Edit tour

Windows Analysis Report
PROFORMA FATURA.exe

Overview

General Information

Sample name:	PROFORMA FATURA.exe
Analysis ID:	1525518
MD5:	49c53c3c0868699a9cbe2ef3d5bfcb8e
SHA1:	3113b54138af9199fd97f96a42542541b6a8fdb3
SHA256:	0ad205b2d883bca56250246f308228379c27f6114d8b740014deeef53b3412bb
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

PROFORMA FATURA.exe (PID: 2672 cmdline: "C:\Users\user\Desktop\PROFORMA FATURA.exe" MD5: 49C53C3C0868699A9CBE2EF3D5BFCB8E)

powershell.exe (PID: 2432 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3800 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 3384 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 3496 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PROFORMA FATURA.exe (PID: 5396 cmdline: "C:\Users\user\Desktop\PROFORMA FATURA.exe" MD5: 49C53C3C0868699A9CBE2EF3D5BFCB8E)

GvgUQlbRIXOe.exe (PID: 6412 cmdline: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe MD5: 49C53C3C0868699A9CBE2EF3D5BFCB8E)

schtasks.exe (PID: 4784 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpBA20.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

GvgUQlbRIXOe.exe (PID: 6112 cmdline: "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe" MD5: 49C53C3C0868699A9CBE2EF3D5BFCB8E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "zqamcx.com", "Username": "sender@zqamcx.com", "Password": "Methodman991"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.4572147923.0000000002C48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.4572408671.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.4572147923.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.4572147923.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.4572408671.0000000002881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.4572408671.0000000002881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PROFORMA FATURA.exe PID: 2672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PROFORMA FATURA.exe PID: 2672	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PROFORMA FATURA.exe PID: 2672	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PROFORMA FATURA.exe PID: 5396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PROFORMA FATURA.exe PID: 5396	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: GvgUQlbRIXOe.exe PID: 6412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GvgUQlbRIXOe.exe PID: 6412	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: GvgUQlbRIXOe.exe PID: 6412	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: GvgUQlbRIXOe.exe PID: 6112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GvgUQlbRIXOe.exe PID: 6112	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33205:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33277:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33301:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33393:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x333fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3346f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33505:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33595:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33205:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33277:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33301:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33393:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x333fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3346f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33505:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33595:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33205:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33277:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33301:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33393:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x333fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3346f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33505:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33595:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PROFORMA FATURA.exe.4ab7388.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PROFORMA FATURA.exe.4ab7388.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PROFORMA FATURA.exe.4ab7388.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33205:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33277:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33301:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33393:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x333fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3346f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33505:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33595:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x71625:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x71697:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71721:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x717b3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x7181d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x7188f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71925:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35395:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x719b5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x71625:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x71697:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71721:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x717b3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x7181d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x7188f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71925:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35395:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x719b5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x71825:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xade45:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x71897:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xadeb7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71921:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xadf41:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x719b3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xadfd3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71a1d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xae03d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x71a8f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xae0af:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71b25:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xae145:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x71825:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xade45:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x71897:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xadeb7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71921:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xadf41:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x719b3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xadfd3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71a1d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xae03d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x71a8f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xae0af:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71b25:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xae145:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 19 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PROFORMA FATURA.exe", ParentImage: C:\Users\user\Desktop\PROFORMA FATURA.exe, ParentProcessId: 2672, ParentProcessName: PROFORMA FATURA.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe", ProcessId: 2432, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpBA20.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpBA20.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe, ParentImage: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe, ParentProcessId: 6412, ParentProcessName: GvgUQlbRIXOe.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpBA20.tmp", ProcessId: 4784, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 78.110.166.82, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\PROFORMA FATURA.exe, Initiated: true, ProcessId: 5396, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 53953

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\PROFORMA FATURA.exe", ParentImage: C:\Users\user\Desktop\PROFORMA FATURA.exe, ParentProcessId: 2672, ParentProcessName: PROFORMA FATURA.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp", ProcessId: 3496, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PROFORMA FATURA.exe", ParentImage: C:\Users\user\Desktop\PROFORMA FATURA.exe, ParentProcessId: 2672, ParentProcessName: PROFORMA FATURA.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe", ProcessId: 2432, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\PROFORMA FATURA.exe", ParentImage: C:\Users\user\Desktop\PROFORMA FATURA.exe, ParentProcessId: 2672, ParentProcessName: PROFORMA FATURA.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp", ProcessId: 3496, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "zqamcx.com", "Username": "sender@zqamcx.com", "Password": "Methodman991"}

Multi AV Scanner detection for domain / URL

Source: zqamcx.com	Virustotal: Detection: 9%			Perma Link
Source: http://zqamcx.com	Virustotal: Detection: 9%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Virustotal: Detection: 56%			Perma Link

Multi AV Scanner detection for submitted file

Source: PROFORMA FATURA.exe	ReversingLabs: Detection: 75%
Source: PROFORMA FATURA.exe	Virustotal: Detection: 56%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: PROFORMA FATURA.exe

Joe Sandbox ML: detected

Source: PROFORMA FATURA.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PROFORMA FATURA.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: ThhL.pdbSHA256g source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr
Source:	Binary string: ThhL.pdb source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 4x nop then jmp 0747B7A6h		0_2_0747B899
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 4x nop then jmp 0721AA06h		11_2_0721AAF9

Source: global traffic

TCP traffic: 192.168.2.6:53953 -> 78.110.166.82:587

Source: Joe Sandbox View

IP Address: 78.110.166.82 78.110.166.82

Source: Joe Sandbox View

ASN Name: UKSERVERS-ASUKDedicatedServersHostingandCo-Location UKSERVERS-ASUKDedicatedServersHostingandCo-Location

Source: global traffic

TCP traffic: 192.168.2.6:53953 -> 78.110.166.82:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: zqamcx.com

Source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: PROFORMA FATURA.exe, 00000009.00000002.4583291405.0000000006252000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0#
Source: PROFORMA FATURA.exe, 00000009.00000002.4583291405.0000000006252000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: PROFORMA FATURA.exe, 00000000.00000002.2170478140.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000B.00000002.2216843841.0000000003260000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PROFORMA FATURA.exe, 00000009.00000002.4583291405.0000000006252000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.0000000006328000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: PROFORMA FATURA.exe, 00000009.00000002.4583291405.0000000006252000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.0000000006328000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zqamcx.com
Source: PROFORMA FATURA.exe, 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4568852604.0000000000437000.00000040.00000400.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, O9KGcRw9bkp.cs	.Net Code: KAZ
Source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack, O9KGcRw9bkp.cs	.Net Code: KAZ

Installs a global keyboard hook

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\PROFORMA FATURA.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 0_2_02CAD5BC	0_2_02CAD5BC
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 0_2_053B6BE0	0_2_053B6BE0
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 0_2_053B0011	0_2_053B0011
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 0_2_053B0040	0_2_053B0040
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 0_2_053B6BD0	0_2_053B6BD0
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 0_2_07477728	0_2_07477728
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 0_2_074756C0	0_2_074756C0
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 0_2_074756D0	0_2_074756D0
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 0_2_07475298	0_2_07475298
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 0_2_07474E60	0_2_07474E60
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 0_2_07476D78	0_2_07476D78
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_00DA4A88	9_2_00DA4A88
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_00DA9B40	9_2_00DA9B40
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_00DACDC0	9_2_00DACDC0
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_00DA3E70	9_2_00DA3E70
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_00DA41B8	9_2_00DA41B8
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_00DAF4A8	9_2_00DAF4A8
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_0551C900	9_2_0551C900
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_05511010	9_2_05511010
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_055113D8	9_2_055113D8
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_0551F2D0	9_2_0551F2D0
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_05D6DD3D	9_2_05D6DD3D
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_05D68C0A	9_2_05D68C0A
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_05D65760	9_2_05D65760
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_05D62F08	9_2_05D62F08
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_05D63F38	9_2_05D63F38
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_05D60040	9_2_05D60040
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_05D6BD90	9_2_05D6BD90
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_05D63637	9_2_05D63637
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_05D649E8	9_2_05D649E8
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 9_2_05D65068	9_2_05D65068
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 11_2_0163D5BC	11_2_0163D5BC
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 11_2_05556BE0	11_2_05556BE0
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 11_2_05550040	11_2_05550040
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 11_2_05550006	11_2_05550006
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 11_2_05556BD0	11_2_05556BD0
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 11_2_07214E60	11_2_07214E60
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 11_2_07217728	11_2_07217728
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 11_2_072156C0	11_2_072156C0
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 11_2_072156D0	11_2_072156D0
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 11_2_07215298	11_2_07215298
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 11_2_07216D78	11_2_07216D78
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_010E41B8	14_2_010E41B8
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_010E9B40	14_2_010E9B40
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_010E4A88	14_2_010E4A88
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_010ECDC0	14_2_010ECDC0
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_010E3E70	14_2_010E3E70
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_010EF4B9	14_2_010EF4B9
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_05FCDD3D	14_2_05FCDD3D
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_05FC8C0B	14_2_05FC8C0B
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_05FC5760	14_2_05FC5760
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_05FC3F38	14_2_05FC3F38
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_05FC2F08	14_2_05FC2F08
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_05FC0040	14_2_05FC0040
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_05FCBD90	14_2_05FCBD90
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_05FC3637	14_2_05FC3637
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_05FC49E8	14_2_05FC49E8
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_05FC5068	14_2_05FC5068

Source: PROFORMA FATURA.exe

Static PE information: invalid certificate

Source: PROFORMA FATURA.exe, 00000000.00000000.2115763119.0000000000B28000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameThhL.exe@ vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000000.00000002.2169367415.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000000.00000002.2171035964.0000000004712000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000000.00000002.2170478140.00000000030F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb9cb78e8-c1d3-4ab9-8530-a3a5b5ca79e5.exe4 vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000000.00000002.2175247224.000000000A080000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb9cb78e8-c1d3-4ab9-8530-a3a5b5ca79e5.exe4 vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000009.00000002.4569368222.00000000007F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000009.00000002.4568852604.0000000000439000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb9cb78e8-c1d3-4ab9-8530-a3a5b5ca79e5.exe4 vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe	Binary or memory string: OriginalFilenameThhL.exe@ vs PROFORMA FATURA.exe

Source: PROFORMA FATURA.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: PROFORMA FATURA.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: GvgUQlbRIXOe.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, EgTglEucnUn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, EgTglEucnUn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, MmVR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, MmVR.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, EGW1In2sxEk72sqfx8.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, EGW1In2sxEk72sqfx8.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, EGW1In2sxEk72sqfx8.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, YytYwTXRVn7U81VOno.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, YytYwTXRVn7U81VOno.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, EGW1In2sxEk72sqfx8.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, EGW1In2sxEk72sqfx8.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, EGW1In2sxEk72sqfx8.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, EGW1In2sxEk72sqfx8.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, EGW1In2sxEk72sqfx8.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, EGW1In2sxEk72sqfx8.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, YytYwTXRVn7U81VOno.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@1/1

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

File created: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6068:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:948:120:WilError_03
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Mutant created: \Sessions\1\BaseNamedObjects\LUhAgCfBCnbQ

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

File created: C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp

Jump to behavior

Source: PROFORMA FATURA.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PROFORMA FATURA.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PROFORMA FATURA.exe	ReversingLabs: Detection: 75%
Source: PROFORMA FATURA.exe	Virustotal: Detection: 56%

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

File read: C:\Users\user\Desktop\PROFORMA FATURA.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PROFORMA FATURA.exe "C:\Users\user\Desktop\PROFORMA FATURA.exe"
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Users\user\Desktop\PROFORMA FATURA.exe "C:\Users\user\Desktop\PROFORMA FATURA.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpBA20.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process created: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Users\user\Desktop\PROFORMA FATURA.exe "C:\Users\user\Desktop\PROFORMA FATURA.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpBA20.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process created: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: PROFORMA FATURA.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PROFORMA FATURA.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: PROFORMA FATURA.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ThhL.pdbSHA256g source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr
Source:	Binary string: ThhL.pdb source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: PROFORMA FATURA.exe, Form1.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: GvgUQlbRIXOe.exe.0.dr, Form1.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.PROFORMA FATURA.exe.3efa190.3.raw.unpack, MainForm.cs	.Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.PROFORMA FATURA.exe.59d0000.5.raw.unpack, MainForm.cs	.Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, EGW1In2sxEk72sqfx8.cs	.Net Code: yZlktfWd1o System.Reflection.Assembly.Load(byte[])
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, EGW1In2sxEk72sqfx8.cs	.Net Code: yZlktfWd1o System.Reflection.Assembly.Load(byte[])
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, EGW1In2sxEk72sqfx8.cs	.Net Code: yZlktfWd1o System.Reflection.Assembly.Load(byte[])

Source: PROFORMA FATURA.exe

Static PE information: 0xDEBF553A [Thu Jun 3 06:05:46 2088 UTC]

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Code function: 0_2_0747E7ED push FFFFFF8Bh; iretd	0_2_0747E7EF
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 11_2_0721DA4D push FFFFFF8Bh; iretd	11_2_0721DA4F
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Code function: 14_2_05FCF708 push F4057CCFh; iretd	14_2_05FCF711

Source: PROFORMA FATURA.exe	Static PE information: section name: .text entropy: 7.502265215302294
Source: GvgUQlbRIXOe.exe.0.dr	Static PE information: section name: .text entropy: 7.502265215302294

Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, g4Qs8M5oWwROxbKec3.cs	High entropy of concatenated method names: 'fGG6ov0mZ1', 'z9861YA9qS', 'O8W6tBllRO', 'RZf6Ev8JCW', 'c1q6JVyrhH', 'qFy6l03KBO', 'v4E60y3waN', 'XgV69ehsdG', 'FLQ6ZwkB9k', 'QcI6aJgQw9'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, zgxQIxz5lAukYUxvcV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LYurI4lJjl', 'DZQre7PP7g', 'AetrDsDgK8', 'b1KrN59af1', 'SJmrOnkyC9', 'PAZrrXZ5KF', 'AFYr24Uy4L'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, JTnk9wqS5upEMWkVDI.cs	High entropy of concatenated method names: 'GODHWatdyD3ai5D1mqb', 'wX7NoKtHR7EPQpZs1Cu', 'rl9HOgrwQ3', 'obXHrWJFf7', 'fOTH2E62eW', 'DNVxNAt0Ia2l0xdeW2U', 'g4ZJ6stceAIeDFVhj9b'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, SIM1vrU83M80n3ghnSU.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HHt27t0dj1', 'P6e25Aj47u', 'f822nRZ0KS', 'kry2gEkAIN', 'dFk2mY6FjV', 'hlY2RQK7k7', 'nn82crIklZ'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, a9Jf6RK6DvE2Wnfcjo.cs	High entropy of concatenated method names: 'SgFOKOZ7jN', 'hdPO3nLxXA', 'IuCOpkPas1', 'nCWOSFBJaE', 'PrwOHREnrc', 'GqfO6MTlq0', 'xlFOd5LqVr', 'FcyOP1ioIq', 'bSVO8SuU9p', 'wNrOMyTk2S'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, KGrF0bFArvIPSaM0rx.cs	High entropy of concatenated method names: 'j7R6KrOXAv', 'vlK6pleJPp', 'bDd6H6KmlL', 'pa4Hu9CPFO', 'Q6GHzydtKx', 'nTc64MpboE', 'C5f6X89O3m', 'FLo6LyareV', 'sdO6jnCGYy', 'uub6kiZVeu'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, EGW1In2sxEk72sqfx8.cs	High entropy of concatenated method names: 'w8ijq3hQbi', 'RZjjKT3yWN', 'InBj3trNVt', 'frpjpLw6f9', 'GonjSyJEsT', 'nMojHN4oJc', 'a3rj6s71t0', 'BEPjdDGFqu', 'zfPjPpH7wZ', 'Fw3j85RExc'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, JGt8leideG3tEw3FFw.cs	High entropy of concatenated method names: 'p8BX69Chcm', 'UdpXdAgx8X', 'pTdX8nRXOG', 'Y1DXM4BNDw', 'IPBXeP2W5U', 'V47XDb8nZZ', 'M7WVG0WMmBLAQT0Nk1', 'GrTuMf1AHyW0wtkhgm', 'kiVgIFkicWxHjSBOOQ', 'wITXXrC79k'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, qq8b56hyCVeqo4mhxD.cs	High entropy of concatenated method names: 'L2VOWS122e', 'e0JOACvmn6', 'JH3OQf8KJ5', 'l0pOsWDL3b', 'HFCO7ep4Xh', 'VePOiTR8oR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, z5urZkslVeJkKSP9xS.cs	High entropy of concatenated method names: 'l2EeT1qhRI', 'jYeebNyP8b', 'Cmle7GWpFr', 'OT6e54YlQW', 'lK0eAyVwwA', 'vv2eQSSfsl', 'nOfesef6a5', 'iCIeiMNFnj', 'lJdewQnU0s', 'q2HeCgVLQP'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, LpC6HlESRmbB0HCWjb.cs	High entropy of concatenated method names: 'I1IrXvySP7', 'bPRrjLiKld', 'zIsrk9F5nP', 'GN0rKWEyxT', 'dO3r3vuvGE', 'kwvrSguksF', 'mHirH1VBOu', 'rwVOc3f1Eh', 'hFUOhxg0HP', 'quZOy4Json'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, FpLxU0USGQJ0hASUnF9.cs	High entropy of concatenated method names: 'vyLrojyPsh', 'd6Wr1VCg7Y', 'twlrtyio0H', 'LMtrEGXROm', 'e4JrJ8F9g8', 'juxrlZSMbK', 'J8Hr0byZk5', 'iY4r946lWx', 'kTbrZnahfs', 'KErraLc6ld'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, EQSd2GR5QIKoQb3pwL.cs	High entropy of concatenated method names: 'Dispose', 'FMbXyt4mVu', 'gB4LAHpEeU', 'XbiVVNu8KF', 'BaPXueQq8L', 'rdMXzu6F6m', 'ProcessDialogKey', 'hDoL4o7n0C', 'tI5LXTJfFI', 'mHSLLMvn5X'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, YytYwTXRVn7U81VOno.cs	High entropy of concatenated method names: 'i0p37pHOV4', 'cqL35EtsJm', 'sDZ3noBtXj', 'Fpe3g5miCu', 'CEN3m3L8eX', 'sXF3RfPcUB', 'EZr3cbFn9p', 'mFo3hnHetx', 'QNh3y2YjO1', 'HYU3u0bxtc'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, VkYf5BPjdXsGlTY65o.cs	High entropy of concatenated method names: 'SxIpEN6DTu', 'nckplmVpkn', 'SZIp9KW9iu', 'JffpZ40gCj', 'qohpeXV1ti', 'yvMpDKy4ev', 'LTppNWvUGU', 'ypOpOYiyNg', 'NI7pr08V0a', 'IFhp2ElSPx'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, MCfrSMWdlxWVY1IL1f.cs	High entropy of concatenated method names: 'ID3I9I8why', 'sPsIZDLsUK', 'RjbIW0rOAZ', 'LHBIA7rIpf', 'q5pIsyM4ff', 'sC1IipnrZd', 'jwPICf1Uxx', 'QPwIGGvWyw', 'XaxITJdgdg', 'CRWIf1WYjN'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, boHndMrnP1k12e3lIF.cs	High entropy of concatenated method names: 'a69Nh8xuT6', 'eHYNubMpPh', 'C37O4cOH0m', 'P1FOXmZ7Re', 'byHNfIywoB', 'oYUNbRyQaL', 'wUrNYDV574', 'q5XN7EYIHj', 'ICSN5RR8PQ', 'X5HNndBiEf'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, CFC8oSAR2QsHjWaGqv.cs	High entropy of concatenated method names: 'gXXtV7N8f', 'VM9EyVCGl', 'gEDlu2red', 'MDQ0i5x24', 'FeqZNnCFY', 'pJGahV8rN', 'vLFOcvFxvkQxqmT7ZW', 'Mla4EfKO5pGeg00Eew', 'Br2OaRLQA', 'hay2g3TJH'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, J4ugg54wIbg5846ALq.cs	High entropy of concatenated method names: 'la7Hq9VSxc', 'aOHH3yGFAY', 'ItIHS3DB6v', 'YJQH6lopwl', 'ErwHdj0tBY', 't9oSmkXEcX', 'MtPSRBLA0Y', 'kBpScqIPBb', 'XSUShWqoe0', 'WnNSyEt9bp'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, hIIN84dB4yLGgx3Xmo.cs	High entropy of concatenated method names: 'KNFN8NcRIV', 'OvDNMdJccD', 'ToString', 'HSwNKchN9D', 'PYYN33RFbY', 'iYFNprc0lR', 'X0GNSISsMI', 'VpcNHWkyAr', 'yD1N6uIZ7j', 'SPfNdnynLO'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, g4Qs8M5oWwROxbKec3.cs	High entropy of concatenated method names: 'fGG6ov0mZ1', 'z9861YA9qS', 'O8W6tBllRO', 'RZf6Ev8JCW', 'c1q6JVyrhH', 'qFy6l03KBO', 'v4E60y3waN', 'XgV69ehsdG', 'FLQ6ZwkB9k', 'QcI6aJgQw9'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, zgxQIxz5lAukYUxvcV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LYurI4lJjl', 'DZQre7PP7g', 'AetrDsDgK8', 'b1KrN59af1', 'SJmrOnkyC9', 'PAZrrXZ5KF', 'AFYr24Uy4L'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, JTnk9wqS5upEMWkVDI.cs	High entropy of concatenated method names: 'GODHWatdyD3ai5D1mqb', 'wX7NoKtHR7EPQpZs1Cu', 'rl9HOgrwQ3', 'obXHrWJFf7', 'fOTH2E62eW', 'DNVxNAt0Ia2l0xdeW2U', 'g4ZJ6stceAIeDFVhj9b'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, SIM1vrU83M80n3ghnSU.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HHt27t0dj1', 'P6e25Aj47u', 'f822nRZ0KS', 'kry2gEkAIN', 'dFk2mY6FjV', 'hlY2RQK7k7', 'nn82crIklZ'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, a9Jf6RK6DvE2Wnfcjo.cs	High entropy of concatenated method names: 'SgFOKOZ7jN', 'hdPO3nLxXA', 'IuCOpkPas1', 'nCWOSFBJaE', 'PrwOHREnrc', 'GqfO6MTlq0', 'xlFOd5LqVr', 'FcyOP1ioIq', 'bSVO8SuU9p', 'wNrOMyTk2S'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, KGrF0bFArvIPSaM0rx.cs	High entropy of concatenated method names: 'j7R6KrOXAv', 'vlK6pleJPp', 'bDd6H6KmlL', 'pa4Hu9CPFO', 'Q6GHzydtKx', 'nTc64MpboE', 'C5f6X89O3m', 'FLo6LyareV', 'sdO6jnCGYy', 'uub6kiZVeu'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, EGW1In2sxEk72sqfx8.cs	High entropy of concatenated method names: 'w8ijq3hQbi', 'RZjjKT3yWN', 'InBj3trNVt', 'frpjpLw6f9', 'GonjSyJEsT', 'nMojHN4oJc', 'a3rj6s71t0', 'BEPjdDGFqu', 'zfPjPpH7wZ', 'Fw3j85RExc'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, JGt8leideG3tEw3FFw.cs	High entropy of concatenated method names: 'p8BX69Chcm', 'UdpXdAgx8X', 'pTdX8nRXOG', 'Y1DXM4BNDw', 'IPBXeP2W5U', 'V47XDb8nZZ', 'M7WVG0WMmBLAQT0Nk1', 'GrTuMf1AHyW0wtkhgm', 'kiVgIFkicWxHjSBOOQ', 'wITXXrC79k'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, qq8b56hyCVeqo4mhxD.cs	High entropy of concatenated method names: 'L2VOWS122e', 'e0JOACvmn6', 'JH3OQf8KJ5', 'l0pOsWDL3b', 'HFCO7ep4Xh', 'VePOiTR8oR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, z5urZkslVeJkKSP9xS.cs	High entropy of concatenated method names: 'l2EeT1qhRI', 'jYeebNyP8b', 'Cmle7GWpFr', 'OT6e54YlQW', 'lK0eAyVwwA', 'vv2eQSSfsl', 'nOfesef6a5', 'iCIeiMNFnj', 'lJdewQnU0s', 'q2HeCgVLQP'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, LpC6HlESRmbB0HCWjb.cs	High entropy of concatenated method names: 'I1IrXvySP7', 'bPRrjLiKld', 'zIsrk9F5nP', 'GN0rKWEyxT', 'dO3r3vuvGE', 'kwvrSguksF', 'mHirH1VBOu', 'rwVOc3f1Eh', 'hFUOhxg0HP', 'quZOy4Json'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, FpLxU0USGQJ0hASUnF9.cs	High entropy of concatenated method names: 'vyLrojyPsh', 'd6Wr1VCg7Y', 'twlrtyio0H', 'LMtrEGXROm', 'e4JrJ8F9g8', 'juxrlZSMbK', 'J8Hr0byZk5', 'iY4r946lWx', 'kTbrZnahfs', 'KErraLc6ld'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, EQSd2GR5QIKoQb3pwL.cs	High entropy of concatenated method names: 'Dispose', 'FMbXyt4mVu', 'gB4LAHpEeU', 'XbiVVNu8KF', 'BaPXueQq8L', 'rdMXzu6F6m', 'ProcessDialogKey', 'hDoL4o7n0C', 'tI5LXTJfFI', 'mHSLLMvn5X'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, YytYwTXRVn7U81VOno.cs	High entropy of concatenated method names: 'i0p37pHOV4', 'cqL35EtsJm', 'sDZ3noBtXj', 'Fpe3g5miCu', 'CEN3m3L8eX', 'sXF3RfPcUB', 'EZr3cbFn9p', 'mFo3hnHetx', 'QNh3y2YjO1', 'HYU3u0bxtc'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, VkYf5BPjdXsGlTY65o.cs	High entropy of concatenated method names: 'SxIpEN6DTu', 'nckplmVpkn', 'SZIp9KW9iu', 'JffpZ40gCj', 'qohpeXV1ti', 'yvMpDKy4ev', 'LTppNWvUGU', 'ypOpOYiyNg', 'NI7pr08V0a', 'IFhp2ElSPx'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, MCfrSMWdlxWVY1IL1f.cs	High entropy of concatenated method names: 'ID3I9I8why', 'sPsIZDLsUK', 'RjbIW0rOAZ', 'LHBIA7rIpf', 'q5pIsyM4ff', 'sC1IipnrZd', 'jwPICf1Uxx', 'QPwIGGvWyw', 'XaxITJdgdg', 'CRWIf1WYjN'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, boHndMrnP1k12e3lIF.cs	High entropy of concatenated method names: 'a69Nh8xuT6', 'eHYNubMpPh', 'C37O4cOH0m', 'P1FOXmZ7Re', 'byHNfIywoB', 'oYUNbRyQaL', 'wUrNYDV574', 'q5XN7EYIHj', 'ICSN5RR8PQ', 'X5HNndBiEf'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, CFC8oSAR2QsHjWaGqv.cs	High entropy of concatenated method names: 'gXXtV7N8f', 'VM9EyVCGl', 'gEDlu2red', 'MDQ0i5x24', 'FeqZNnCFY', 'pJGahV8rN', 'vLFOcvFxvkQxqmT7ZW', 'Mla4EfKO5pGeg00Eew', 'Br2OaRLQA', 'hay2g3TJH'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, J4ugg54wIbg5846ALq.cs	High entropy of concatenated method names: 'la7Hq9VSxc', 'aOHH3yGFAY', 'ItIHS3DB6v', 'YJQH6lopwl', 'ErwHdj0tBY', 't9oSmkXEcX', 'MtPSRBLA0Y', 'kBpScqIPBb', 'XSUShWqoe0', 'WnNSyEt9bp'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, hIIN84dB4yLGgx3Xmo.cs	High entropy of concatenated method names: 'KNFN8NcRIV', 'OvDNMdJccD', 'ToString', 'HSwNKchN9D', 'PYYN33RFbY', 'iYFNprc0lR', 'X0GNSISsMI', 'VpcNHWkyAr', 'yD1N6uIZ7j', 'SPfNdnynLO'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, g4Qs8M5oWwROxbKec3.cs	High entropy of concatenated method names: 'fGG6ov0mZ1', 'z9861YA9qS', 'O8W6tBllRO', 'RZf6Ev8JCW', 'c1q6JVyrhH', 'qFy6l03KBO', 'v4E60y3waN', 'XgV69ehsdG', 'FLQ6ZwkB9k', 'QcI6aJgQw9'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, zgxQIxz5lAukYUxvcV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LYurI4lJjl', 'DZQre7PP7g', 'AetrDsDgK8', 'b1KrN59af1', 'SJmrOnkyC9', 'PAZrrXZ5KF', 'AFYr24Uy4L'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, JTnk9wqS5upEMWkVDI.cs	High entropy of concatenated method names: 'GODHWatdyD3ai5D1mqb', 'wX7NoKtHR7EPQpZs1Cu', 'rl9HOgrwQ3', 'obXHrWJFf7', 'fOTH2E62eW', 'DNVxNAt0Ia2l0xdeW2U', 'g4ZJ6stceAIeDFVhj9b'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, SIM1vrU83M80n3ghnSU.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HHt27t0dj1', 'P6e25Aj47u', 'f822nRZ0KS', 'kry2gEkAIN', 'dFk2mY6FjV', 'hlY2RQK7k7', 'nn82crIklZ'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, a9Jf6RK6DvE2Wnfcjo.cs	High entropy of concatenated method names: 'SgFOKOZ7jN', 'hdPO3nLxXA', 'IuCOpkPas1', 'nCWOSFBJaE', 'PrwOHREnrc', 'GqfO6MTlq0', 'xlFOd5LqVr', 'FcyOP1ioIq', 'bSVO8SuU9p', 'wNrOMyTk2S'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, KGrF0bFArvIPSaM0rx.cs	High entropy of concatenated method names: 'j7R6KrOXAv', 'vlK6pleJPp', 'bDd6H6KmlL', 'pa4Hu9CPFO', 'Q6GHzydtKx', 'nTc64MpboE', 'C5f6X89O3m', 'FLo6LyareV', 'sdO6jnCGYy', 'uub6kiZVeu'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, EGW1In2sxEk72sqfx8.cs	High entropy of concatenated method names: 'w8ijq3hQbi', 'RZjjKT3yWN', 'InBj3trNVt', 'frpjpLw6f9', 'GonjSyJEsT', 'nMojHN4oJc', 'a3rj6s71t0', 'BEPjdDGFqu', 'zfPjPpH7wZ', 'Fw3j85RExc'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, JGt8leideG3tEw3FFw.cs	High entropy of concatenated method names: 'p8BX69Chcm', 'UdpXdAgx8X', 'pTdX8nRXOG', 'Y1DXM4BNDw', 'IPBXeP2W5U', 'V47XDb8nZZ', 'M7WVG0WMmBLAQT0Nk1', 'GrTuMf1AHyW0wtkhgm', 'kiVgIFkicWxHjSBOOQ', 'wITXXrC79k'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, qq8b56hyCVeqo4mhxD.cs	High entropy of concatenated method names: 'L2VOWS122e', 'e0JOACvmn6', 'JH3OQf8KJ5', 'l0pOsWDL3b', 'HFCO7ep4Xh', 'VePOiTR8oR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, z5urZkslVeJkKSP9xS.cs	High entropy of concatenated method names: 'l2EeT1qhRI', 'jYeebNyP8b', 'Cmle7GWpFr', 'OT6e54YlQW', 'lK0eAyVwwA', 'vv2eQSSfsl', 'nOfesef6a5', 'iCIeiMNFnj', 'lJdewQnU0s', 'q2HeCgVLQP'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, LpC6HlESRmbB0HCWjb.cs	High entropy of concatenated method names: 'I1IrXvySP7', 'bPRrjLiKld', 'zIsrk9F5nP', 'GN0rKWEyxT', 'dO3r3vuvGE', 'kwvrSguksF', 'mHirH1VBOu', 'rwVOc3f1Eh', 'hFUOhxg0HP', 'quZOy4Json'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, FpLxU0USGQJ0hASUnF9.cs	High entropy of concatenated method names: 'vyLrojyPsh', 'd6Wr1VCg7Y', 'twlrtyio0H', 'LMtrEGXROm', 'e4JrJ8F9g8', 'juxrlZSMbK', 'J8Hr0byZk5', 'iY4r946lWx', 'kTbrZnahfs', 'KErraLc6ld'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, EQSd2GR5QIKoQb3pwL.cs	High entropy of concatenated method names: 'Dispose', 'FMbXyt4mVu', 'gB4LAHpEeU', 'XbiVVNu8KF', 'BaPXueQq8L', 'rdMXzu6F6m', 'ProcessDialogKey', 'hDoL4o7n0C', 'tI5LXTJfFI', 'mHSLLMvn5X'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, YytYwTXRVn7U81VOno.cs	High entropy of concatenated method names: 'i0p37pHOV4', 'cqL35EtsJm', 'sDZ3noBtXj', 'Fpe3g5miCu', 'CEN3m3L8eX', 'sXF3RfPcUB', 'EZr3cbFn9p', 'mFo3hnHetx', 'QNh3y2YjO1', 'HYU3u0bxtc'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, VkYf5BPjdXsGlTY65o.cs	High entropy of concatenated method names: 'SxIpEN6DTu', 'nckplmVpkn', 'SZIp9KW9iu', 'JffpZ40gCj', 'qohpeXV1ti', 'yvMpDKy4ev', 'LTppNWvUGU', 'ypOpOYiyNg', 'NI7pr08V0a', 'IFhp2ElSPx'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, MCfrSMWdlxWVY1IL1f.cs	High entropy of concatenated method names: 'ID3I9I8why', 'sPsIZDLsUK', 'RjbIW0rOAZ', 'LHBIA7rIpf', 'q5pIsyM4ff', 'sC1IipnrZd', 'jwPICf1Uxx', 'QPwIGGvWyw', 'XaxITJdgdg', 'CRWIf1WYjN'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, boHndMrnP1k12e3lIF.cs	High entropy of concatenated method names: 'a69Nh8xuT6', 'eHYNubMpPh', 'C37O4cOH0m', 'P1FOXmZ7Re', 'byHNfIywoB', 'oYUNbRyQaL', 'wUrNYDV574', 'q5XN7EYIHj', 'ICSN5RR8PQ', 'X5HNndBiEf'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, CFC8oSAR2QsHjWaGqv.cs	High entropy of concatenated method names: 'gXXtV7N8f', 'VM9EyVCGl', 'gEDlu2red', 'MDQ0i5x24', 'FeqZNnCFY', 'pJGahV8rN', 'vLFOcvFxvkQxqmT7ZW', 'Mla4EfKO5pGeg00Eew', 'Br2OaRLQA', 'hay2g3TJH'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, J4ugg54wIbg5846ALq.cs	High entropy of concatenated method names: 'la7Hq9VSxc', 'aOHH3yGFAY', 'ItIHS3DB6v', 'YJQH6lopwl', 'ErwHdj0tBY', 't9oSmkXEcX', 'MtPSRBLA0Y', 'kBpScqIPBb', 'XSUShWqoe0', 'WnNSyEt9bp'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, hIIN84dB4yLGgx3Xmo.cs	High entropy of concatenated method names: 'KNFN8NcRIV', 'OvDNMdJccD', 'ToString', 'HSwNKchN9D', 'PYYN33RFbY', 'iYFNprc0lR', 'X0GNSISsMI', 'VpcNHWkyAr', 'yD1N6uIZ7j', 'SPfNdnynLO'

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

File created: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: PROFORMA FATURA.exe PID: 2672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6412, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: 2C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: 2E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: 7980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: 8980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: 8B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: 9B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: A100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: B100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: C100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: 2880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory allocated: 4880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: 1630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: 3000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: 5000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: 7A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: 8A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: 8BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: 9BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: 9F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: AF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: BF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: 10E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory allocated: 4BD0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6979	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7524	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1408	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Window / User API: threadDelayed 5378	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Window / User API: threadDelayed 4439	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Window / User API: threadDelayed 6586
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Window / User API: threadDelayed 3269

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 3108	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4892	Thread sleep count: 6979 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4892	Thread sleep count: 240 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7028	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 404	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6268	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2016	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 4236	Thread sleep count: 5378 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 4236	Thread sleep count: 4439 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99654s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -98980s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -98749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -98403s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -98296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -98186s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -98010s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -97895s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -97777s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -97671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -97559s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -97452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -97343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -97234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -97124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -97015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -96906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -96796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -96687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -96577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -96468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -96359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -96249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -96140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -96017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -95906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -95796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -95678s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -95562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -95446s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 7100	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 2848	Thread sleep count: 6586 > 30
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 2848	Thread sleep count: 3269 > 30
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99780s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99671s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99561s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99453s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99343s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99220s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99094s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -98984s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -98874s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -98714s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -98216s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -98109s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -97998s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -97888s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -97779s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -97671s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -97562s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -97450s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -97343s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -97234s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -97124s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -97015s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -96906s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -96797s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -96687s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -96578s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -96468s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -96359s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -96250s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -96140s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -96031s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -95921s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99984s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99547s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99437s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99218s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -98890s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -98781s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -98672s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -98562s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -98453s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -98343s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208	Thread sleep time: -98234s >= -30000s

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99874	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99654	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99421	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99093	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 98980	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 98749	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 98403	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 98296	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 98186	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 98010	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 97895	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 97777	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 97671	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 97559	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 97452	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 97343	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 97234	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 97124	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 97015	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 96906	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 96796	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 96687	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 96577	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 96468	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 96359	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 96249	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 96140	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 96017	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 95906	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 95796	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 95678	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 95562	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 95446	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99780
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99671
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99561
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99453
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99343
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99220
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99094
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 98984
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 98874
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 98714
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 98216
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 98109
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 97998
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 97888
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 97779
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 97671
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 97562
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 97450
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 97343
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 97234
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 97124
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 97015
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 96906
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 96797
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 96687
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 96578
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 96468
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 96359
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 96250
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 96140
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 96031
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 95921
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99984
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99765
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99547
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99437
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99218
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 98890
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 98781
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 98672
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 98562
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 98453
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 98343
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Thread delayed: delay time: 98234

Source: PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe"
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Memory written: C:\Users\user\Desktop\PROFORMA FATURA.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Memory written: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Process created: C:\Users\user\Desktop\PROFORMA FATURA.exe "C:\Users\user\Desktop\PROFORMA FATURA.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpBA20.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Process created: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Queries volume information: C:\Users\user\Desktop\PROFORMA FATURA.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Queries volume information: C:\Users\user\Desktop\PROFORMA FATURA.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Queries volume information: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Queries volume information: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA.exe.4ab7388.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4572147923.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4572408671.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4572147923.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4572408671.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PROFORMA FATURA.exe PID: 2672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PROFORMA FATURA.exe PID: 5396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6112, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA.exe.4ab7388.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4572147923.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4572408671.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PROFORMA FATURA.exe PID: 2672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PROFORMA FATURA.exe PID: 5396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6112, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA.exe.4ab7388.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4572147923.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4572408671.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4572147923.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4572408671.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PROFORMA FATURA.exe PID: 2672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PROFORMA FATURA.exe PID: 5396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6112, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	21 Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PROFORMA FATURA.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeKeylogger
PROFORMA FATURA.exe	57%	Virustotal		Browse
PROFORMA FATURA.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeKeylogger
C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe	57%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
zqamcx.com	9%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r11.i.lencr.org/0#	0%	Virustotal		Browse
http://zqamcx.com	9%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
zqamcx.com	78.110.166.82	true	true	9%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://zqamcx.com	PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	true	9%, Virustotal, Browse	unknown
https://account.dyn.com/	PROFORMA FATURA.exe, 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4568852604.0000000000437000.00000040.00000400.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r11.o.lencr.org0#	PROFORMA FATURA.exe, 00000009.00000002.4583291405.0000000006252000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PROFORMA FATURA.exe, 00000000.00000002.2170478140.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000B.00000002.2216843841.0000000003260000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr	false	URL Reputation: safe	unknown
http://r11.i.lencr.org/0#	PROFORMA FATURA.exe, 00000009.00000002.4583291405.0000000006252000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://x1.c.lencr.org/0	PROFORMA FATURA.exe, 00000009.00000002.4583291405.0000000006252000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.0000000006328000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	PROFORMA FATURA.exe, 00000009.00000002.4583291405.0000000006252000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.0000000006328000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.110.166.82	zqamcx.com	United Kingdom		42831	UKSERVERS-ASUKDedicatedServersHostingandCo-Location	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525518
Start date and time:	2024-10-04 10:59:53 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PROFORMA FATURA.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 182 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:00:43	API Interceptor	8540099x Sleep call for process: PROFORMA FATURA.exe modified
05:00:46	API Interceptor	28x Sleep call for process: powershell.exe modified
05:00:48	API Interceptor	6208296x Sleep call for process: GvgUQlbRIXOe.exe modified
11:00:48	Task Scheduler	Run new task: GvgUQlbRIXOe path: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
78.110.166.82	COB756883.vbs	Get hash	malicious	CobaltStrike	Browse	windowsupdatesolutions.com/ServerCOB.txt
	Ingreso_SII_Abril_2021.cmd	Get hash	malicious	Unknown	Browse	www.emolcl.com/namaste/puma.php
	Ingreso_SII_Abril_2021.cmd	Get hash	malicious	Unknown	Browse	www.emolcl.com/namaste/puma.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
zqamcx.com	eFatura_ETN2024000000575_Ekleri.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
zqamcx.com	SecuriteInfo.com.Win32.MalwareX-gen.16545.12050.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UKSERVERS-ASUKDedicatedServersHostingandCo-Location	30% SWIFT COPY DOWN PAYMENT-PDF.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	z1quote93039-pdf.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	z25RFQ945894-PDF.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	https://client31.webvalue.party/wp-content/uploads/weTranser_edited/weTranser_edited/index.php/	Get hash	malicious	Unknown	Browse	5.101.173.45
	https://client31.webvalue.party/wp-content/uploads/weTranser_edited/weTranser_edited/index.php?email%5C=3mail@b.c	Get hash	malicious	Unknown	Browse	5.101.173.45
	450230549.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	CCE_000110.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	https://qrplanet.com/smdv5p/	Get hash	malicious	Unknown	Browse	5.101.173.45
	22.09.2024-22.09.2024.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	FaturaHat#U0131rlatma.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82

Process:	C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PROFORMA FATURA.exe.log

Download File

Process:	C:\Users\user\Desktop\PROFORMA FATURA.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379736180876081
Encrypted:	false
SSDEEP:	48:tWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZSUyus:tLHyIFKL3IZ2KRH9Oug0s
MD5:	23D14C8875D63B191CE7B80A7E0DA611
SHA1:	61513364D1EA206DE2F86EA8CC14366BBE337FF4
SHA-256:	1FF046748DCF57390C0519EF9CB2DE9C3ACD0B7D202A735346CEFEFC1B88CB78
SHA-512:	6319AB379B2610ED0FDC6A3733E43995511DC444874FD880A78C4D144F3C10831A6191F157D49A2802E8620E24046F1D272A06367EA9C11F0FD4B1468465E128
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3e0sehfq.oqt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_afmzpfvl.yoc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bc1nzdf0.2dh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzk50qgb.gmp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nl20zavh.ruo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rafy1dfb.xgx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sozpsjhb.ot2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v1drupbt.qiz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp

Download File

Process:	C:\Users\user\Desktop\PROFORMA FATURA.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1599
Entropy (8bit):	5.100235785500619
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLXxvn:cge7QYrFdOFzOzN33ODOiDdKrsuTtv
MD5:	D84EE81413BCE94AAD796C8A69D969D3
SHA1:	1F9A55D47460C0E956D33DEB5AFD15E6B33E1B60
SHA-256:	7B8B22FE621C7147A3967B3B1E7DB8C6691F7F371F2F9689F720D9D1FF77C083
SHA-512:	2E9134B8948C581BAE325F596219A471307DE32B6D7A3657B5C8C112FA27C3677E105C63152265E37D15F04B5D66E8F621FA8621B1290418AAFA31FB7369629B
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Local\Temp\tmpBA20.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1599
Entropy (8bit):	5.100235785500619
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLXxvn:cge7QYrFdOFzOzN33ODOiDdKrsuTtv
MD5:	D84EE81413BCE94AAD796C8A69D969D3
SHA1:	1F9A55D47460C0E956D33DEB5AFD15E6B33E1B60
SHA-256:	7B8B22FE621C7147A3967B3B1E7DB8C6691F7F371F2F9689F720D9D1FF77C083
SHA-512:	2E9134B8948C581BAE325F596219A471307DE32B6D7A3657B5C8C112FA27C3677E105C63152265E37D15F04B5D66E8F621FA8621B1290418AAFA31FB7369629B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe

Download File

Process:	C:\Users\user\Desktop\PROFORMA FATURA.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	823816
Entropy (8bit):	7.509349012348611
Encrypted:	false
SSDEEP:	12288:DrG4eUyzwoF6w7g9vZ7Bw6/992kJ9TaRdxkYv8HrAvTmeXNig8g7N5hkR:WvUClwR7BVvRJ9GOted77Ni
MD5:	49C53C3C0868699A9CBE2EF3D5BFCB8E
SHA1:	3113B54138AF9199FD97F96A42542541B6A8FDB3
SHA-256:	0AD205B2D883BCA56250246F308228379C27F6114D8B740014DEEEF53B3412BB
SHA-512:	2A3A51767F4409A70E5FFF84468A0AEBD2EB7EA200F09AEBDB2FB70274A4D25FA05C15E1194D4CBD3FE83D060D53AA4A584AE6449977AF63D142B9D3EC82E7E3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75% Antivirus: Virustotal, Detection: 57%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:U................0..P...........o... ........@.. ....................................@..................................o..O.......,............\...6...........T..p............................................ ............... ..H............text....O... ...P.................. ..`.rsrc...,............R..............@..@.reloc...............Z..............@..B.................o......H........o...W..............@...........................................^..}.....(.......(...............0............{....o....,..{....o....,..{....o....+....,...{........(....o......8.....{....o......,5..{....o....(....#.....@.@[..{......(....o......8.....{....o........,3..{....o....(....#...(\%.@[...{......(....o......+B.{....o........,1..{....o....(....#...(\%.@Z...{......(....o.......0..+.........,..{.......+....,...{....o........(.......0............s....}.....s..

C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\PROFORMA FATURA.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.509349012348611
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.98% Win32 Executable (generic) a (10002005/4) 49.93% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PROFORMA FATURA.exe
File size:	823'816 bytes
MD5:	49c53c3c0868699a9cbe2ef3d5bfcb8e
SHA1:	3113b54138af9199fd97f96a42542541b6a8fdb3
SHA256:	0ad205b2d883bca56250246f308228379c27f6114d8b740014deeef53b3412bb
SHA512:	2a3a51767f4409a70e5fff84468a0aebd2eb7ea200f09aebdb2fb70274a4d25fa05c15e1194d4cbd3fe83d060d53aa4a584ae6449977af63d142b9d3ec82e7e3
SSDEEP:	12288:DrG4eUyzwoF6w7g9vZ7Bw6/992kJ9TaRdxkYv8HrAvTmeXNig8g7N5hkR:WvUClwR7BVvRJ9GOted77Ni
TLSH:	AC0538BA91215F82DA133FB048142B413F3CBA7F5A75467C8FD20CA4429DDB9C964BAD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:U................0..P...........o... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4c6ff2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xDEBF553A [Thu Jun 3 06:05:46 2088 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 01:00:00 09/11/2021 00:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc6f9d	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x62c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xc5c00	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xca000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc54f0	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc4ff8	0xc5000	e472600217abd52ed7acc77771d295c5	False	0.7882755492544417	data	7.502265215302294	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc8000	0x62c	0x800	cefafaace8ee54082ab72ecc814ef45a	False	0.33935546875	data	3.4701936638851714	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xca000	0xc	0x200	13c04688a64c7206bcd3ac338cce7466	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc8090	0x39c	data			0.4231601731601732
RT_MANIFEST	0xc843c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 11:00:48.998310089 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:49.003185034 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:49.003372908 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:49.646071911 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:49.646591902 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:49.651648998 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:49.817229986 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:49.817380905 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:49.822217941 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:49.991050959 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:50.000725031 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:50.006155968 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:50.181807995 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:50.181818962 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:50.181824923 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:50.181910992 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:50.273078918 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:50.287060022 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:50.291932106 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:50.457946062 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:50.481291056 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:50.486089945 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:50.651737928 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:50.652836084 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:50.658093929 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:50.822968006 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:50.827410936 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:50.832195997 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:51.005261898 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:51.014534950 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:51.019371986 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:51.184333086 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:51.184526920 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:51.189502954 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:51.360568047 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:51.360753059 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:51.365601063 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:51.530467987 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:51.531148911 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:51.531306028 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:51.531321049 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:51.531342030 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:51.739020109 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:52.051513910 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:52.074050903 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:52.408710003 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:52.408787012 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:52.409064054 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:52.409125090 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:52.409845114 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:52.409849882 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:52.409853935 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:52.409857988 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:53.082760096 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:53.463020086 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:53.463470936 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:53.463953972 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:53.464024067 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:53.466039896 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:53.466064930 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:53.469616890 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:53.469631910 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:53.469717026 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:53.475009918 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:53.475831985 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:53.823395014 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:53.828176975 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:53.994853020 CEST	587	53953	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:53.998009920 CEST	53953	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:53.998816967 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:54.003679037 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.003968000 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:54.034327984 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.034657001 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:54.039689064 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.202110052 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.207700014 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:54.212616920 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.381562948 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.388171911 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:54.393119097 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.564479113 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.564750910 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:54.569741964 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.583894014 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.583920956 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.583961010 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.584096909 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:54.585378885 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:54.590300083 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.731090069 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.731358051 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:54.736231089 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.753608942 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.770524025 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:54.775429010 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.900996923 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.901542902 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:54.906338930 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.938353062 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:54.938719034 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:54.944684982 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.212137938 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.212196112 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.212207079 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.212218046 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.212239981 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.212542057 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.212587118 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.212888002 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.213193893 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.213892937 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.214337111 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.220484972 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.220494986 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.382169008 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.383446932 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.388554096 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.390563965 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.390856028 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.397078991 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.549170017 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.549380064 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.554404974 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.560337067 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.560549021 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.566237926 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.715637922 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.715882063 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.720668077 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.739878893 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.740052938 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.744828939 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.888104916 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.888303995 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.893613100 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.907612085 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.908221006 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.908298969 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.908324003 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.908346891 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:55.912966013 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.913069963 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.913151026 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:55.913160086 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.054655075 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.054853916 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.059695005 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.180310965 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.223429918 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.226670027 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.226869106 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.230647087 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.231750965 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.235635996 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.398843050 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.400233984 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.400341034 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.400382042 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.400515079 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.400580883 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.400619984 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.400659084 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.400703907 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.400718927 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.400747061 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.402719021 CEST	587	53956	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.405113935 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.405132055 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.405241013 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.405375004 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.405411959 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.405508995 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.405612946 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.405616999 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.407408953 CEST	53956	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.408097982 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.412950993 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.413804054 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.590747118 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.645319939 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.992501974 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:56.992652893 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:56.997538090 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.162902117 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.163062096 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:57.167877913 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.336076021 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.336478949 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:57.341299057 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.516822100 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.516843081 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.516858101 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.516872883 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.516922951 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:57.516967058 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:57.518791914 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:57.523592949 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.688975096 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.690087080 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:57.694925070 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.859657049 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:57.859929085 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:57.864721060 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.030277967 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.030699015 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.035547972 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.207654953 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.208241940 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.213219881 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.377640963 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.377918959 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.382788897 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.559283972 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.559596062 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.564415932 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.728827953 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.729249954 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.729296923 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.729321003 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.729346037 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.729398012 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.729444027 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.729444027 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.729474068 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.729474068 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.729485989 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:00:58.734062910 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.734080076 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.734114885 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.734294891 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.734301090 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.734317064 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.922409058 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:00:58.973431110 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:02:28.896100998 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:02:28.901037931 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:02:29.063570023 CEST	587	53958	78.110.166.82	192.168.2.6
Oct 4, 2024 11:02:29.064420938 CEST	53958	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:02:32.131088018 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:02:32.136065960 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:02:32.300879955 CEST	587	53975	78.110.166.82	192.168.2.6
Oct 4, 2024 11:02:32.349016905 CEST	53975	587	192.168.2.6	78.110.166.82
Oct 4, 2024 11:02:32.374903917 CEST	53975	587	192.168.2.6	78.110.166.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 11:00:48.882498980 CEST	62943	53	192.168.2.6	1.1.1.1
Oct 4, 2024 11:00:48.991504908 CEST	53	62943	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 11:00:48.882498980 CEST	192.168.2.6	1.1.1.1	0xd2f6	Standard query (0)	zqamcx.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 11:00:48.991504908 CEST	1.1.1.1	192.168.2.6	0xd2f6	No error (0)	zqamcx.com		78.110.166.82	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 4, 2024 11:00:49.646071911 CEST	587	53953	78.110.166.82	192.168.2.6	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Fri, 04 Oct 2024 10:00:49 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 4, 2024 11:00:49.646591902 CEST	53953	587	192.168.2.6	78.110.166.82	EHLO 651689
Oct 4, 2024 11:00:49.817229986 CEST	587	53953	78.110.166.82	192.168.2.6	250-cphost14.qhoster.net Hello 651689 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Oct 4, 2024 11:00:49.817380905 CEST	53953	587	192.168.2.6	78.110.166.82	STARTTLS
Oct 4, 2024 11:00:49.991050959 CEST	587	53953	78.110.166.82	192.168.2.6	220 TLS go ahead
Oct 4, 2024 11:00:54.034327984 CEST	587	53956	78.110.166.82	192.168.2.6	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Fri, 04 Oct 2024 10:00:53 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 4, 2024 11:00:54.034657001 CEST	53956	587	192.168.2.6	78.110.166.82	EHLO 651689
Oct 4, 2024 11:00:54.202110052 CEST	587	53956	78.110.166.82	192.168.2.6	250-cphost14.qhoster.net Hello 651689 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Oct 4, 2024 11:00:54.207700014 CEST	53956	587	192.168.2.6	78.110.166.82	STARTTLS
Oct 4, 2024 11:00:54.381562948 CEST	587	53956	78.110.166.82	192.168.2.6	220 TLS go ahead
Oct 4, 2024 11:00:54.564479113 CEST	587	53958	78.110.166.82	192.168.2.6	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Fri, 04 Oct 2024 10:00:54 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 4, 2024 11:00:54.564750910 CEST	53958	587	192.168.2.6	78.110.166.82	EHLO 651689
Oct 4, 2024 11:00:54.731090069 CEST	587	53958	78.110.166.82	192.168.2.6	250-cphost14.qhoster.net Hello 651689 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Oct 4, 2024 11:00:54.731358051 CEST	53958	587	192.168.2.6	78.110.166.82	STARTTLS
Oct 4, 2024 11:00:54.900996923 CEST	587	53958	78.110.166.82	192.168.2.6	220 TLS go ahead
Oct 4, 2024 11:00:56.992501974 CEST	587	53975	78.110.166.82	192.168.2.6	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Fri, 04 Oct 2024 10:00:56 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 4, 2024 11:00:56.992652893 CEST	53975	587	192.168.2.6	78.110.166.82	EHLO 651689
Oct 4, 2024 11:00:57.162902117 CEST	587	53975	78.110.166.82	192.168.2.6	250-cphost14.qhoster.net Hello 651689 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Oct 4, 2024 11:00:57.163062096 CEST	53975	587	192.168.2.6	78.110.166.82	STARTTLS
Oct 4, 2024 11:00:57.336076021 CEST	587	53975	78.110.166.82	192.168.2.6	220 TLS go ahead

Target ID:	0
Start time:	05:00:43
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\PROFORMA FATURA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PROFORMA FATURA.exe"
Imagebase:	0xa60000
File size:	823'816 bytes
MD5 hash:	49C53C3C0868699A9CBE2EF3D5BFCB8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:00:45
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe"
Imagebase:	0x9f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:00:45
Start date:	04/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:00:45
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"
Imagebase:	0x9f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:00:45
Start date:	04/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:00:45
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp"
Imagebase:	0x20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:00:46
Start date:	04/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:00:46
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\PROFORMA FATURA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PROFORMA FATURA.exe"
Imagebase:	0x5a0000
File size:	823'816 bytes
MD5 hash:	49C53C3C0868699A9CBE2EF3D5BFCB8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.4572408671.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.4572408671.0000000002881000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.4572408671.0000000002881000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:00:48
Start date:	04/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:00:48
Start date:	04/10/2024
Path:	C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe
Imagebase:	0xc00000
File size:	823'816 bytes
MD5 hash:	49C53C3C0868699A9CBE2EF3D5BFCB8E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 75%, ReversingLabs Detection: 57%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:00:49
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpBA20.tmp"
Imagebase:	0x20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:00:49
Start date:	04/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:00:50
Start date:	04/10/2024
Path:	C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"
Imagebase:	0x800000
File size:	823'816 bytes
MD5 hash:	49C53C3C0868699A9CBE2EF3D5BFCB8E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.4572147923.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.4572147923.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.4572147923.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.7%
Total number of Nodes:	318
Total number of Limit Nodes:	8

Executed Functions

Function 053B6BD0 Relevance: 1.0, Instructions: 997COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172895265.00000000053B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53b0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3876dfb4ef557d3ccf8c4f478b9a75ab6f7bae651377c8d6c2aa7d9b332f822e
Instruction ID: 12348c19e6fc20755fa2d4052b57537e29d30e881518c5024549bd095bdaa6c1
Opcode Fuzzy Hash: 3876dfb4ef557d3ccf8c4f478b9a75ab6f7bae651377c8d6c2aa7d9b332f822e
Instruction Fuzzy Hash: 3CB2C274A00219CFDB14DB68C994BD9B7B2FF8A300F1185E9D509AB362DB71AE85CF41

Function 053B6BE0 Relevance: 1.0, Instructions: 993COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172895265.00000000053B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53b0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95a28fc8952a2c7da3e4c64e218750f5592418ebbc0afc82e1dbf04bae116fc
Instruction ID: 4e9f3d0070313342774e4d49536d2b05c350fdc2983ce547796fbd971a040133
Opcode Fuzzy Hash: f95a28fc8952a2c7da3e4c64e218750f5592418ebbc0afc82e1dbf04bae116fc
Instruction Fuzzy Hash: 83B2C274A00219CFDB14DB68C994BD9B7B2FF8A300F1185E9D509AB362DB71AE85CF41

Function 0747B899 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfdcbad78878980160d703118a2bf07a246d2928d1a5647071c919c46dd0efa9
Instruction ID: 3dee43bea031c0c00baaf9b7f1c0a14e9c78792173d8a441bc8c4e9bb290dfa7
Opcode Fuzzy Hash: cfdcbad78878980160d703118a2bf07a246d2928d1a5647071c919c46dd0efa9
Instruction Fuzzy Hash: BAD067B8818204CBC714DF64E4995F8BBFCEB0F351F006466D40AE7215D7749981CF15

Function 07477E9D Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 074780DE

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5aad411f9080b512f23b9cf07536be1364ba21c938e7672fcd9a0dfaca7a92da
Instruction ID: 16d7ada9aebca3e1b2a8bc96128c85314d86a1ccdc867e8bd0102dad025a6577
Opcode Fuzzy Hash: 5aad411f9080b512f23b9cf07536be1364ba21c938e7672fcd9a0dfaca7a92da
Instruction Fuzzy Hash: 4DA15CB1D0025ADFEB24CF68C9457DEBBB6FF48314F14856AE808A7240DB749985CF91

Function 07477EA8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 074780DE

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e46aadb8c13464a144a9c83a13bb32cf73750f2ea525ef14e0b2cd0c5abea835
Instruction ID: 8f29a58920a3015c5c70050613d9b41df57cff1e375bc7f7929e8b8aa178ebe1
Opcode Fuzzy Hash: e46aadb8c13464a144a9c83a13bb32cf73750f2ea525ef14e0b2cd0c5abea835
Instruction Fuzzy Hash: CA915BB1D0025ADFEB24CF68C945BDEBBB6FF48314F14856AE808A7240DB749985CF91

Function 02CAADA8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02CAAFFE

Memory Dump Source

Source File: 00000000.00000002.2170319326.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ca0000_PROFORMA FATURA.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b270592e441135280c8eb540d705992c7002025a02be1478c659239d855d71be
Instruction ID: 32221cdff19e710cc4770b77a6ed67e535cab1f303a499b1e9585ce42601fd7c
Opcode Fuzzy Hash: b270592e441135280c8eb540d705992c7002025a02be1478c659239d855d71be
Instruction Fuzzy Hash: 16713670A00B469FD764DF2AD45175ABBF1FF88308F008A2DD48AD7A50DB75E945CB90

Function 02CA44B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02CA59C9

Memory Dump Source

Source File: 00000000.00000002.2170319326.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ca0000_PROFORMA FATURA.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3fa91d100c20b5164ce69438b91b85892e2f1fac98426fa0fe6a1d133e74e758
Instruction ID: 5fdd16e3641f4f29f04ea89289b108592c57ebd8b7aa4aead64c2a25e3ea8575
Opcode Fuzzy Hash: 3fa91d100c20b5164ce69438b91b85892e2f1fac98426fa0fe6a1d133e74e758
Instruction Fuzzy Hash: 1F41E370D0071DCFDB24CFA9C98579EBBB5BF48704F60806AD409AB251DB756945CF90

Function 02CA590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02CA59C9

Memory Dump Source

Source File: 00000000.00000002.2170319326.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ca0000_PROFORMA FATURA.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f50211bee19f3249a72a5a400d0dba6a94b7ca271749bfaa0de1b3f7351f6309
Instruction ID: 7acf0159a5b25093b202ad5508e637eea973fd51a1c42dff8595f532d8428c04
Opcode Fuzzy Hash: f50211bee19f3249a72a5a400d0dba6a94b7ca271749bfaa0de1b3f7351f6309
Instruction Fuzzy Hash: 564100B1C00719CFDB24CFA9C9857DEBBB1BF48308F60806AD408AB251DB71694ACF50

Function 053B4040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 053B4101

Memory Dump Source

Source File: 00000000.00000002.2172895265.00000000053B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53b0000_PROFORMA FATURA.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 344ef963c3127a3a4d5aa5a8f913adb59bdfdb2c8294e556d65d3c8d2a45c12b
Instruction ID: af1b6a54883830f1f83caef2333faab669c3b44a3529dc69a58427790248dc0c
Opcode Fuzzy Hash: 344ef963c3127a3a4d5aa5a8f913adb59bdfdb2c8294e556d65d3c8d2a45c12b
Instruction Fuzzy Hash: 0C4119B99003098FDB14CF99C448AAAFBF6FB88314F24C459D519AB721D7B5A841CFA4

Function 07477C18 Relevance: 1.6, APIs: 1, Instructions: 76
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07477CB0

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2118d29d466ff25a511492a6f8a0e8e531f668eb46722e3d93624ef9ad0d2f84
Instruction ID: 594e516b5796a91942979babf6ef548462486c8922345ee661bd8a0143e2a297
Opcode Fuzzy Hash: 2118d29d466ff25a511492a6f8a0e8e531f668eb46722e3d93624ef9ad0d2f84
Instruction Fuzzy Hash: 642148B69003499FDF10CFA9C881BEEBBF4FF48320F50842AE918A7250C7789550CBA5

Function 07477C20 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07477CB0

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2b8c10eeb48460fe2258a697abf6cc1d36b0836f27d4f8bf807096adf01b3f70
Instruction ID: 0b34236a97ff093aa787e167a25611ac3dbb80dfc250b8c64582befb5a385622
Opcode Fuzzy Hash: 2b8c10eeb48460fe2258a697abf6cc1d36b0836f27d4f8bf807096adf01b3f70
Instruction Fuzzy Hash: FA2128B19003499FDB10CFA9C881BDEBBF5FF48320F50842AE518A7250D7789554CBA4

Function 0747764A Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 074776CE

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 53c2a89a5898183c55d6bdd3291a19888cd88e3836b1ffcdbd8cadd4dbad5d20
Instruction ID: 98b2a2c0624701f158998ee7f626db9b62aa07b24340325e51751d06ff37962e
Opcode Fuzzy Hash: 53c2a89a5898183c55d6bdd3291a19888cd88e3836b1ffcdbd8cadd4dbad5d20
Instruction Fuzzy Hash: C2213AB19043098FDB10CFAAC4857EEBBF0AF88324F14842ED559A7240C7789544CFA5

Function 07477D09 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07477D90

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8e42ab8ceae69ce74558d8bac783f767af35cc8d1dc9d6abecc66cf1fdb14b91
Instruction ID: 3aecf99ffa17bddd9bef061b73747312b04ede31d9ca9aa248e97f7695e174ae
Opcode Fuzzy Hash: 8e42ab8ceae69ce74558d8bac783f767af35cc8d1dc9d6abecc66cf1fdb14b91
Instruction Fuzzy Hash: 882139B190035A9FDF10CFA9C880BEEBBF1FF48310F50842AE558A7240D7789500CBA4

Function 02CAD27C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02CAD656,?,?,?,?,?), ref: 02CAD717

Memory Dump Source

Source File: 00000000.00000002.2170319326.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ca0000_PROFORMA FATURA.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e62a9293a683673e3e5899622ac0045cadb07fc2d3d994241a556865055855a0
Instruction ID: dd3703d688dc37cb6979a6bc09f248705963bcfc4a1f83f4086a421c0ca8e3eb
Opcode Fuzzy Hash: e62a9293a683673e3e5899622ac0045cadb07fc2d3d994241a556865055855a0
Instruction Fuzzy Hash: 3221E4B5900349DFDB10CF9AD984ADEBBF4FB48324F14841AE919A3310D378A950CFA5

Function 07477650 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 074776CE

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 45b175dd4a7f08721610de9aad270a55ffd2e6bd5bf651bccb52207f6a396a43
Instruction ID: d56e9f686ef66a1bc3116c85970a2747df31b07b428c35ba8c7c615cb0197f66
Opcode Fuzzy Hash: 45b175dd4a7f08721610de9aad270a55ffd2e6bd5bf651bccb52207f6a396a43
Instruction Fuzzy Hash: 432129B19003099FDB10DFAAC4857EEBBF4EF88324F54842AD519A7240DB789944CFA5

Function 07477D10 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07477D90

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: db6f02a8492ea8e69180066584227b479c96dd8addc6b9a0439edd3a37f7d3f0
Instruction ID: e521b6fa776b9c0499fd664d23266ed8f71968d49cd66041aa1f4909f70408da
Opcode Fuzzy Hash: db6f02a8492ea8e69180066584227b479c96dd8addc6b9a0439edd3a37f7d3f0
Instruction Fuzzy Hash: E12128B18003599FDB10CFAAC881BEEBBF5FF48310F50842AE518A7250D7789910CBA5

Function 02CAD689 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02CAD656,?,?,?,?,?), ref: 02CAD717

Memory Dump Source

Source File: 00000000.00000002.2170319326.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ca0000_PROFORMA FATURA.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 125ee4d72c62938d994c36ade64c1909f84dda0912528e222ba5cfe16e254e67
Instruction ID: cc58046bdf12acc47b438d2494c8a10520d4c76b20b97b2464ddd14f8eddf111
Opcode Fuzzy Hash: 125ee4d72c62938d994c36ade64c1909f84dda0912528e222ba5cfe16e254e67
Instruction Fuzzy Hash: 9A21C2B5900249DFDB10CFAAD984ADEBBF5FB48324F14841AE919B3350D378AA54CF64

Function 07477B58 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07477BCE

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cae1b85537046e7663d802a61d488946116af51a2ac45e4166e090173e5dcc7c
Instruction ID: 77841298e00dce81ba110c9270843d0cf0a6cb0fe8c06fced75655a1e7277116
Opcode Fuzzy Hash: cae1b85537046e7663d802a61d488946116af51a2ac45e4166e090173e5dcc7c
Instruction Fuzzy Hash: AD1144729002499FDB10CFAAC844BEFBBF5AF88324F24841AE519A7250C7799950CBA4

Function 0747759A Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07477602

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d52e97cf49259569e20a436f979f83e216da141df80a0c92238588588216463d
Instruction ID: 218113ec7209a20b323d66511fe19c4498b1ad7a8013737ad2acdfa1be3b8a4f
Opcode Fuzzy Hash: d52e97cf49259569e20a436f979f83e216da141df80a0c92238588588216463d
Instruction Fuzzy Hash: 18113AB190034A8FDB20DFAAD4457DFFBF4EF88724F24881AD559A7240CB75A940CBA5

Function 07477B60 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07477BCE

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4afe5e5d62d55c261b81701631b5b6ef4f4f9c96a6f22736dfffa4e4ed0b8424
Instruction ID: 13141b78d363ffe40024b4e642744d0b8cf18f85a574a6e224e951590fa5bfab
Opcode Fuzzy Hash: 4afe5e5d62d55c261b81701631b5b6ef4f4f9c96a6f22736dfffa4e4ed0b8424
Instruction Fuzzy Hash: 391156728003499FDB10CFAAC845BEFBBF5AF88324F10841AE519A7250C775A510CBA0

Function 074775A0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07477602

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f3c1ff5e72dcdc48b9b9b5ddaca42fe19eeca64c0053561d399e683f91b2d9a8
Instruction ID: 1c71bfda13e9a471dfe8466b66ebf1d1f92ce72f07014c364d017690650b19dc
Opcode Fuzzy Hash: f3c1ff5e72dcdc48b9b9b5ddaca42fe19eeca64c0053561d399e683f91b2d9a8
Instruction Fuzzy Hash: 1B113AB19003498FDB20DFAAC4457DFFBF4AF88724F24881AD519A7240CB75A540CBA5

Function 0747C838 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0747C89D

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 624d342d570859e4c2315bccf7363cbe1b1d44483c36566de3e00729a09b7e95
Instruction ID: 04c1c3ddcdeddbacc3cd901850f0c9cc9c9ab5844e21154ef563167d3405ad59
Opcode Fuzzy Hash: 624d342d570859e4c2315bccf7363cbe1b1d44483c36566de3e00729a09b7e95
Instruction Fuzzy Hash: E311DFB58003499FDB10DF9AD985BDEBBF8EB48320F20881AE958A7650C375A544CFA5

Function 07478D9C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0747C89D

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9df77d529e926a8011512afba6e7f9b626fc61215fc7e0200f82cb58b7628c0c
Instruction ID: 56afaf71cb437502c18833b475f82c8c2ca2d10e982fa640e368b248dceb32ac
Opcode Fuzzy Hash: 9df77d529e926a8011512afba6e7f9b626fc61215fc7e0200f82cb58b7628c0c
Instruction Fuzzy Hash: C91103B5804349DFDB10DF9AC585BDEBBF8FB48320F10881AE918A7210D3B5A954CFA5

Function 02CAAF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02CAAFFE

Memory Dump Source

Source File: 00000000.00000002.2170319326.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ca0000_PROFORMA FATURA.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7733a49ba918985fdf07389b46f2da4513c79140de3886d0622103daea203996
Instruction ID: bebbd5ae81f229be436981d24609201309e49e8f6c3065d7df118e67c824f42d
Opcode Fuzzy Hash: 7733a49ba918985fdf07389b46f2da4513c79140de3886d0622103daea203996
Instruction Fuzzy Hash: AF1113B6C0074A8FCB10CF9AC444BDEFBF4AF88228F10841AD429A7210D375A545CFA1

Function 02BAD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2169892482.0000000002BAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bad000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff451b43f2d2216401c08bc71361c993a64e20dd6dfcb9caecec1fdd4f3d2b5
Instruction ID: 897aa2a4772fc6ac27f3837acf5257ebee206f1874bdf9ff68f517b1254e2696
Opcode Fuzzy Hash: 1ff451b43f2d2216401c08bc71361c993a64e20dd6dfcb9caecec1fdd4f3d2b5
Instruction Fuzzy Hash: 74213D75508305DFDB08DF14D5C0B16BF65FB84314F24C5ADD9090B656C736E456CBA1

Function 02BAD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2169892482.0000000002BAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bad000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6130024bb53c88d81d35792c4cb32939c49eacfee5c9fbd0315d971074a22a31
Instruction ID: 83c05fd3cc8b2d61b5264271de851f16239422b368eabbd54db35317684bedd8
Opcode Fuzzy Hash: 6130024bb53c88d81d35792c4cb32939c49eacfee5c9fbd0315d971074a22a31
Instruction Fuzzy Hash: 332125B2508241EFDB05DF14D9D0B2ABF65FB88318F24C5A9E9090B657C336D456CBA1

Function 02BBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170018325.0000000002BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bbd000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ecb9af4bb51234f931c5d7e9b978c2dfa1a7a08a14518c15b9ddd3150916562
Instruction ID: 09e50975e0c2ff2f4fdcd79464510abc0169c4c7d3adcc65038d6f5ab073557f
Opcode Fuzzy Hash: 6ecb9af4bb51234f931c5d7e9b978c2dfa1a7a08a14518c15b9ddd3150916562
Instruction Fuzzy Hash: 10212275604201EFDB16DF14D9D0B66BB61FF88314F60C5ADE90A4B252C3BAD407CA61

Function 02BBD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170018325.0000000002BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bbd000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96cd42c9cd9dc0206666b70e366d0829271baf2df57d4bef8148831a4ce188ef
Instruction ID: 2bc1a8019a98e547c4e2c8d564b58d1640449442a8d9f1db29aff96773f5389d
Opcode Fuzzy Hash: 96cd42c9cd9dc0206666b70e366d0829271baf2df57d4bef8148831a4ce188ef
Instruction Fuzzy Hash: 8C213775A04281EFDB06DF10D5C0B75BB61FF84314F20C5ADE9494B252C3BAD446CB61

Function 02BBD006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170018325.0000000002BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bbd000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2f5f8f59f83aa1e7f7af1c91002b01ae76a6ba9df7d98ac4853576d73317e8
Instruction ID: 0cc7d4fd484c34675f85698a157afb6ecfffbfa6fe7ba2fea0b08aa7bfd47107
Opcode Fuzzy Hash: 6f2f5f8f59f83aa1e7f7af1c91002b01ae76a6ba9df7d98ac4853576d73317e8
Instruction Fuzzy Hash: 792181755093808FCB17CF20D9A4B55BF71EF45214F28C5EAD8498B6A7C37AD80ACB62

Function 02BAD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2169892482.0000000002BAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bad000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 1f4e5c3767ff93a81372e965f5b367807da8e216a5035ea154e2f897f2f16c77
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 3F11D376504280CFCB15CF10D5C4B1ABF71FB84318F24C6A9D8490B657C33AD456CBA1

Function 02BAD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2169892482.0000000002BAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bad000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 6e3df09e4f8c88de6d5bcbcf755d8a9d420bd6262dd9d8915367172bbfbaaeb9
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 1411E6B6504281DFDB15CF10D5C4B1ABF71FB84324F28C6E9D8090B666C33AE456CBA1

Function 02BBD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170018325.0000000002BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bbd000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 8d3c94f5c71ad8aa08637fb7e9f94ec3376685ca30595d0c63301605e09a3714
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 63118B75904284DFCB16CF10D5C4B65BBA1FF84218F24C6A9D8894B6A6C37AD44ACB61

Function 02BAD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2169892482.0000000002BAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bad000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5251536e9f4ff854ce7f218f9f4b0d34e92012288d86e9a958aa46659d2da546
Instruction ID: d0592408776066ef789b53e7b32a684ededb18f053fdce23a83e6c209c11a763
Opcode Fuzzy Hash: 5251536e9f4ff854ce7f218f9f4b0d34e92012288d86e9a958aa46659d2da546
Instruction Fuzzy Hash: BB01267200C3459BE7184F25CD94B26BF98DF41324F08C59AEE094A696DBB99840CBB1

Function 02BAD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2169892482.0000000002BAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bad000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5569e543090bf6713666df743db7e80f3c1ed8316ec59695e81c2a5063e00b10
Instruction ID: 4496bb8e5f3ea2cd70a22eec1f8be386281e309110dd5597f60050f99afbd4ea
Opcode Fuzzy Hash: 5569e543090bf6713666df743db7e80f3c1ed8316ec59695e81c2a5063e00b10
Instruction Fuzzy Hash: 1FF096724093449EE7148F16DDC4B62FF98EB81634F18C55AED084B696C779A844CBB1

Non-executed Functions

Function 053B0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172895265.00000000053B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53b0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de50f1c41efc7c52c33d3e1265e82a948d5af9b3c3c30fc5f8e67d78dccad61
Instruction ID: f81670515bcee687cd6cba12160828fca6605d8f393485ae6d6419efc69c56ee
Opcode Fuzzy Hash: 4de50f1c41efc7c52c33d3e1265e82a948d5af9b3c3c30fc5f8e67d78dccad61
Instruction Fuzzy Hash: 561274B0C817458AE710CF65F94C2893BA1B785318FD04A09DA616F3E5EBBC196ECF46

Function 07477728 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d5b3f62632a17595b806e4f1e77d4573f8034465abb5d3a7735f62ed46e472
Instruction ID: 19d976264d3a81def7c055e3a1168367d6b28d8d533e8d68a04138569ee0ad31
Opcode Fuzzy Hash: c0d5b3f62632a17595b806e4f1e77d4573f8034465abb5d3a7735f62ed46e472
Instruction Fuzzy Hash: 00E10DB4E102598FDB15DFA9C580AEEFBB2FF49304F64825AD414AB355D730A942CFA0

Function 074756D0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579a562d4df9fc80a47d5e57557c9c700d6fd3252c44d559701603726bc4d022
Instruction ID: 022cca8e61741ac787bc6c74ef9b6d06bc990759011748e04d13dda93556f962
Opcode Fuzzy Hash: 579a562d4df9fc80a47d5e57557c9c700d6fd3252c44d559701603726bc4d022
Instruction Fuzzy Hash: 1AE1FCB4E102598FDB14DFA9C590AEEFBB2FF49304F24826AD414AB355D730A942CF61

Function 07475298 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486f745d0e58958ff2e823c9d1e06c2edb043b9459f158b18891ce7c2dd1174f
Instruction ID: 4a266df72fb3d3387ab0754fc3ee45e17dd9cccde0172e97f7eb578e50b47d4f
Opcode Fuzzy Hash: 486f745d0e58958ff2e823c9d1e06c2edb043b9459f158b18891ce7c2dd1174f
Instruction Fuzzy Hash: 51E1EBB4E102598FDB14DFA9C590AEEFBB2FF89304F24825AD414AB355D730A942CF60

Function 07474E60 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb80834cbdd19b2a9a90d48863ea64bc27786cabe38e9b22753b2b48dc470f43
Instruction ID: 8255a69ccddd926a4e48eafca793b7bcac149f2eec1f092cc2fcbc3cde0be71d
Opcode Fuzzy Hash: fb80834cbdd19b2a9a90d48863ea64bc27786cabe38e9b22753b2b48dc470f43
Instruction Fuzzy Hash: 85E1FBB4E102598FDB14DFA9C580AEEFBB2FF49305F24826AD414AB355D731A942CF60

Function 07476D78 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0426739b622c0917a84bcdf4d65baf493a44becac581f2060532affd6eb14656
Instruction ID: 89f32d46a790a9b811769deb47f03fbae8c69beebec8862632c86e3159ec90ad
Opcode Fuzzy Hash: 0426739b622c0917a84bcdf4d65baf493a44becac581f2060532affd6eb14656
Instruction Fuzzy Hash: DBE1EAB4E102598FDB14DFA9C580AEEFBB2FF89304F24826AD414A7355D731A942CF61

Function 02CAD5BC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170319326.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ca0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cca66aecff3e67bb99705fdbba6bf9226adf555751b4f645e2680cb709d0567
Instruction ID: 8dcb61e3178a2ba6914d2526e30a7c452f86347dcabfde4dd2fbd2139e7401f4
Opcode Fuzzy Hash: 6cca66aecff3e67bb99705fdbba6bf9226adf555751b4f645e2680cb709d0567
Instruction Fuzzy Hash: 22A17F32E0020A8FCF15DFB5C8545AEB7B2FF85308B15856EE905AB265DB32E915CF80

Function 053B0011 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172895265.00000000053B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53b0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a647b7bdc727b0d3a15f5f90d4633e1af1c997e88364f1ef17c258479a2d27
Instruction ID: 87e9a10fde2c016a32fd1f7115be0b936c99b64becd2f02305dac4c1f714d2cd
Opcode Fuzzy Hash: 82a647b7bdc727b0d3a15f5f90d4633e1af1c997e88364f1ef17c258479a2d27
Instruction Fuzzy Hash: 15C1F8B0C817468AE710CF25F9482897BB1BB85324F954B09D9616F3D1EBBC186ECF46

Function 074756C0 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174574607.0000000007470000.00000040.00000800.00020000.00000000.sdmp, Offset: 07470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7470000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5459423b5302865de6f6b207af07fbb68a2b6ee629fb8aebfb5d3ce8a7ea01f
Instruction ID: 7a8d9aa079c5c6658bd3b747b1cbcc78ee9693b9fb1eecdae0dc882975fb5fb0
Opcode Fuzzy Hash: a5459423b5302865de6f6b207af07fbb68a2b6ee629fb8aebfb5d3ce8a7ea01f
Instruction Fuzzy Hash: 6051FDB4E102598FDB15DFA9C5805EEFBF2FF89204F24816AD418AB355D7309A42CFA1

Analysis Process: PROFORMA FATURA.exePID: 5396, Parent PID: 2672COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	106
Total number of Limit Nodes:	9

Executed Functions

Function 00DA9B40 Relevance: 2.8, Instructions: 2822COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1042c1cd388f4454eb502f22edd6fd294e0fb6b45f5421ecb982c3ddc49fdcf5
Instruction ID: b613c9c2e43271de98f0009dd84c3ee908642b320a4e6aa59e5df6a9b3405b25
Opcode Fuzzy Hash: 1042c1cd388f4454eb502f22edd6fd294e0fb6b45f5421ecb982c3ddc49fdcf5
Instruction Fuzzy Hash: 4253F931D10B1A8ACB51EF68C8805A9F7B1FF9A310F15D79AE45877121FB70AAC5CB81

Function 00DACDC0 Relevance: 2.3, Instructions: 2311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6591f6c7b04ad0f4d3c1c46d2de0a4842a1dbec1f7b9b162bf873032a3ae415
Instruction ID: 8d3bd05751f3525b84f37eecff511e5e3a78e70cf2fbd36d92ba0117d30bc52d
Opcode Fuzzy Hash: c6591f6c7b04ad0f4d3c1c46d2de0a4842a1dbec1f7b9b162bf873032a3ae415
Instruction Fuzzy Hash: 5E332D31D10B198EDB11EF68C8806ADF7B1FF99300F15C79AE459A7211EB70AAC5CB91

Function 00DAF4A8 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c47aad33428992a4976fb45fdff604572e3c169595fa390a27b08f864860538
Instruction ID: 8f5fe9216d61a568825588ac9ee2aa41541622b3e10366950028510c907042d2
Opcode Fuzzy Hash: 4c47aad33428992a4976fb45fdff604572e3c169595fa390a27b08f864860538
Instruction Fuzzy Hash: 87523D34A002058FDB24DFA8C584B9DB7F2EF4A314F5985AAD409EB355DB74EC81CBA1

Function 00DA4A88 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c85825ac8a3410a2dc1f1ec52961293be9f57affed2a1df9d6161b774f26b78d
Instruction ID: 18b58b491e74e036e57880c5b4402372b60b218c7d3b9a2e93acc321ad749006
Opcode Fuzzy Hash: c85825ac8a3410a2dc1f1ec52961293be9f57affed2a1df9d6161b774f26b78d
Instruction Fuzzy Hash: 26B16E70E00209CFDF14CFA9C99179DBBF2AF89714F188529D815E7294EBB4D845CBA1

Function 00DA3E70 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917aec06e4e0fe5c5e5b4ee946da1c41f834f1723b0e3fbfeb6556f99720039b
Instruction ID: f7e22b979af2a3c9bc6015036629499c9d87ee543bff55ea9510c974e1bb4902
Opcode Fuzzy Hash: 917aec06e4e0fe5c5e5b4ee946da1c41f834f1723b0e3fbfeb6556f99720039b
Instruction Fuzzy Hash: 80917C70E00309CFDF10CFA9D9917DEBBF2AF89314F188529E405A7294EB749985CBA1

Function 0551E9A0 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.4582288814.0000000005510000.00000040.00000800.00020000.00000000.sdmp, Offset: 05510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5510000_PROFORMA FATURA.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1b96f654e490d3959ecf4702ab0b40b132c674af004bf0a1f67d22be98ce3c1a
Instruction ID: 05c7f8304f265bf5e0fe21735d9d045ae3847635f1dca454236225cde37b36fc
Opcode Fuzzy Hash: 1b96f654e490d3959ecf4702ab0b40b132c674af004bf0a1f67d22be98ce3c1a
Instruction Fuzzy Hash: AA713470A00B058FE724DF6AD445B6ABBF6FF88300F04892DD88AD7A40DB75E845CB95

Function 05D6E228 Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.4582492092.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5d60000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2ecc551a997271ddd76b0d68e7f192ca2799724bd6f73d70ab87f05dadccbd
Instruction ID: ff7f50c5dda5686d10131c0b3a8f6eff9f2edb69c976dea69474293e4e750c48
Opcode Fuzzy Hash: 6c2ecc551a997271ddd76b0d68e7f192ca2799724bd6f73d70ab87f05dadccbd
Instruction Fuzzy Hash: AF41F372E047558FDB04DFA9D80079EBBF5EFC9220F14866BD504A7391DB749845CBA0

Function 055166D8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0551675F

Memory Dump Source

Source File: 00000009.00000002.4582288814.0000000005510000.00000040.00000800.00020000.00000000.sdmp, Offset: 05510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5510000_PROFORMA FATURA.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8b7661a425368f8fd63a2998db005cd111516c98f9fe835746f0d72ffe7d942b
Instruction ID: 0e6139ac60172bf49d2d9997488d5fc07a3f8e5f79a8ed6e9e09ddb21be520c7
Opcode Fuzzy Hash: 8b7661a425368f8fd63a2998db005cd111516c98f9fe835746f0d72ffe7d942b
Instruction Fuzzy Hash: A821C4B59002499FDB10CFAAD984ADEBFF4FB48320F14841AE914A3350D774A954CFA5

Function 05D6E310 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(8B5504F4), ref: 05D6E377

Memory Dump Source

Source File: 00000009.00000002.4582492092.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5d60000_PROFORMA FATURA.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: b90e7e3ff4e195c625c183213b017672b423f9ecb66a028941078d3056b93380
Instruction ID: 8f9d27c6a9b577244c898f5b28e6c8076228ce1c10a6eb5fe3e48665aeae39ab
Opcode Fuzzy Hash: b90e7e3ff4e195c625c183213b017672b423f9ecb66a028941078d3056b93380
Instruction Fuzzy Hash: 091114B1C0065A9FCB10CF9AC544B9EFBF4BF48320F11816AD518A7240D378A950CFA5

Function 0551DE84 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0551E9BC), ref: 0551EBF6

Memory Dump Source

Source File: 00000009.00000002.4582288814.0000000005510000.00000040.00000800.00020000.00000000.sdmp, Offset: 05510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5510000_PROFORMA FATURA.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c241f67563c9cfbc28c59c7e33da9ebb8cfbb56535e3376a3f77382a57c2939c
Instruction ID: 96c2167857e8af314a3ddd74df086d6ce129a09aeaf5dde14683bf38cac30cdd
Opcode Fuzzy Hash: c241f67563c9cfbc28c59c7e33da9ebb8cfbb56535e3376a3f77382a57c2939c
Instruction Fuzzy Hash: E61123B5C043498FDB10CF9AC544B9EFFF8BB88214F10841AD919B7200C378A505CFA4

Function 00DA7910 Relevance: .6, Instructions: 557
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e6d5d26fb400094ed9e8ec58f54711d9fc25e2184f96f02e9f8a0c5574ce21
Instruction ID: 3d272d8042d01094ac06b06875fad9ee9ea8d2c69f7b7aecf7be277087f36cbc
Opcode Fuzzy Hash: f8e6d5d26fb400094ed9e8ec58f54711d9fc25e2184f96f02e9f8a0c5574ce21
Instruction Fuzzy Hash: 76128134701202DFDB19AB3CE45422D37A6FBD6314B14592DE206DB3A6CF75ED868BA0

Function 00DA96E8 Relevance: .4, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511ee248a52e4202f737f9d59318d02640cc7e727ef748e1b4ac43a1ebad3007
Instruction ID: 0e47074b2ca712839c6c1300a36b6b721c325373d82527e7adf3669ed9a234f9
Opcode Fuzzy Hash: 511ee248a52e4202f737f9d59318d02640cc7e727ef748e1b4ac43a1ebad3007
Instruction Fuzzy Hash: 10D19D34A002058FDB14DF68D8907AEFBB6EF8A310F28856AE509DB295D774DC45CBA1

Function 00DA936C Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1716b410bcad8e0d682f53ab91adeefb1149f9a59b0dbf88dc81ef5c1c2d0094
Instruction ID: ae9afc8e483936b36a164ca5bc1c6e8ad1c275ca360e17c1382b967247b513f7
Opcode Fuzzy Hash: 1716b410bcad8e0d682f53ab91adeefb1149f9a59b0dbf88dc81ef5c1c2d0094
Instruction Fuzzy Hash: 9AB17134A002048FDB14DFA8E594AADBBF2FF89310F258469E506EB395DB35DD46CB60

Function 00DA4A7C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a250dab0cb6f98b7d3c1d587d21ea024bb9257d6f0df45b5b577b342ebeb3fc
Instruction ID: cb867ce3678a7cc4f7fd1b7c0c3fe156913d0e3042eeda328cd0c8f23c17d84d
Opcode Fuzzy Hash: 2a250dab0cb6f98b7d3c1d587d21ea024bb9257d6f0df45b5b577b342ebeb3fc
Instruction Fuzzy Hash: 97B15D70E00219CFDF10CFA8C99579DBBF1AF89714F288529D815E7294EBB4D845CBA1

Function 00DA3E64 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 707dd0852d4b7fb3c961c41b502bdc0438a58ca8f1055a7da5722fbcbd61176c
Instruction ID: 8fbb74cffcd4b7a02456de901a0f5c814b2711a0609c2599e20d28031198e20c
Opcode Fuzzy Hash: 707dd0852d4b7fb3c961c41b502bdc0438a58ca8f1055a7da5722fbcbd61176c
Instruction Fuzzy Hash: 6C916C70E00309CFDF10CFA8D9857DEBBF2AF89314F188129E415A7294EB749985CBA1

Function 00DAFC38 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7287c62368361589a959a565ad012331ffbea1c0bce51fcfe761fd4a8da474
Instruction ID: ebcffef58fb216e10faaed48a8dbb9151338d1db12079f94138cde8b01317690
Opcode Fuzzy Hash: 5c7287c62368361589a959a565ad012331ffbea1c0bce51fcfe761fd4a8da474
Instruction Fuzzy Hash: 6E719031F002199BDB15EFB8D8506AEBBB6AFC5710F148529E405AB380DF349D42C7A5

Function 00DA47F4 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9395900b5c1f2f092befe467469616bbff3160f3f15eabd3f0374eb2b7bb5769
Instruction ID: 15fa700af24d3026e5509ece9ddafcb952a18051a36ea3c40c86c584fc75e4bc
Opcode Fuzzy Hash: 9395900b5c1f2f092befe467469616bbff3160f3f15eabd3f0374eb2b7bb5769
Instruction Fuzzy Hash: EA716971E002498FDF10CFA9D8817DEBBF1AF89714F188129E415AB254EBB49842CFA1

Function 00DA4800 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64b58b870501575c883a45356bd0d509968b68690b5109ba70d135d9162acca
Instruction ID: 0543581334dad37d76589b29d64d11ad1da828b18f98acc7fe5d4e17c926d82c
Opcode Fuzzy Hash: d64b58b870501575c883a45356bd0d509968b68690b5109ba70d135d9162acca
Instruction Fuzzy Hash: 1E715A71E00249DFDF10CFA9D88179EBBF2BF89714F188129E415A7254EBB89841CFA5

Function 00DA6EC7 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fea469dd2edb0dbd3b5d286e3fd514417ff90fcd55884bf91eef008d06440ba
Instruction ID: c7b479c4e87fe7bdb50f85bf60c1c8baed1b2f4f1abc9369d30bfab4aa0a798d
Opcode Fuzzy Hash: 6fea469dd2edb0dbd3b5d286e3fd514417ff90fcd55884bf91eef008d06440ba
Instruction Fuzzy Hash: 8351D131B002598FDB15DF78D8547AEB7B2EF86300F14856AE506EB281EB71DC46CBA0

Function 00DA6CCD Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89cfdd34f6a05e0664eda8e86ddd3acb6b79160d4b1e04f59934d50caa48a7f
Instruction ID: 7b796eaa3ae1bdf57a67504395fe2d5f296987ee2b4c3ffdbb4cca517120f418
Opcode Fuzzy Hash: c89cfdd34f6a05e0664eda8e86ddd3acb6b79160d4b1e04f59934d50caa48a7f
Instruction Fuzzy Hash: E4512375E00258CFDB14CFA9C885B9DBBF1BF49310F188529E815BB351D774A844CBA5

Function 00DA6CD8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b99e28a6d98de6013967b04056bcd182baff907ba7b6010a21553ecb947709
Instruction ID: 052018735d9fd3ae2d2cadc32f99b3dafa96cdfbc4d99fc6ba5dd77df65abc6c
Opcode Fuzzy Hash: e9b99e28a6d98de6013967b04056bcd182baff907ba7b6010a21553ecb947709
Instruction Fuzzy Hash: E8510375E00258CFDB14CFA9C885B9EBBB1BF49310F188529E815BB391DB74A844CBA5

Function 00DAF31D Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b7435de256441e78aa7f15bfb9bbe23509dec5a38f9766878e279a4d32b096
Instruction ID: b0a426212249adad56d363af683f6cf57aeb708e2865a7321f90d03818bfd6a3
Opcode Fuzzy Hash: 96b7435de256441e78aa7f15bfb9bbe23509dec5a38f9766878e279a4d32b096
Instruction Fuzzy Hash: D131C0307002458FDB19AB78D55466E7BA6EB8A740F2444B8C406DB396EF75CC468BE1

Function 00DA112A Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96e6e6d24b9c139e31e9e9eba74f9d1b9f59ba971f03032dc0cb5b4782507244
Instruction ID: f287ed46d2a938ffe42966b8ebedb6e25f11f475af4af8801556ba44b5bfccb6
Opcode Fuzzy Hash: 96e6e6d24b9c139e31e9e9eba74f9d1b9f59ba971f03032dc0cb5b4782507244
Instruction Fuzzy Hash: 1B51DB74246A82DFD70AEF2CF9A09553FB1EBD130570499EDD1009B27ADAA46906CF50

Function 00DA1138 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255b9afa10b8d4693b5804edc27816a80f1d9ecfdea188dba071f0f02ce26305
Instruction ID: 226a82b082edab89f5151790db939e17174d0666098567a5c31b002b4100a21a
Opcode Fuzzy Hash: 255b9afa10b8d4693b5804edc27816a80f1d9ecfdea188dba071f0f02ce26305
Instruction Fuzzy Hash: BA51C874246A42DFC70AFF2CF9A09453FA1FBE1705704A9EDD1009B27ADEA06906CF90

Function 00DAF1E0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaffb92fbff6eb462f611666d387ed6b6f319d0b7bf8cc1eaa00db7fa72dd48a
Instruction ID: 2249f0ec9220f396f907202f8dc45884fc972a65cc7956d8a0cf488a27c634f2
Opcode Fuzzy Hash: eaffb92fbff6eb462f611666d387ed6b6f319d0b7bf8cc1eaa00db7fa72dd48a
Instruction Fuzzy Hash: CD318138E0024A9FDB19CFA5D45469EB7B6FF89300F148569E806E7350DF70AC46CB50

Function 00DA6F68 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1c02ed2f2cb716e3e44a9bac474c2f8007705b740be4883f7e91ce8061ed58
Instruction ID: b230ae4766b093a440064db8671aeabafce13c610075041820c8005d37281a53
Opcode Fuzzy Hash: df1c02ed2f2cb716e3e44a9bac474c2f8007705b740be4883f7e91ce8061ed58
Instruction Fuzzy Hash: 27315C34E00219DFDB14CBA4D8547AEB7B2EF96310F248569E506EB280DB71ED85CB61

Function 00DA26CD Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5481bba8ac17804e44470f96d4f5a09ab5447659f7856eea10cf4319588b5393
Instruction ID: 372090244663eac617af39685d8184d854ab80ac625954c805a483f17239a1d3
Opcode Fuzzy Hash: 5481bba8ac17804e44470f96d4f5a09ab5447659f7856eea10cf4319588b5393
Instruction Fuzzy Hash: 9B41E0B1D01349DFDB10DFAAC984A9EBFB5FF48310F248429E809AB254DB75A945CB90

Function 00DA5087 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5720b14f9076a0f997c0b3b3e66f0ee93cfda4cefcf718a89c0d5a68af634629
Instruction ID: 0755d593852c9be48ec5aaf1a6efd808dda3edfc4709575f422613bc2ef0b608
Opcode Fuzzy Hash: 5720b14f9076a0f997c0b3b3e66f0ee93cfda4cefcf718a89c0d5a68af634629
Instruction Fuzzy Hash: B03162346007118FDB25EB34D5957AE77F2AF9A344F5005A9D402AB3A4DB35DC42CBB4

Function 00DAF1F0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c238d4d93555ca469bb380168245b805014b6cd67ccba92a96243a36a79e9e
Instruction ID: 5895848b8bde863146e7e2f587b287eae230bf92f7ec6e692bcad34bb3cb95b8
Opcode Fuzzy Hash: c7c238d4d93555ca469bb380168245b805014b6cd67ccba92a96243a36a79e9e
Instruction Fuzzy Hash: C2314D38E1060A9BDB19DFA9D45469EB7B6FF8A310F148569E806E7350DF70EC42CB60

Function 00DA26D8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df47fe5f13338cbceb09e956fe1a73517daf66f91f911e554414cd1078dcfb4f
Instruction ID: b0d744caba5fd300102df1ed69b0b52bfa4cc44457df20e90e62ae109f103fa9
Opcode Fuzzy Hash: df47fe5f13338cbceb09e956fe1a73517daf66f91f911e554414cd1078dcfb4f
Instruction Fuzzy Hash: 1741DEB0D00349DFDB10DFAAC984A9EBBF5FF48310F248429E809AB254DB75A945CB90

Function 00DA5098 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ed2ca4125fa4571466cb4f901f177cac3ca88bc237a665c06e1dc2ae480fb1
Instruction ID: 3e9c5f9f7dc224c2e2c8601f3aed40bb8fd3452cfcc2dbb582de8b69dbc9af5f
Opcode Fuzzy Hash: d3ed2ca4125fa4571466cb4f901f177cac3ca88bc237a665c06e1dc2ae480fb1
Instruction Fuzzy Hash: 07312D34600B158FDB24EB74D9557AE77F2AF8A344F1005A9D401AB3A8DF36DC41CBA5

Function 00DA9257 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e5d1069b8123946f0e0397ef7a918432e349542aee19065cb1da424a4a1c6b
Instruction ID: 142717ab446b20afb4fec2b191bf7573441f41672ecbfd0bc63212ae48a8b78a
Opcode Fuzzy Hash: 22e5d1069b8123946f0e0397ef7a918432e349542aee19065cb1da424a4a1c6b
Instruction Fuzzy Hash: 43318235E0024A9BDB05CF65D49469EFBB6EF86300F14C559E805AB341DB70AD46CB91

Function 00DA168F Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80d0ddc5c0743d080b62589f17a6db6ea7e3eecdfa9cb24d6c09760ef9412fd
Instruction ID: 2884d76574ac659e42e1cdeb6a2a4e826d6388869a1e16289d4eff85467fe7d7
Opcode Fuzzy Hash: b80d0ddc5c0743d080b62589f17a6db6ea7e3eecdfa9cb24d6c09760ef9412fd
Instruction Fuzzy Hash: 47212B3CA01141DFEF22E72CF8487293B65E792314F086DA9D406CB256DBB8DC49CBA1

Function 00DA9268 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd03524785660c632d2f5928c1b78175f9ac80843cfd5859d5b33b41d85e4fb3
Instruction ID: 1c68b15a872b0ecc88de36b5fbec989bac44841ddb5649139fd2fbe57c682526
Opcode Fuzzy Hash: bd03524785660c632d2f5928c1b78175f9ac80843cfd5859d5b33b41d85e4fb3
Instruction Fuzzy Hash: C4216035E0020A9BDB15CFA9D59469EFBB6FF86300F14C619E805BB244DB70ED46CBA0

Function 00DA9159 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9192c2000d25bfedc610a0e499752b60a103585aa347a721c5c63b591162e27
Instruction ID: 69a59a6264d926106a2902b5461436d8db61e9d85f5cc6c0e58326b463967974
Opcode Fuzzy Hash: d9192c2000d25bfedc610a0e499752b60a103585aa347a721c5c63b591162e27
Instruction Fuzzy Hash: 69217171E002069BDB19CFA4C9546DEF7B2EF8A340F14851AE815BB381DB70A946CB60

Function 00DA1868 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc1d37e7964e5370996e0b99484ec67a787e0accd711b00cb85120b7334a921
Instruction ID: 9e031de91dd1892a38a78334e51c57376df97a7607b55406da2a8934de6b6b78
Opcode Fuzzy Hash: ccc1d37e7964e5370996e0b99484ec67a787e0accd711b00cb85120b7334a921
Instruction Fuzzy Hash: 73214C346002158FDB28EB78C5657AE77F6AF8A341F1004A9D506EB2A0DB35DD41CBB5

Function 00DA1370 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b3e3859d94984da4dda544bf70879031e0fb0656d7f274c729fcacc776ac9f4
Instruction ID: 3d73fb570c0acd180cc00a85f7f928c73973c0d9340f8881f56d10a63d949053
Opcode Fuzzy Hash: 1b3e3859d94984da4dda544bf70879031e0fb0656d7f274c729fcacc776ac9f4
Instruction Fuzzy Hash: E121D53C6002509BEF325B6CD44C3293B56E717714F08186AE10ACB3D2DAA9CC9587A2

Function 00DA4F79 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c3589d8e3e9861c274f8e05e4a52da59d00c57ea48e89c26d3ffa82cc61ac5a
Instruction ID: a412245a186463dab5248ee5f4e8a1ebcfddbbacb15e148438a026c6cb59d910
Opcode Fuzzy Hash: 9c3589d8e3e9861c274f8e05e4a52da59d00c57ea48e89c26d3ffa82cc61ac5a
Instruction Fuzzy Hash: 57216B34700214CFDB64EB78D559A9E7BF1EF8A301F1004A9E406EB3A5DB719D06CBA5

Function 00D1D124 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571149599.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d1d000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ecfd65879787bfb79cc134119e6e3380df6e7ad44b1eb18a9c30e927dd68a20
Instruction ID: 8333ee0409e0b413682c24ad3b91b1e07bfa239df416196a2f9cdc8b0e31f7c1
Opcode Fuzzy Hash: 8ecfd65879787bfb79cc134119e6e3380df6e7ad44b1eb18a9c30e927dd68a20
Instruction Fuzzy Hash: 1C210375604340FFDB04DF14E9C0B65BB62FB84314F24C66DE94A4A252CB76D8C6CA71

Function 00DA9168 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc78a785f42fdf20b2c2dba19afbd1dd43f5960b258010fec83aa75cd859e220
Instruction ID: e0ed29f731e57b734e8bb1e25627e92525bd660c088450972f5f6a2a1bfebd81
Opcode Fuzzy Hash: bc78a785f42fdf20b2c2dba19afbd1dd43f5960b258010fec83aa75cd859e220
Instruction Fuzzy Hash: 7C215030E0031A9BDB19CFA4C85469EF7B6AF8A300F64851AE815FB340DB70AD46CB60

Function 00DA1878 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809450beb279a1a94bd04d2b3d3d6a5acac7ea71f2a04186bf26e7d161a8ef7e
Instruction ID: 6ec1fe1b06d193ba14589c076852cd876327fecc98ba18cb8ba512e40d028970
Opcode Fuzzy Hash: 809450beb279a1a94bd04d2b3d3d6a5acac7ea71f2a04186bf26e7d161a8ef7e
Instruction Fuzzy Hash: 89211938B002198BDB24EB78D5657AE77F6AB8A345F200469D406EB2A0DF35DC41CBB1

Function 00DAFE18 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3508228d71e1dc8570deb47ccba280fbc0cc1d3e20d8fd42a58bb269f48675b1
Instruction ID: 194d9ced6d0cae32a6f817e5d7aa0de710ee16bd28225a4609bbbd66a9c54c54
Opcode Fuzzy Hash: 3508228d71e1dc8570deb47ccba280fbc0cc1d3e20d8fd42a58bb269f48675b1
Instruction Fuzzy Hash: 651104317083581FEB0A6F78582056E3FA7EFC6260705446AE505DB3E2DE399E02C7B6

Function 00DA16A0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10654294588829f3b5018de70cea533beb935220e39a7122fe29e753eb78256f
Instruction ID: cb2d362824f96f021bba43a14ed4f2193821b0fd82f3049d7090453fb3cb4f26
Opcode Fuzzy Hash: 10654294588829f3b5018de70cea533beb935220e39a7122fe29e753eb78256f
Instruction Fuzzy Hash: F321B73C601101DBEF25E72CF884B193766E786714F146D69D40ACB255DFB8DC458BE1

Function 00DA4F88 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434eb9bcd1acaddcca32fb865771988b407bc4a9fd411f0b5d379975db390591
Instruction ID: 1b391279589eff71930135e4f8c435de437d778a82b89de5c48b5c470d004866
Opcode Fuzzy Hash: 434eb9bcd1acaddcca32fb865771988b407bc4a9fd411f0b5d379975db390591
Instruction Fuzzy Hash: 11214834700604CFDB24EB78D958AAE7BF2AF8A301F1004A8E406EB3A5DB75DC01CB64

Function 00DA1478 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e823d81e15b4a723a26994fb12776b77206eb54f810fd0e44079863dad0e3208
Instruction ID: feed371738ddb8eac16c6346c0e2b7bc0553ef23a21611b5bf600bcc0884c4f5
Opcode Fuzzy Hash: e823d81e15b4a723a26994fb12776b77206eb54f810fd0e44079863dad0e3208
Instruction Fuzzy Hash: 8D119439E012568FCF21EFB894411AD7BF5EF4B350F2404BAD809E7242D675D8428BB0

Function 00DA0838 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4968563f60e41508dba698b36074ea5e67936a3fe7905381d684a65fcf4d89c1
Instruction ID: 78b5f0fc5224ba1bb69db8cae454e173a21f244fa529bbce443ae5f4a2af6c31
Opcode Fuzzy Hash: 4968563f60e41508dba698b36074ea5e67936a3fe7905381d684a65fcf4d89c1
Instruction Fuzzy Hash: 61110A30B013045BEF156B79C41036A3E15E757314F284879D406CF286DA69CC458FF5

Function 00DA0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5630ffa5d05bf3523077210b229908992cb3bd26901da1e507ce50c34fd0860
Instruction ID: 40feb9aaf0e9b891812e3d704387ca6656fd558b1d28b4df5e60274e786a1326
Opcode Fuzzy Hash: f5630ffa5d05bf3523077210b229908992cb3bd26901da1e507ce50c34fd0860
Instruction Fuzzy Hash: FB11A335B012099BEF14BB79C41476A3A55FB87714F288879D106CF385DE69CC818FE5

Function 00DA6B91 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a107384b070cad87eb9c7de91b76a03191385859aab6b46f3014b4f79a24b9fc
Instruction ID: 33aaef7fadb6c86adf985ebb849cad242da0667030a6124dab966fc26c7812dd
Opcode Fuzzy Hash: a107384b070cad87eb9c7de91b76a03191385859aab6b46f3014b4f79a24b9fc
Instruction Fuzzy Hash: 1F110C3170A2918FD717A778546126E7FB1EF8B300B0444EBD089CB2D2DA755C8A87A2

Function 00DA17B6 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb93dfccf61559bb130c2f102e319784c9ee3585649a937810ce1a2bb1ffe3d
Instruction ID: 68313ccda258cbb079033b1d1e843ba388551407df749c7ea8b71f222210e9c4
Opcode Fuzzy Hash: 6eb93dfccf61559bb130c2f102e319784c9ee3585649a937810ce1a2bb1ffe3d
Instruction Fuzzy Hash: C811D679F402529FDB11ABB8980C66E7FF6FB88250F144879E94AD7341EB34C8558B90

Function 00DA1488 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2db2bd6b4bbdbe63a5bf0d5397219853a9752d0db393452375e9586c61ec89
Instruction ID: b4cda6dce36fda4ec4ffc4e6068a8490a2d0fe6ecd2217df3c04f4900e72038f
Opcode Fuzzy Hash: bc2db2bd6b4bbdbe63a5bf0d5397219853a9752d0db393452375e9586c61ec89
Instruction Fuzzy Hash: F6014035E002158FCB61EFB884511AD7BF5EF8A360F2504BAD805E7241E635D942CBB1

Function 00D1D11F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571149599.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d1d000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 3296bfb34b8862c4768b232a2afaf285f19445d540b919a9c61d53e1da255d8d
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 9811DD75504380EFCB01CF14E9C4B55BBB2FB84314F28C6A9D8494B652C33AD88ACF61

Function 00DA9890 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b11aa1b1bb8490067b4b1e947373f978e8bb881976193801441530b1a8b30cda
Instruction ID: 55b4689193dc73a3fdd1df1c3828cd057add4ae53a7261148ff609f314523139
Opcode Fuzzy Hash: b11aa1b1bb8490067b4b1e947373f978e8bb881976193801441530b1a8b30cda
Instruction Fuzzy Hash: 7611C230A002458FDB14DF64D88478EBF65EF82310F288269C9486B296DB749D06CBB1

Function 00DA80F8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb76cc5cfb232cd63c36bbfe8d0b0cb71fad64979a0f85b28e6bef8d487cf3c0
Instruction ID: a313c9e13518989b4d939aa7305e4ea10f67f12ee2f7752609027472e87eff2d
Opcode Fuzzy Hash: cb76cc5cfb232cd63c36bbfe8d0b0cb71fad64979a0f85b28e6bef8d487cf3c0
Instruction Fuzzy Hash: C0018F3851218ADFEB06FFB8F95159D7F71EB81700F0042EDC004AB195EE756E468BA1

Function 00DA7080 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8abc27f3affcdb0490f8e920c67a28325dcd9b8861cdd211ed5e75faf227b0e6
Instruction ID: 02f8ac89f801749e5b35ba40e4cd95c53d1fb8603bbb32a548da4bef4abfa830
Opcode Fuzzy Hash: 8abc27f3affcdb0490f8e920c67a28325dcd9b8861cdd211ed5e75faf227b0e6
Instruction Fuzzy Hash: A2012438B402048FCB14DB74E9ACB6C37B2EF89315F1454A8E506DB3A0CB31AD82CB40

Function 00DA1514 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abaec642ab885184ae99381c152917c3fef9347a7a6b0e4fc0776a1312999a2
Instruction ID: 1432c840e54eaadae5182a3f73ffb25e2847feb65f24c7d9ba714c0848ef2c38
Opcode Fuzzy Hash: 7abaec642ab885184ae99381c152917c3fef9347a7a6b0e4fc0776a1312999a2
Instruction Fuzzy Hash: 30F0C23BA042508FDB218BA894511AC7BB1EE9B311B1800D7D846DB252D265D842C771

Function 00DA8108 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4571433690.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_da0000_PROFORMA FATURA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb28c8f751840fd59e0b38c7a0db34ce59d216456771d852056a00c739564601
Instruction ID: 54ad5a85285dc9b7da854c8997f47b2ffff543d76eecca7f9b7c15a85b91763c
Opcode Fuzzy Hash: cb28c8f751840fd59e0b38c7a0db34ce59d216456771d852056a00c739564601
Instruction Fuzzy Hash: 2FF0AF3891214ADFEB05FFBCF95169D7BB1EB80700F0042ACC104A7294EEB06F458BA0

Analysis Process: GvgUQlbRIXOe.exePID: 6412, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	336
Total number of Limit Nodes:	12

Executed Functions

Function 0163D031 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0163D0BE
GetCurrentThread.KERNEL32 ref: 0163D0FB
GetCurrentProcess.KERNEL32 ref: 0163D138
GetCurrentThreadId.KERNEL32 ref: 0163D191

Memory Dump Source

Source File: 0000000B.00000002.2215753142.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1630000_GvgUQlbRIXOe.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3ee6e6d37e0bf197fd47f9b0bb805b78a93d47425b34709823d5bbdc773c8fa2
Instruction ID: 4cff09d740201fcf5be7259e46942aadf2f93203e97ff14a84d34eb78f95090d
Opcode Fuzzy Hash: 3ee6e6d37e0bf197fd47f9b0bb805b78a93d47425b34709823d5bbdc773c8fa2
Instruction Fuzzy Hash: FF5156B1900349CFEB14CFA9D9487DEBBF1BF88314F208459E119A7360DB745984CB65

Function 0163D040 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0163D0BE
GetCurrentThread.KERNEL32 ref: 0163D0FB
GetCurrentProcess.KERNEL32 ref: 0163D138
GetCurrentThreadId.KERNEL32 ref: 0163D191

Memory Dump Source

Source File: 0000000B.00000002.2215753142.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1630000_GvgUQlbRIXOe.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b003cd8f09444e8f421698cdb9cfed33defb0e5e830aeb0f9a2f23206d858c53
Instruction ID: 5526ccf6e6ba525ba9539721519834f233e0206d4f1edc6049d4f5cffa95025c
Opcode Fuzzy Hash: b003cd8f09444e8f421698cdb9cfed33defb0e5e830aeb0f9a2f23206d858c53
Instruction Fuzzy Hash: 445144B0900349CFEB54CFAAD948B9EBBF1AF88314F208459E119A7360DB745984CB65

Function 07217E9D Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 072180DE

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: be3b7c9e5b940088d9419d52d8985e7f996d2a63dd926762946b0439161b2a99
Instruction ID: 0933f4d7fda3c06a5ec8e0e8baafdcf2be61f4078c6563c01d69e64d6d8f3362
Opcode Fuzzy Hash: be3b7c9e5b940088d9419d52d8985e7f996d2a63dd926762946b0439161b2a99
Instruction Fuzzy Hash: 50A13AB1D1025ADFEB24CF68C881B9EBBF2BF58310F148569E809A7240DB749985CF91

Function 07217EA8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 072180DE

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 776202d54f67d6e7ad9f7f78d5f22cd3e80e56f42ca951daa7ef465aeb2da8f9
Instruction ID: e0ee1480d49ea74a6c0ee8c874fe1c962e9b613e2b0a3d602eca9a873a325cb5
Opcode Fuzzy Hash: 776202d54f67d6e7ad9f7f78d5f22cd3e80e56f42ca951daa7ef465aeb2da8f9
Instruction Fuzzy Hash: 7A913AB1D1021ADFEB24CF68C881B9EBBF2FF58310F148569E809A7240DB749985CF91

Function 0163ADA8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0163AFFE

Memory Dump Source

Source File: 0000000B.00000002.2215753142.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1630000_GvgUQlbRIXOe.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: af948f8d635a036c18f82d538871377a025d81ef2175cc50e52155eba3a7e587
Instruction ID: d9fe084bd3f8d563da19dcc7e014fd202666656ef91bc14ed9a4e84f4f6a61f6
Opcode Fuzzy Hash: af948f8d635a036c18f82d538871377a025d81ef2175cc50e52155eba3a7e587
Instruction Fuzzy Hash: 54713570A00B058FE724DF6AC84475ABBF1FF88604F008A2DD58AD7B50D775E849DB91

Function 055518E4 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05551A02

Memory Dump Source

Source File: 0000000B.00000002.2220685487.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5550000_GvgUQlbRIXOe.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0e715f7ac02dc1c9aa79cd1f1f1dac7dd633b60c777e2d5fb6ed557584d0acb2
Instruction ID: 225fb45cf60b23d86b647f1d0b7fb068bbff55d6701a5fbe7fd1729281689743
Opcode Fuzzy Hash: 0e715f7ac02dc1c9aa79cd1f1f1dac7dd633b60c777e2d5fb6ed557584d0acb2
Instruction Fuzzy Hash: 2251D0B1D10709DFDB14CF99C994ADEBFB1BF48310F24822AE819AB250D775A985CF90

Function 055518F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05551A02

Memory Dump Source

Source File: 0000000B.00000002.2220685487.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5550000_GvgUQlbRIXOe.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0f3ed1c962b518647c43a6b02da66e30e99ddd9d000a6e9f8f8125ee4e3311b4
Instruction ID: 474f480ee78cc4c7657b9db5bcf0b19c5d72ef631715d8e846985ee7da1b3904
Opcode Fuzzy Hash: 0f3ed1c962b518647c43a6b02da66e30e99ddd9d000a6e9f8f8125ee4e3311b4
Instruction Fuzzy Hash: 4E41C0B1D107499FDB14CF99C894ADEBFB5BF88310F24812AE819AB210D774A985CF90

Function 0163590C Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016359C9

Memory Dump Source

Source File: 0000000B.00000002.2215753142.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1630000_GvgUQlbRIXOe.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4f37c00dd779b4b3bbfd05e3782b4a349ad120b286359ea0a6bae68143627379
Instruction ID: defd9150d6f18677883f059803a797de13e975ac202987c572d5a642e161f31e
Opcode Fuzzy Hash: 4f37c00dd779b4b3bbfd05e3782b4a349ad120b286359ea0a6bae68143627379
Instruction Fuzzy Hash: 2941EFB0C00719CBEB25CFAAC884BDEBBB5BF89314F60816AD409AB251DB755946CF50

Function 016344B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016359C9

Memory Dump Source

Source File: 0000000B.00000002.2215753142.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1630000_GvgUQlbRIXOe.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a834dac332386ab428a74683dff0aecfcc91da05afc7323a2d2e367021a33fbf
Instruction ID: 7d4a6c66392682d07501a296aa646ce7c864f182e00b3dfd5d30fb00e1951b66
Opcode Fuzzy Hash: a834dac332386ab428a74683dff0aecfcc91da05afc7323a2d2e367021a33fbf
Instruction Fuzzy Hash: B941D270C0071DCBEB24DFAAC98479EBBB5BF89704F20815AD409AB251DB756946CF90

Function 05554040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05554101

Memory Dump Source

Source File: 0000000B.00000002.2220685487.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5550000_GvgUQlbRIXOe.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6dcf0364a3fbf90fae44d85d85356774f51f51aee92bca149f35cc63855403b6
Instruction ID: a50f87c5238fa55ebd4edc729eb3a361ec26ff20ccb0ec4f6165bb273052df5e
Opcode Fuzzy Hash: 6dcf0364a3fbf90fae44d85d85356774f51f51aee92bca149f35cc63855403b6
Instruction Fuzzy Hash: DA41F7B5A00709CFDB14CF99C848AAABBF5FB88324F24C459D519AB321D775A841CFA0

Function 07217C18 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07217CB0

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a7c6266723d36d9a1e4bb3836c5d381395fae6ea14684cf5e8ef996fc2222031
Instruction ID: 29b65bffc0ea12103ced4f0d849f0e1651f427f65bfe09529190c9f831fcbad2
Opcode Fuzzy Hash: a7c6266723d36d9a1e4bb3836c5d381395fae6ea14684cf5e8ef996fc2222031
Instruction Fuzzy Hash: C92139B291034A9FDB10CFA9C881BDEBBF5FF88320F10842AE558A7341C7789550CBA1

Function 07217C20 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07217CB0

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: cecce563719e612df2c4a080e8624b22689aaa84b2a492c54badc639f09645ba
Instruction ID: 98d4b142cb9cb78a5e8a52959c044d88347de4743365be384e828d19a79c0ac5
Opcode Fuzzy Hash: cecce563719e612df2c4a080e8624b22689aaa84b2a492c54badc639f09645ba
Instruction Fuzzy Hash: 4D2128B191034A9FDB10CFA9C885BDEBBF5FF88320F108429E519A7340C7789550CBA4

Function 07217D09 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07217D90

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2fa0e91725e77bd272457c4bc1484fb3fc8a0e2027a6ff694115b9947bd4ed8e
Instruction ID: cf48f8e81cfcf5b6a98cd13a265b46a8e60201d85cefbbfef6651d900ed00197
Opcode Fuzzy Hash: 2fa0e91725e77bd272457c4bc1484fb3fc8a0e2027a6ff694115b9947bd4ed8e
Instruction Fuzzy Hash: 9E2119B190035A9FDF10CFA9C884BEEBBF1FF88310F14852AE559A7240C7789551CBA1

Function 0721764A Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 072176CE

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 907e17ba497d8fc11da0e85245afbe62a0ffc8c436387d4d0b367c4a158b60f9
Instruction ID: c9fee28c1427f46ab7d2384cf674ab658c84b6084a77341715322ca3418d2187
Opcode Fuzzy Hash: 907e17ba497d8fc11da0e85245afbe62a0ffc8c436387d4d0b367c4a158b60f9
Instruction Fuzzy Hash: AE2137B191034A8FDB10CFAAC4857EEBBF0BF98314F24842ED559A7240CB789945CBA5

Function 07217650 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 072176CE

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 24005d54ce0a550582a2108edca8b9265fef7f2bc6c9de6a708d99bfa1c100c8
Instruction ID: effa2aa5ecb9e10749157ca1a541c198a39cad9b6302e7396558562ec10441e0
Opcode Fuzzy Hash: 24005d54ce0a550582a2108edca8b9265fef7f2bc6c9de6a708d99bfa1c100c8
Instruction Fuzzy Hash: D62138B191030A8FDB10CFAAC4857AEBBF4BF98324F14842ED559A7340CB789945CFA5

Function 07217D10 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07217D90

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1c85d460407ad88328b74ccbc2e9d2426f81015c8609ab8c12c66bdb96942c2f
Instruction ID: ec131a531c9e5e8d94f5ffe9cd83342a1fe467711bc414f53058dff5f23994f6
Opcode Fuzzy Hash: 1c85d460407ad88328b74ccbc2e9d2426f81015c8609ab8c12c66bdb96942c2f
Instruction Fuzzy Hash: BE2128B180035A9FDB10CFAAC881BEEBBF5FF88310F108429E519A7240D7789550CBA5

Function 0163D689 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0163D717

Memory Dump Source

Source File: 0000000B.00000002.2215753142.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1630000_GvgUQlbRIXOe.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f21c4e5ba5bc124bd2f74e73109b9e9cfc7881485cfa85fb36168ffed7fe8499
Instruction ID: 74f8bb70dc0b7e8a15e72408516a8da6a12ab9958f5bc8de432d1e8778b92284
Opcode Fuzzy Hash: f21c4e5ba5bc124bd2f74e73109b9e9cfc7881485cfa85fb36168ffed7fe8499
Instruction Fuzzy Hash: 7421E0B5900249DFDB10CFAAD984AEEBBF4FB48324F14841AE918A3350D378A950CF60

Function 0163D690 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0163D717

Memory Dump Source

Source File: 0000000B.00000002.2215753142.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1630000_GvgUQlbRIXOe.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1e457b2b6a2b564dec34df8c6f8660324287869937ad540761fe0357682d6f4c
Instruction ID: 37bca2bf9484f31236e021e77cbc3063106e685cdfed75fd1ddc6e2b5d7a1db3
Opcode Fuzzy Hash: 1e457b2b6a2b564dec34df8c6f8660324287869937ad540761fe0357682d6f4c
Instruction Fuzzy Hash: 3821C4B5900249DFDB10CF9AD984ADEBFF4FB48324F14841AE918A3350D378A954CFA5

Function 07217B58 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07217BCE

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2e5ce1f2c57dda9de11476c8c2c90dc0d4868002f44acd8419cdf66d7baa4db8
Instruction ID: f140b5575492581706f659199d6296932ddfc97747835c9876bb4b03cc969aa3
Opcode Fuzzy Hash: 2e5ce1f2c57dda9de11476c8c2c90dc0d4868002f44acd8419cdf66d7baa4db8
Instruction Fuzzy Hash: 5511597290024ADFDB10CFA9C844BEEBFF5BF98320F248819E559A7250C7799550CFA0

Function 0721759A Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07217602

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0b8e9d6bc581145c0e576f369c2b259cf022aee9b7ed801d23a443fa90e16180
Instruction ID: cd93ac75601f635fc43ff3c6020c229f7128f8dc9df6c61f2018bdcc534d3281
Opcode Fuzzy Hash: 0b8e9d6bc581145c0e576f369c2b259cf022aee9b7ed801d23a443fa90e16180
Instruction Fuzzy Hash: 19115BB190034A8FDB20DFAAC4457DEFFF4EF98624F24841DD559A7240CB756940CBA5

Function 07217B60 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07217BCE

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d95c11dc56f45b9d3fd15080b0a9a01e5bde9d791de9dacaedf13a914aa85e07
Instruction ID: 273b6e99933d10028b5af2902af89bf68f83f28c32dc1dceef5dd8c057b4797d
Opcode Fuzzy Hash: d95c11dc56f45b9d3fd15080b0a9a01e5bde9d791de9dacaedf13a914aa85e07
Instruction Fuzzy Hash: 1611567280034A9FDB10CFAAC844BDEBBF5AF98320F208419E519A7250CB79A550CBA0

Function 072175A0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07217602

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c0d4b0fa305136a9de06ce21a98e1d05b24f2e1893c8f6f81e059e08d0067a0e
Instruction ID: 0457014815f6c6bb87e69f38f6755ae9593c0421aac3a06ee67a911974379702
Opcode Fuzzy Hash: c0d4b0fa305136a9de06ce21a98e1d05b24f2e1893c8f6f81e059e08d0067a0e
Instruction Fuzzy Hash: 431136B1D0034A8FDB20DFAAC44579EFBF4AF98724F248819D519A7340CB79A940CBA5

Function 0721BA98 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0721BAFD

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4a6326e663409bbda6ecb4e156eeb39d86f4da73b6fc65c7b5c08331171afa5d
Instruction ID: f0f899bcce70ef94f51c0455252fddc0ccdb9ac40a586cd830f8999eb69b1fe2
Opcode Fuzzy Hash: 4a6326e663409bbda6ecb4e156eeb39d86f4da73b6fc65c7b5c08331171afa5d
Instruction Fuzzy Hash: A81116B58007499FDB10DF99D484BDEFFF8EB49320F14844AE554A3241C3756554CFA1

Function 07218DFC Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0721BAFD

Memory Dump Source

Source File: 0000000B.00000002.2221695574.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7210000_GvgUQlbRIXOe.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 98c3fcbbf29a1e2745e0dccaeb9c0bb4f1482f2a4a897002dc5fd3b68df64ce3
Instruction ID: b218c36851ea1b9b1b74c355129e5b688af25b746496c4630ad9b87b22deaaff
Opcode Fuzzy Hash: 98c3fcbbf29a1e2745e0dccaeb9c0bb4f1482f2a4a897002dc5fd3b68df64ce3
Instruction Fuzzy Hash: 891133B5810349DFCB20DF9AC488BDEBBF8FB58320F108419E919A3200C3B5A940CFA0

Function 0163AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0163AFFE

Memory Dump Source

Source File: 0000000B.00000002.2215753142.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1630000_GvgUQlbRIXOe.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: dc8df1b97f5ba3bba280b99eb2fd9d58b97d31e6697f6ec9ce6cbe359f27aed5
Instruction ID: 1b953d6073cdf89f91a9a18dd4f532a19b8aba43eca99ec542a5803e104b0556
Opcode Fuzzy Hash: dc8df1b97f5ba3bba280b99eb2fd9d58b97d31e6697f6ec9ce6cbe359f27aed5
Instruction Fuzzy Hash: 67110FB6C007498FDB20CF9AC844B9EFBF4AB88324F10841AD529A7210D379A545CFA1

Function 0144D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2215077988.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_144d000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c725199229182ff0056d6846cc39ea6adf1770b388791d78b1ab270ecbba0090
Instruction ID: 1e2ec1bf3ebb77dd9bf7764734021f961696e54bff95b2b4301d2b38e013129a
Opcode Fuzzy Hash: c725199229182ff0056d6846cc39ea6adf1770b388791d78b1ab270ecbba0090
Instruction Fuzzy Hash: 99210672904240DFEB05DF94D9C0B2BBF65FB98320F20C56AED090B266C376D416CBA1

Function 0144D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2215077988.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_144d000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8469cfa9859a5ca4db482e231af91197ca722cad3a25e3fe83346a3f1e8c4d94
Instruction ID: 483f7f21a4c7a0a8af303d9943402da247d394484af63c685774030a9d741776
Opcode Fuzzy Hash: 8469cfa9859a5ca4db482e231af91197ca722cad3a25e3fe83346a3f1e8c4d94
Instruction Fuzzy Hash: C6210372A04240EFEB05DF54D9C0B2BBF65FB98318F20C56EE9090B266C736D456CAA1

Function 015AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2215437749.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_15ad000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cbbba000c96975392d839103631d6e52d850b89f0a7349d032e8b3a043b14e5
Instruction ID: 9103e02ea0c9c46bcd5fca2a7609d9c52b828e2ae64008c38c701caa95de5a49
Opcode Fuzzy Hash: 9cbbba000c96975392d839103631d6e52d850b89f0a7349d032e8b3a043b14e5
Instruction Fuzzy Hash: 90214275284200EFCB14EF64D9C0B2ABBB1FB88314F60C96DD90A0F652D37AC407CA61

Function 015AD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2215437749.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_15ad000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ff4255b5b4a34570adf825defaacfc02c6db79eceba6df5b7834e267bb4b9b
Instruction ID: 85552eb275243c0e4e7a369fe86dc1fab6a27c46149d88f056b337b971b28f3f
Opcode Fuzzy Hash: 21ff4255b5b4a34570adf825defaacfc02c6db79eceba6df5b7834e267bb4b9b
Instruction Fuzzy Hash: 3F21FF75544200EFDB05EF94D980B2EBBB1FF84324F60C96DE90A4F652C77AD806CA61

Function 015AD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2215437749.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_15ad000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21269b2dfd2092d8a02b3a8619f90aff09ff7d08dbcece3e62f3dc54e8597901
Instruction ID: 3415e90344ba16a715a0950643b617849ae5e188de88a335523eb6c5f031a084
Opcode Fuzzy Hash: 21269b2dfd2092d8a02b3a8619f90aff09ff7d08dbcece3e62f3dc54e8597901
Instruction Fuzzy Hash: 36218E755493808FCB02DF24D990719BF71FB46214F28C5EAD8498F6A7C33A980ACB62

Function 0144D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2215077988.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_144d000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d2786e60e1e4201bb004dcd9f59ae96814e242b2a6b2dda49e09682ea99c03
Instruction ID: d8f1a64d6ea33a47a37d1b66f84caccd1625d1f1e9386a17d5c1fa5d9cded651
Opcode Fuzzy Hash: 45d2786e60e1e4201bb004dcd9f59ae96814e242b2a6b2dda49e09682ea99c03
Instruction Fuzzy Hash: AE21AF76904284DFDB06CF54D9C4B56BF72FB84324F24C5AADD090B666C33AD426CBA1

Function 0144D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2215077988.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_144d000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 7e6134405b1cab38e43fba5fb77e8d6fc6bfcee3076092fd1c5fb276ffb9aa9e
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: FB11DF76904280CFDB02CF54D9C0B16BF71FB94318F24C6AAD8090B266C33AD456CBA1

Function 015AD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2215437749.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_15ad000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 3b90b425ff2cf24610fa90e9cda43146caafc462c33295911524e7ed5c96154c
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 9411BB75544280DFCB02DF54D5C4B19BFB1FF84224F24C6A9D8494F6A6C33AD40ACB61

Function 0144D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2215077988.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_144d000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bed310192fe9eca21445ca2f901db19a743487915befa6e667216a129a849d8
Instruction ID: e78a4b6de21bdf1dcfdf4891cffcf66b3c135afc60f15ebf2d9f7e91cb8ac9f2
Opcode Fuzzy Hash: 4bed310192fe9eca21445ca2f901db19a743487915befa6e667216a129a849d8
Instruction Fuzzy Hash: 3401F7758043809BF7109FA9CD84B27BF98DF51264F18C51BEE080A3A6C6799441C671

Function 0144D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2215077988.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_144d000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa88f89e20d95630505ad09f34eb105003a37bf95208d2cdcc0a2d1fa844b320
Instruction ID: d7a50becffd986aece6a625b559ae7b587832e5b035e2dfbe33f35116b232ecc
Opcode Fuzzy Hash: aa88f89e20d95630505ad09f34eb105003a37bf95208d2cdcc0a2d1fa844b320
Instruction Fuzzy Hash: C1F0C2764043849BFB108E19C888B63FF98EB91634F18C05BED080A396C2799840CBB1

Analysis Process: GvgUQlbRIXOe.exePID: 6112, Parent PID: 6412COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	45
Total number of Limit Nodes:	6

Executed Functions

Function 010E9B40 Relevance: 2.8, Instructions: 2810COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19900f44ca214318ef038616ac031390d001b6c842ecac8c0165e4ce6b20c129
Instruction ID: a2299e8c686859675de63a00489ee895d6e676eae5efd570a90a158020c05eed
Opcode Fuzzy Hash: 19900f44ca214318ef038616ac031390d001b6c842ecac8c0165e4ce6b20c129
Instruction Fuzzy Hash: 3B53F731D10B1A8ADB51EF69C884599F7B1FF99300F15C79AE4987B121FB70AAC4CB81

Function 010ECDC0 Relevance: 2.3, Instructions: 2295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e0b216293fbe73efb90f2429b4a19e8ad96073b2b1d1aca7fe5facc79030bd
Instruction ID: 5a4cf55f72fa4968a4877d55d470808602a189cada288677f5f069ba4d37e769
Opcode Fuzzy Hash: 66e0b216293fbe73efb90f2429b4a19e8ad96073b2b1d1aca7fe5facc79030bd
Instruction Fuzzy Hash: DA332C31D1071A8EDB11EF69C8946ADF7B1FF99300F14C79AE458A7211EB70AAC5CB81

Function 010EF4B9 Relevance: .7, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eac9d615b0470a714f342a8fbfb1ba018c0de5935e18e1d88b621503119c727
Instruction ID: ac2d50553b10bf315ca99b525dd9cee1f5e3ab6aa0124c057226dac70ae7bf43
Opcode Fuzzy Hash: 4eac9d615b0470a714f342a8fbfb1ba018c0de5935e18e1d88b621503119c727
Instruction Fuzzy Hash: 15522C30A002068FDB64DF69C588B9DBBF2EF89314F5485AAD489EB351DB75EC81CB41

Function 010E41B8 Relevance: .3, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ed64044d99ce7ccae3b69eb4cf2d5cd82f7d90c9d5d6c5aeda29e41b6c71d0
Instruction ID: 64253c7e4d4175ac3a9fc5bbb3ee36cf8998be9f38644a067354efaa721ed853
Opcode Fuzzy Hash: 42ed64044d99ce7ccae3b69eb4cf2d5cd82f7d90c9d5d6c5aeda29e41b6c71d0
Instruction Fuzzy Hash: A3B13B71E002198FDF54CFAAC8897EEBBF2BF88714F148129D855E7294EB749845CB81

Function 010E4A88 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81d71f7cb8051c602c7ba499fa9e7a4c95d1689da26b10e15f1177c4dedfadb1
Instruction ID: 5cf24c1c9e3299a7ca99ea6509835b2fe92e4d588b170cd0e9eaf1a9beb12683
Opcode Fuzzy Hash: 81d71f7cb8051c602c7ba499fa9e7a4c95d1689da26b10e15f1177c4dedfadb1
Instruction Fuzzy Hash: E8B17B70E04209CFDF54CFAAC8997EDBBF2AF88714F148129D854EB294EB759845CB81

Function 010E3E70 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2efe40af4e6352f0356897fa0f01802fe1d38f865ffdb8b29214040b04bd458
Instruction ID: 72ace4e90553c7713de9481848ca110f4a2352aa7c77a533abc2dfc741c01745
Opcode Fuzzy Hash: c2efe40af4e6352f0356897fa0f01802fe1d38f865ffdb8b29214040b04bd458
Instruction Fuzzy Hash: 99915A70E002098FDF54CFAAC98979EBFF2BF88714F148169E485EB254EB749845CB81

Function 05FCE228 Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4582928112.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5fc0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d36a5c2baf7585ab290c6e1340432573f6e93f1e9801bf20a34f4ef1c2941db
Instruction ID: a056be73909d858db2a7c846be081a7ba5387c206295a3d6af8d3d07ceee870a
Opcode Fuzzy Hash: 4d36a5c2baf7585ab290c6e1340432573f6e93f1e9801bf20a34f4ef1c2941db
Instruction Fuzzy Hash: 27411232D187568FCB04DFA9D8447EEBFF5AF89210F1486AAD505A7240DB789885CBA0

Function 05FCE310 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(8B55051E), ref: 05FCE377

Memory Dump Source

Source File: 0000000E.00000002.4582928112.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5fc0000_GvgUQlbRIXOe.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 8395a21e4d4ecf64b2da181c9fdcbd49337a44df2cd360566412a483c8b79204
Instruction ID: 4b73b8cf57136460fe3099853714a4b790c2d5da6c47c1d53dc0fc3efda5d708
Opcode Fuzzy Hash: 8395a21e4d4ecf64b2da181c9fdcbd49337a44df2cd360566412a483c8b79204
Instruction Fuzzy Hash: 3C1123B1C0065A9FCB10CF9AC544BDEFBF8BF48320F14826AD918A7240D378A954CFA5

Function 010E7910 Relevance: .6, Instructions: 554
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a932434d95cbcfa32c0167aed52a52e94d2b53b4570c43eee43386924d015425
Instruction ID: 794d917bace4414c5ef366ddf525a4ba7dc6c10a5c15be975013550b185a2996
Opcode Fuzzy Hash: a932434d95cbcfa32c0167aed52a52e94d2b53b4570c43eee43386924d015425
Instruction Fuzzy Hash: 611280307022039FDB2AAB38E56422936A2FBC9314B10993DE156DF755DF79DD878B80

Function 010E96E8 Relevance: .4, Instructions: 355
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d1dcb6df2e30e323d63342db4742b96698d956fee1c3f30771ab0b77740589
Instruction ID: 98371720d1a6af80b4cc2275044c0200180a911833bf3fc43fefae5f6c102590
Opcode Fuzzy Hash: 41d1dcb6df2e30e323d63342db4742b96698d956fee1c3f30771ab0b77740589
Instruction Fuzzy Hash: 80C1AD70B002058FDB55CF69D8847AEBBF2FF88314F1481AAE549DB295DB70D845CB90

Function 010E936C Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1259d97440acaa6aa7eca6c92b12c8a3af3cedc979bc467c4401d72315770308
Instruction ID: ea0b286b9ea262e5e380cc793f04037aa150804840b200c54e5f1e344b96c00d
Opcode Fuzzy Hash: 1259d97440acaa6aa7eca6c92b12c8a3af3cedc979bc467c4401d72315770308
Instruction Fuzzy Hash: 92B17B35A001048FDB15DFA9D998AADBBF2FB88214F148469E546EB395DF34DD42CB40

Function 010E41AC Relevance: .3, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de558127c42051afb0752edecf120235ff6c9ae079e9117796e88fae1424bfc
Instruction ID: b25f9f8a2e60864d38296be2bfbd2b5b1015cd79f2b64476629f94be8e40ffab
Opcode Fuzzy Hash: 0de558127c42051afb0752edecf120235ff6c9ae079e9117796e88fae1424bfc
Instruction Fuzzy Hash: 8FB13971E002198FDB50CFAAC8897EEBBF2AF88714F148129D895E7254EB749845CB91

Function 010ECAA8 Relevance: .3, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa429eff3c30057a7cb1c0282f62e3bd007a3e3d44f0b5b94b52be586a58b46
Instruction ID: 2b8ca2eaf2fe60185ea8fab8247ff64a7ba2f28bcdaaeb5b072fb7c943c1e417
Opcode Fuzzy Hash: 0fa429eff3c30057a7cb1c0282f62e3bd007a3e3d44f0b5b94b52be586a58b46
Instruction Fuzzy Hash: E291F432A041598FEB25CB59CA847FDFBF1EB80310F1989A6D485EB642C236EC85D790

Function 010E4A7C Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 791503f911512e8c13029755c81d0444f4c029bd3b446b2af67ff6c3d17d89ac
Instruction ID: 4a36b9c04740c7d406b5410cccbdbc337d401939bc1e67f692ab8b159720a59e
Opcode Fuzzy Hash: 791503f911512e8c13029755c81d0444f4c029bd3b446b2af67ff6c3d17d89ac
Instruction Fuzzy Hash: 21A17B70E04209CFDF54CFAAC8997DDBBF2AF88714F148129D854EB294EB759885CB81

Function 010E3E64 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2a9229591a847d6789b7fb82395da7942a53dd26c25cb4020e6c326ef9257b
Instruction ID: b09b1be08e5052f75e487138a418078696749e5fa07d7832ab056d37bb7b1229
Opcode Fuzzy Hash: 3a2a9229591a847d6789b7fb82395da7942a53dd26c25cb4020e6c326ef9257b
Instruction Fuzzy Hash: 04914870E002098FDF50CFAAC9897DEBFF2AF88314F148169E484EB254EB749845CB91

Function 010EFC38 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04a72c039f6817b789ab12abec1a5fddae25f2a4d5b2b7ff91fb5986bcef91b
Instruction ID: bd2055c0c0d22ae3bf27c686785fe592f836e4f7b30d8913200fe2266118480b
Opcode Fuzzy Hash: a04a72c039f6817b789ab12abec1a5fddae25f2a4d5b2b7ff91fb5986bcef91b
Instruction Fuzzy Hash: EE71A231F0421A9BDB19EFA9C8546AEBBF6AFC4A00F144529E505AB380DF349D42CB91

Function 010E4800 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b85ea0d6305888c780e076eb485cdc009d3c81d57cec02a639f72ad1233a56
Instruction ID: dc7e2afbf3d0ff38fe64b57d418082b8492fe4d9a931384cb65cf908615d22ea
Opcode Fuzzy Hash: 88b85ea0d6305888c780e076eb485cdc009d3c81d57cec02a639f72ad1233a56
Instruction Fuzzy Hash: A3716970E002499FDB54CFAAC8887EEBBF2BF88714F188129E455E7254EB749841CF95

Function 010E47F4 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8043e0a97d184998ed62f74d76b18a7316fca902df1e14edec1df425af7c13
Instruction ID: d0540256ca1afa1480df48c4d7fd498677a8b092010e2e8efdc4ac3fdbdc294e
Opcode Fuzzy Hash: 5c8043e0a97d184998ed62f74d76b18a7316fca902df1e14edec1df425af7c13
Instruction Fuzzy Hash: 4B714870E002498FDB54CFAAC9897DEBBF2BF88714F188129E494E7254EB749841CF95

Function 010E6EC7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902f58914c5f0fddb4d654fde462b17ae6476050ba9090901f06108b52a1f25a
Instruction ID: 1c6a8aa1fef9cd89ac1e1330e4512c248380972159810cf144db48d10acab954
Opcode Fuzzy Hash: 902f58914c5f0fddb4d654fde462b17ae6476050ba9090901f06108b52a1f25a
Instruction Fuzzy Hash: 1351B330A002599FDB19DF79D4587AEB7F2FF85300F20856AE446EB291DB719842CB50

Function 010E6CCD Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c363e8c994791d49c4541b217f4ecfa08a44c4bd1bf5276fe815aaa3f8604531
Instruction ID: 879a32468b700427f9f06137c1d9a02e763a646621de15bc9c37deaac7521b17
Opcode Fuzzy Hash: c363e8c994791d49c4541b217f4ecfa08a44c4bd1bf5276fe815aaa3f8604531
Instruction Fuzzy Hash: 22513470E002588FDB18DFAAD8887DDBBF1BF48314F54815AE855BB391C7B5A840CB55

Function 010E6CD8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f796ee5714eb1058e58d96377337198da3455cf681dcac7f2be7ef1dafac20f
Instruction ID: 531d1c02c1a0ca5b1e2bd4c92aeaf5a3a6af0390ca83fd1751b48e88e06679b8
Opcode Fuzzy Hash: 0f796ee5714eb1058e58d96377337198da3455cf681dcac7f2be7ef1dafac20f
Instruction Fuzzy Hash: DA511470D002188FDB18DFAAD848B9DBBF1BF48310F54815AE855BB391D775A844CF95

Function 010E112A Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc4b4c538b842760fbdfb181eee5b829a54875d0afea62bab3b124ce24b8372
Instruction ID: 8908f4b712f2b32c476055ddc88f0a5ece7e25ea97fe7a9af5f498dfe8941a54
Opcode Fuzzy Hash: 8dc4b4c538b842760fbdfb181eee5b829a54875d0afea62bab3b124ce24b8372
Instruction Fuzzy Hash: CF51ED342032828FCB19EF28FBB09543FA1BB9131D300596DD1449BE6EFA746A16CB51

Function 010E1138 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ff86b6cb1ca4b3a66c0c94aaf8a80b5a894812274996b99774ac54f9d4d3e5
Instruction ID: 1bf1fafb2d5bd02effbda88785c9611240d1ca412624080c28bd9866d2a933fa
Opcode Fuzzy Hash: d2ff86b6cb1ca4b3a66c0c94aaf8a80b5a894812274996b99774ac54f9d4d3e5
Instruction Fuzzy Hash: 8A51AD34207283CFCB19EF28FBB09443FA1FB9131D3045969D1449BE6EEA746A26CB51

Function 010EF31D Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: decbbcde417e5d91178ad7c4de49c3b93d7f13acfb91920d03c6cdb67b5bec59
Instruction ID: 6060fef0ee57baefd4cdaabef84864712b2d492aebfb140300f24c4dbd1222e3
Opcode Fuzzy Hash: decbbcde417e5d91178ad7c4de49c3b93d7f13acfb91920d03c6cdb67b5bec59
Instruction Fuzzy Hash: 2E31F470B002068FDB5AAB39C55866E7BE3AFCA640F54446CD486DB399DF35CC42CB91

Function 010E6F68 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e59fc3737e80e5855d352b622456a7eac5719eb018c94c525dffb74a499e64a4
Instruction ID: 48c2b9f084b173cf476f194be300ecac664fb0fa9953487aaa207cba41515030
Opcode Fuzzy Hash: e59fc3737e80e5855d352b622456a7eac5719eb018c94c525dffb74a499e64a4
Instruction Fuzzy Hash: 08318134E0121ADFDB29CBA9D45879DBBF1FF85300F508565F442EB245D771A982CB90

Function 010EF1E0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f896fd576b405b64eb79e655efba5babb0856cf2dcb162e373f9020eb55be23b
Instruction ID: 6d8a58d33d9e8cb500c5a738275849464888b5b24ed5b17c289d4f6b28fe3ce0
Opcode Fuzzy Hash: f896fd576b405b64eb79e655efba5babb0856cf2dcb162e373f9020eb55be23b
Instruction Fuzzy Hash: 22315C34E102069FDB19DFA9D4946AEBBF6BF89300F10855DE856EB250DB70AC42CB40

Function 010E26CE Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4265aa8a12db593d1cc293b00983d735ac4b8633b88b5cc495b6e00290468942
Instruction ID: deaaddbffe720c53f76f80a93d23f115d0b65243ba5d9c91cd54db62aa13ad9b
Opcode Fuzzy Hash: 4265aa8a12db593d1cc293b00983d735ac4b8633b88b5cc495b6e00290468942
Instruction Fuzzy Hash: DA41E1B0D01349DFEB14CF9AC984ADEBFF5BF48310F148429E849AB254DB759949CB90

Function 010EF1F0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec5e5c4fa77a1314eb592d08370c822e661220138dfd6909a33f75837e2c3159
Instruction ID: 2a830b95689a98f078404186f1e3215164e1c4220cf1875fb9aff857114fdfd3
Opcode Fuzzy Hash: ec5e5c4fa77a1314eb592d08370c822e661220138dfd6909a33f75837e2c3159
Instruction Fuzzy Hash: A6313A34E106069FDB19DFA9D49869EB7F6BF89300F508919E856FB350DF70A842CB50

Function 010E26D8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a343204be1670e82702a40785b8316e0c29073b5841a4a06874cf5376fa9085
Instruction ID: c874531cc8d4a4e3d6071056ec34cf7efce1db48d8246a76f0864d838390464a
Opcode Fuzzy Hash: 1a343204be1670e82702a40785b8316e0c29073b5841a4a06874cf5376fa9085
Instruction Fuzzy Hash: 6841EFB0D01349DFEB14DF9AC984A9EBFF5FF48310F148029E809AB254DB75A945CB90

Function 010E5098 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba0bda47c437cd43f8558f570ede2f1dade805b68e700644484f80d05ff0136
Instruction ID: 050904c4829cfa8ae416ef108a90679995a896a868fa7d993df7b0799dadecdd
Opcode Fuzzy Hash: dba0bda47c437cd43f8558f570ede2f1dade805b68e700644484f80d05ff0136
Instruction Fuzzy Hash: EA31A434701255CFDB68EB39C95869E7BF2AF88208F1008A9D441AB794DF36DD41CB91

Function 010E5087 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 861e75e77532f707fe6c205829778dbc957f347ac3643e21e4e965a5d59e8a01
Instruction ID: 410d0e68716516cdfa6df3d075e81471a9d53f24efa642f2b806664c5a953f1f
Opcode Fuzzy Hash: 861e75e77532f707fe6c205829778dbc957f347ac3643e21e4e965a5d59e8a01
Instruction Fuzzy Hash: 01318134701251CFDB59EB35CA686AD7BF2AF89208F1008E9D441AB7A4DF36DD41CB90

Function 010E168F Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84340458f83438055ee99f682dee9b9d194292c68f323631e8c8326d417f5f59
Instruction ID: 49bcf513cc847dffb21654fc5e56bd454fc463c0524b0c3bace8cf0af3430943
Opcode Fuzzy Hash: 84340458f83438055ee99f682dee9b9d194292c68f323631e8c8326d417f5f59
Instruction Fuzzy Hash: 8B3109386021418FDF57973DE56C7193BE2EB85318F0409ADD089CB657EA78D845CB92

Function 010E9257 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb5861acdcfb1bd2387ba6583e1369be790f3c8986ef93287d82765babe669
Instruction ID: 3c198cfe7a602f061d6c6321abbd4760c138c170a9a14ef324d90385910e13ec
Opcode Fuzzy Hash: 4ccb5861acdcfb1bd2387ba6583e1369be790f3c8986ef93287d82765babe669
Instruction Fuzzy Hash: 72318D30E002469FDB06CFA9C59469EFBF2BF85304F14C65AE845BB341DB709842CB80

Function 010E9268 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4cc304034ae47ae05c56341197909256cf4d71c709746a738b18f9f30e6067
Instruction ID: c3f592b923080d336fb5d8e8265cbbe05bbbf89f4d30bfe4991f98ad891feba2
Opcode Fuzzy Hash: 9d4cc304034ae47ae05c56341197909256cf4d71c709746a738b18f9f30e6067
Instruction Fuzzy Hash: 3C218030E0020A9FDB16CFAAD59469EF7F2BF89304F50C659E855BB341DB709842CB90

Function 010E9159 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b180fe9484b1f7ac74550c9e8839d20c8107a87c4c18189b2991bfda60aee0
Instruction ID: e6c34f87a624c827fb90031f6f26aed6f361a4ffbb222bb7714b3a7156944d91
Opcode Fuzzy Hash: 53b180fe9484b1f7ac74550c9e8839d20c8107a87c4c18189b2991bfda60aee0
Instruction Fuzzy Hash: 17219031E006499FCB19CFA9D4586EEFBF2AF89314F10855EE852BB341DB709942CB50

Function 0109D124 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571194778.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_109d000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d273abcb91e35ebf2ea12f35ba83954a2d0e2eb8de3218cabaf01bb25d79d329
Instruction ID: f6d567362a95f89b0386af9e32c0c794c68b60aae51109f58709147571004a7d
Opcode Fuzzy Hash: d273abcb91e35ebf2ea12f35ba83954a2d0e2eb8de3218cabaf01bb25d79d329
Instruction Fuzzy Hash: B52167B6240200FFDF05CF58C9D0B29BBA1FB84314F20C5ADE9890B292C33AD446CB61

Function 010E1868 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e0df3d8c60051d6ce57b742dfd919741a6d67197d90e2342976fa6ec67370d
Instruction ID: 34ed2e95a1972b689a972de7128c8b73a09478b563a54325d8f09ee479a3fd94
Opcode Fuzzy Hash: f5e0df3d8c60051d6ce57b742dfd919741a6d67197d90e2342976fa6ec67370d
Instruction Fuzzy Hash: BA218E30B00249CFDB69EB79C6597AE7BF2AB49304F5004ADD046EB2A0DB758D41CBA1

Function 010E4F7A Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4025d8188e3c2e2a0a462e1b0cf580f7e7988854d72494355c9e07bb553d35d8
Instruction ID: ec0564c7ec2d6683b2788af2588a0af618198188d8b3a0f183b779ff17c5649b
Opcode Fuzzy Hash: 4025d8188e3c2e2a0a462e1b0cf580f7e7988854d72494355c9e07bb553d35d8
Instruction Fuzzy Hash: 35214834B00204CFCB64EB79D568AAD7BF2AF89704F1044A9F546EB3A5EB769D01CB50

Function 010E9168 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8e3f191d0b1b6b80969743f9b52d4a86d2e306f30bca9bfa75b854a9817b78
Instruction ID: 29ac160a7872a4b7b29d94ff4dcbabc2b8ce1d87c3db0acf0ec4ce458ebeb4df
Opcode Fuzzy Hash: 3e8e3f191d0b1b6b80969743f9b52d4a86d2e306f30bca9bfa75b854a9817b78
Instruction Fuzzy Hash: EC215E30E4061A9FDB19CFAAC858A9EF7F6AF89304F10855AE815BB341DB70A941CB50

Function 010E1370 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2500c38ba8c9e289596b9c8ea3def262f86d8883e905706f621d62d809b27120
Instruction ID: efd9ebf51eedbcaa57edb81136acd9584478fefe32a78e1fed1238f0c9f95f1f
Opcode Fuzzy Hash: 2500c38ba8c9e289596b9c8ea3def262f86d8883e905706f621d62d809b27120
Instruction Fuzzy Hash: B821A5B06022109FDB7B573DE55C3683BE1E746318F1405BAE196C7396DE79CC828742

Function 010E1878 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8eaf28d1f92eb33dacbd2219602edb33c43daaac942f7f5a59cd0f029daf75
Instruction ID: b94ddb1ad1a5d956b5d03e66b6eb3f0ee634b427e29b88abec028533f8846dc4
Opcode Fuzzy Hash: 7d8eaf28d1f92eb33dacbd2219602edb33c43daaac942f7f5a59cd0f029daf75
Instruction Fuzzy Hash: ED216D30B00209CFDB68EB79D5687AE7BF2AB89205F5004A9D146EB390DF75DD41CBA1

Function 010EFE18 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 590d3fb446a690ef6f5a48a7b1000adccefe449a9b8b6c9a47bf8938c2423f44
Instruction ID: 39cce77a132294f25152f5a4fcdc8da4b9f103ad711deaadbdf36a1ead9b61b9
Opcode Fuzzy Hash: 590d3fb446a690ef6f5a48a7b1000adccefe449a9b8b6c9a47bf8938c2423f44
Instruction Fuzzy Hash: FA1178317083950FDB0A6FB898205AE3FB7AFC6550704046AE145DB392DF384C02C7A6

Function 010E16A0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8539749c76c47cfc6aa911acd4f603a7a892a2dc7916bda6d4988fde4521afc6
Instruction ID: 1d8886a96cd9308ccc40c4266d12564daeba4ece2970808952e3b7e01e3a2d44
Opcode Fuzzy Hash: 8539749c76c47cfc6aa911acd4f603a7a892a2dc7916bda6d4988fde4521afc6
Instruction Fuzzy Hash: EE21C6386021018FEF66E72DE958B1D37E6FB8431CF105579D04AC765BEA78D8408B92

Function 010E6B91 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac466eb96a6326571c58af0156c443412e1fe33719f122bea0c31e995300244c
Instruction ID: d7617b8283e9cd2e7f07f1617cd094a873dad3bd20e998e972f51a40cf7f0a9e
Opcode Fuzzy Hash: ac466eb96a6326571c58af0156c443412e1fe33719f122bea0c31e995300244c
Instruction Fuzzy Hash: EA2101717052449FC719EB38E0647AE3BF2EFD5610F0044AED045CB68AEE758C86CB81

Function 010E4F88 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9437ce9243177b889592647c108c222141d092b2da9a39af96b7e13c2920a727
Instruction ID: 7ef8146e18b8cc9255d76e836465285d6544e6da922fb538a5ed16f2b7df18dd
Opcode Fuzzy Hash: 9437ce9243177b889592647c108c222141d092b2da9a39af96b7e13c2920a727
Instruction Fuzzy Hash: 68213634700208CFCB64EB79C55CA9D7BF2AB89604F1044A9F546EB3A4EB769D01CB50

Function 010E0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98897446146da151287fa5282c5d4988d2400e3c08ca17fad0fe189d6d8f538
Instruction ID: feb34c226073e5891dbcef1fce2957a612b04bca02f2d22861b25de71c80a960
Opcode Fuzzy Hash: b98897446146da151287fa5282c5d4988d2400e3c08ca17fad0fe189d6d8f538
Instruction Fuzzy Hash: AF11B230B012098FEFA56A7EC61872936D1FB85218F2045B9F1C6CF24EDAB5CC818BD1

Function 010E0838 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b602702c9394f3ae536e4c51df2fe0a34882db40ff274eeaf61469a2da2e377c
Instruction ID: 77099eea37eed2114bc8650e50e1f420610ec85c3d9dbe428dd5ad7e56ae9705
Opcode Fuzzy Hash: b602702c9394f3ae536e4c51df2fe0a34882db40ff274eeaf61469a2da2e377c
Instruction Fuzzy Hash: AB11A730B012099FEF665A7AC62836D36D5E741218F1049B9F5C6CF28FDAA5C8418BD2

Function 010E1478 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2bb08bd03349b2e666ddbba407aacc00a10bb175c33eb7394c2cbed8b6649e1
Instruction ID: b28db682c2f75d1f25003e2c49cfe8816184202d2a951c1f17ec07696e118396
Opcode Fuzzy Hash: d2bb08bd03349b2e666ddbba407aacc00a10bb175c33eb7394c2cbed8b6649e1
Instruction Fuzzy Hash: 00118272B002158FCF61AFBD84981AE7BE5AF58210B1404BAD885EB341EB35C942CB91

Function 010E17B2 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060b04c2f348122d4d9258913617f48a2b382c11d86f67b81197b0e34109777c
Instruction ID: 459327b37060c5d88a90e916a1598211cfa149e459d18f3b550dbc01d39f44b6
Opcode Fuzzy Hash: 060b04c2f348122d4d9258913617f48a2b382c11d86f67b81197b0e34109777c
Instruction Fuzzy Hash: 58112675F022918FCB15EFB9990865E7FFAFB88264F1404B9E956D7704FA308951C780

Function 010E1488 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed70fd9d4569bfe654499d52b4220b35f6af6bb940d5136e5c76c45b8225dd6
Instruction ID: bb005a40739fc3338d1e23f8020d412d2c90dc6337cbc6c05b661e8cf09b53d1
Opcode Fuzzy Hash: 9ed70fd9d4569bfe654499d52b4220b35f6af6bb940d5136e5c76c45b8225dd6
Instruction Fuzzy Hash: 0D018072F002158FCB61EFBE84481AE7BF5EF49220B6404BAD845E7341EA35D842CB91

Function 0109D11F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571194778.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_109d000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: d3074077923f99b740239406deff6a63a9c6e2a036da23fd3a196cad02c0f70a
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 0A11DDB6544280DFDB06CF58C9D0B15BFB2FB84314F24C6A9D8894B692C33AD44ACF61

Function 010E9890 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784393c350b3fc81ddc79e4ddbfd45f6d979687651e70e2c02493b96a312d113
Instruction ID: e98f660ffaddd5a5c07a2ea81e3e17d31e50896ac6cccf7c1683dd8c80b7c761
Opcode Fuzzy Hash: 784393c350b3fc81ddc79e4ddbfd45f6d979687651e70e2c02493b96a312d113
Instruction Fuzzy Hash: 2E112631A002018FDB04EF99D988399BFB1FF80311F54C168C9886F29ADBB4D905C7A0

Function 010E7080 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b5357fb4451ded0369460c81eb56e62cc676f9e3728e69c3ef80e1c6fbd6ea2
Instruction ID: e9a8b615c88be38eb26ac7bf6a0444af3df65dc706f2af85334319abc41edfe4
Opcode Fuzzy Hash: 9b5357fb4451ded0369460c81eb56e62cc676f9e3728e69c3ef80e1c6fbd6ea2
Instruction Fuzzy Hash: 8E012838702204CFC728DB74D558B6C3BB2EF89215F5400A8E506DB3A8DB35AD82CB40

Function 010E80F8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb23a6c60ed9bc732db9051c1debd9e83bcd02471e174f153f50b945892aefb8
Instruction ID: 7063de18113b2e91a89047c1a217f5242cb6dade473f77d86e94d3166a75cf5e
Opcode Fuzzy Hash: eb23a6c60ed9bc732db9051c1debd9e83bcd02471e174f153f50b945892aefb8
Instruction Fuzzy Hash: B1018474501187DBDB06EB64F96069C7BA1EB81208B44139CC1546F296EE751E128B81

Function 010E1514 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96995dc2493d4cfdda01ea5758e0c7afc71e30344f012a8dbdb87c4c9a96eda8
Instruction ID: 6459eb9daa8cf6f0e0676c07ce0b651b99ffef2af74fe92c636b7721423d60a3
Opcode Fuzzy Hash: 96995dc2493d4cfdda01ea5758e0c7afc71e30344f012a8dbdb87c4c9a96eda8
Instruction Fuzzy Hash: F4F08473B04210CFDB228BEA98980ECBFF1EEA822170900D7D882DB341C734D802CB51

Function 010ECB38 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36efd041878435d79134b8f579f29d65da9c1e82f10e9d89253093208c5ec293
Instruction ID: 56a7012aebf25d229a87434b7723a3f55e5549310a5d2ec71257e745f31550d2
Opcode Fuzzy Hash: 36efd041878435d79134b8f579f29d65da9c1e82f10e9d89253093208c5ec293
Instruction Fuzzy Hash: AFF09071E001284AEB54DEAE88005DFFBE9FBC8620F208577D544E3201D231990187D0

Function 010E8108 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4571541369.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_10e0000_GvgUQlbRIXOe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4748dea47fedd3eee872eb3abca31e4e9887f72693b844b9bb5cf9b7f3cba5
Instruction ID: e6ba04d2884f61f733f55f5344416c26ae549a73966459b22ead67af19d01c57
Opcode Fuzzy Hash: 4c4748dea47fedd3eee872eb3abca31e4e9887f72693b844b9bb5cf9b7f3cba5
Instruction Fuzzy Hash: 86F0A43490114AEFDB05FBA4FA6099C7BB1FB80308F4052ACC108AB255EF746E158B81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PROFORMA FATURA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GvgUQlbRIXOe.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PROFORMA FATURA.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3e0sehfq.oqt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_afmzpfvl.yoc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bc1nzdf0.2dh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzk50qgb.gmp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nl20zavh.ruo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rafy1dfb.xgx.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sozpsjhb.ot2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v1drupbt.qiz.ps1

C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp

C:\Users\user\AppData\Local\Temp\tmpBA20.tmp

Windows Analysis Report
PROFORMA FATURA.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre