Edit tour

Windows Analysis Report
Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Overview

General Information

Sample name:	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Analysis ID:	1559007
MD5:	7766ffc22475dbdb07730fdd97e9c0c5
SHA1:	f744e3b286f1daf7c8cf3df7cf3171d2e7c4675c
SHA256:	f69515024de365946c3a58ce3315898196dcca5a2d5a9ba3f5b257818df4055a
Tags:	exeuser-threatcat_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Musterino_94372478_Ekno_101_20241031410530_ekstre.exe (PID: 6904 cmdline: "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe" MD5: 7766FFC22475DBDB07730FDD97E9C0C5)

powershell.exe (PID: 5020 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5164 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\imOLmwQ.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7428 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7084 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp7551.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Musterino_94372478_Ekno_101_20241031410530_ekstre.exe (PID: 7216 cmdline: "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe" MD5: 7766FFC22475DBDB07730FDD97E9C0C5)

imOLmwQ.exe (PID: 7400 cmdline: C:\Users\user\AppData\Roaming\imOLmwQ.exe MD5: 7766FFC22475DBDB07730FDD97E9C0C5)

schtasks.exe (PID: 7556 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8BD7.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

imOLmwQ.exe (PID: 7624 cmdline: "C:\Users\user\AppData\Roaming\imOLmwQ.exe" MD5: 7766FFC22475DBDB07730FDD97E9C0C5)

imOLmwQ.exe (PID: 7636 cmdline: "C:\Users\user\AppData\Roaming\imOLmwQ.exe" MD5: 7766FFC22475DBDB07730FDD97E9C0C5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "zqamcx.com", "Username": "sender@zqamcx.com", "Password": "Methodman991"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.3112118306.000000000341F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3113375057.000000000375E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.3107870895.000000000040B000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.3107870895.000000000040B000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.3112118306.0000000003449000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3113375057.0000000003788000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.3112118306.00000000033D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.3112118306.00000000033D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3113375057.0000000003719000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.3113375057.0000000003719000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1923270481.0000000004329000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1923270481.0000000004329000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe PID: 6904	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe PID: 6904	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe PID: 6904	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe PID: 7216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe PID: 7216	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: imOLmwQ.exe PID: 7400	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: imOLmwQ.exe PID: 7636	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: imOLmwQ.exe PID: 7636	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35395:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33205:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33277:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33301:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33393:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x333fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3346f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33505:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33595:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33205:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33277:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33301:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33393:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x333fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3346f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33505:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33595:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x71625:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x71697:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71721:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x717b3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x7181d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x7188f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71925:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35395:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x719b5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x71825:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xade45:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x71897:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xadeb7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71921:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xadf41:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x719b3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xadfd3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71a1d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xae03d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x71a8f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xae0af:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71b25:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xae145:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe", ParentImage: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, ParentProcessId: 6904, ParentProcessName: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe", ProcessId: 5020, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8BD7.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8BD7.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\imOLmwQ.exe, ParentImage: C:\Users\user\AppData\Roaming\imOLmwQ.exe, ParentProcessId: 7400, ParentProcessName: imOLmwQ.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8BD7.tmp", ProcessId: 7556, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 78.110.166.82, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, Initiated: true, ProcessId: 7216, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp7551.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp7551.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe", ParentImage: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, ParentProcessId: 6904, ParentProcessName: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp7551.tmp", ProcessId: 7084, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe", ParentImage: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, ParentProcessId: 6904, ParentProcessName: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe", ProcessId: 5020, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp7551.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp7551.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe", ParentImage: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, ParentProcessId: 6904, ParentProcessName: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp7551.tmp", ProcessId: 7084, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "zqamcx.com", "Username": "sender@zqamcx.com", "Password": "Methodman991"}

Multi AV Scanner detection for domain / URL

Source: zqamcx.com

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for submitted file

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Virustotal: Detection: 34%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Joe Sandbox ML: detected

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 78.110.166.82:587

Source: Joe Sandbox View

IP Address: 78.110.166.82 78.110.166.82

Source: Joe Sandbox View

ASN Name: UKSERVERS-ASUKDedicatedServersHostingandCo-Location UKSERVERS-ASUKDedicatedServersHostingandCo-Location

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 78.110.166.82:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: zqamcx.com

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, imOLmwQ.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, imOLmwQ.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, imOLmwQ.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109837896.0000000001595000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109308908.0000000001569000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123376456.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123303542.0000000006A50000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.0000000003427000.00000004.00000800.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003835000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3122984966.0000000006BE2000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3109072613.00000000016D4000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003766000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0#
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109837896.0000000001595000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109308908.0000000001569000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123376456.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123303542.0000000006A50000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.0000000003427000.00000004.00000800.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003835000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3122984966.0000000006BE2000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3109072613.00000000016D4000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003766000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1922034960.000000000337B000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 00000009.00000002.1972777595.00000000029DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1928866653.0000000006470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.htmlr
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929001727.00000000064B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comrm$
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109837896.0000000001595000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123376456.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123303542.0000000006A50000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.0000000003427000.00000004.00000800.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003835000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3122984966.0000000006BE2000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3109072613.00000000016D4000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003766000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109837896.0000000001595000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123376456.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123303542.0000000006A50000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.0000000003427000.00000004.00000800.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003835000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3122984966.0000000006BE2000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3109072613.00000000016D4000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003766000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.0000000003427000.00000004.00000800.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003835000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003766000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zqamcx.com
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1923270481.0000000004329000.00000004.00000800.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3107870895.000000000040B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, imOLmwQ.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, O9KGcRw9bkp.cs	.Net Code: KAZ
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.raw.unpack, O9KGcRw9bkp.cs	.Net Code: KAZ

Installs a global keyboard hook

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\imOLmwQ.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_01729B40	8_2_01729B40
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_01724A88	8_2_01724A88
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_0172CDC0	8_2_0172CDC0
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_01723E70	8_2_01723E70
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_017241B8	8_2_017241B8
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_05F9C9A0	8_2_05F9C9A0
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_05F91480	8_2_05F91480
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_05F910B8	8_2_05F910B8
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_05F9F370	8_2_05F9F370
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_06862F08	8_2_06862F08
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_06865760	8_2_06865760
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_0686DD3D	8_2_0686DD3D
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_06860040	8_2_06860040
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_06863637	8_2_06863637
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_0686BD90	8_2_0686BD90
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_06865068	8_2_06865068
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Code function: 8_2_068649E8	8_2_068649E8
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 9_2_00F8D51C	9_2_00F8D51C
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_01899B40	14_2_01899B40
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_01894A88	14_2_01894A88
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_0189CDC0	14_2_0189CDC0
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_01893E70	14_2_01893E70
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_018941B8	14_2_018941B8
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_068B2F08	14_2_068B2F08
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_068B5760	14_2_068B5760
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_068B8C0A	14_2_068B8C0A
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_068BDD3D	14_2_068BDD3D
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_068B0040	14_2_068B0040
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_068B3637	14_2_068B3637
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_068BBD90	14_2_068BBD90
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_068B5068	14_2_068B5068
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Code function: 14_2_068B49E8	14_2_068B49E8

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Static PE information: invalid certificate

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1928403025.0000000005D30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1923270481.00000000045A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1920367753.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1932523679.0000000007F70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1923270481.0000000004329000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb9cb78e8-c1d3-4ab9-8530-a3a5b5ca79e5.exe4 vs Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1933957722.000000000B000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000000.1855009729.0000000000F6A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVnFP.exe6 vs Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1922034960.0000000003424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb9cb78e8-c1d3-4ab9-8530-a3a5b5ca79e5.exe4 vs Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3108403843.00000000011B9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Binary or memory string: OriginalFilenameVnFP.exe6 vs Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: imOLmwQ.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, EgTglEucnUn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, EgTglEucnUn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, MmVR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, MmVR.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, ArCH2EoQvAw1fqWKFp.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, ArCH2EoQvAw1fqWKFp.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, ArCH2EoQvAw1fqWKFp.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, OFidUOEaL5BQRP6ZWv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, OFidUOEaL5BQRP6ZWv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, ArCH2EoQvAw1fqWKFp.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, ArCH2EoQvAw1fqWKFp.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, ArCH2EoQvAw1fqWKFp.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/15@1/1

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

File created: C:\Users\user\AppData\Roaming\imOLmwQ.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3620:120:WilError_03
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Mutant created: \Sessions\1\BaseNamedObjects\QkwBvKrlcDLYhwlIDXqdJly

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

File created: C:\Users\user\AppData\Local\Temp\tmp7551.tmp

Jump to behavior

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Virustotal: Detection: 34%

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

File read: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe"
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\imOLmwQ.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp7551.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\imOLmwQ.exe C:\Users\user\AppData\Roaming\imOLmwQ.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8BD7.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process created: C:\Users\user\AppData\Roaming\imOLmwQ.exe "C:\Users\user\AppData\Roaming\imOLmwQ.exe"
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process created: C:\Users\user\AppData\Roaming\imOLmwQ.exe "C:\Users\user\AppData\Roaming\imOLmwQ.exe"
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\imOLmwQ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp7551.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8BD7.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process created: C:\Users\user\AppData\Roaming\imOLmwQ.exe "C:\Users\user\AppData\Roaming\imOLmwQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process created: C:\Users\user\AppData\Roaming\imOLmwQ.exe "C:\Users\user\AppData\Roaming\imOLmwQ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, ArCH2EoQvAw1fqWKFp.cs	.Net Code: cinwiePwgV System.Reflection.Assembly.Load(byte[])
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, ArCH2EoQvAw1fqWKFp.cs	.Net Code: cinwiePwgV System.Reflection.Assembly.Load(byte[])

Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Static PE information: section name: .text entropy: 7.940612345814647
Source: imOLmwQ.exe.0.dr	Static PE information: section name: .text entropy: 7.940612345814647

Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, UYw6rXMZTokZeFQJ55.cs	High entropy of concatenated method names: 'j4uiuXHDiGP8p2NqbRn', 'NNZ9rwHIPpQ1gcEHZxB', 'KMY59cH827xI5sMU0fl', 'xdo0pWUbvE', 'Ws10FtIJib', 'cSr0TUYIaU', 'MHdtS2HSw162uDRUxVt', 'r80y6ZHcWc4TOj9NusJ'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, yDpdN5XPVhFPBrl8kfO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gOYTBxCHR2', 'NrMTyoDYiV', 'BVhT6OIiv2', 'bBXT4r02Vk', 'LfNTxJCwlb', 'hYqTkEQmnd', 'Lp7Tgm6T5N'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, UGJkmc6RmahHpPMaPi.cs	High entropy of concatenated method names: 't0ZvExl7XX', 'HdmvcP3EyU', 'RobvbWhfbe', 'REuvMdGu19', 'fX3v9y1NtK', 'fqBv8B5O86', 'MeevOVgoTf', 'cWgvhAMBs9', 'JcDvd5SKYn', 'kMNvBf71jP'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, wseRcTLnhJ8VtoI1hI.cs	High entropy of concatenated method names: 'QZJTSaZV9I', 'qunTWVt2wu', 'EJvT0rH6NL', 'JDJTj7cH9c', 'ux4TFTfyuk', 'uxMTorftdg', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, UCBSKilNVMnhypwelq.cs	High entropy of concatenated method names: 'FSPKnnxKaE', 'y9oKLL8R2L', 'i5QpP9d7vl', 'cN4pXr7glq', 'xBmKBWwEcL', 'fVaKyqhlmP', 'ixMK6cw5WE', 'PLoK434chp', 'ITEKxxGhPN', 'U7cKkHiLfx'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, Ql25VeIvvRyJsriAYa.cs	High entropy of concatenated method names: 'RwaFuqMy8I', 'dRxFKxcTB2', 'c5vFFnPsgO', 'h4HFGYLoYM', 'fUyFrEhUYW', 'gFSFtm266c', 'Dispose', 'JW7p3pvHYu', 'ppkpQ8CjxU', 'YpTpSSxlOf'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, dnARV9CgbytmkGKx9D.cs	High entropy of concatenated method names: 'hfwiIDE7N', 'T8h59hCDl', 'QbfDVJyaF', 'iWQmc1RMX', 'I8mc0cET8', 'cDdJCDUdw', 'PVaIwCpVy68Ka0b4dQ', 'HFbBvrEmksRe4gWbCf', 'o7f9ybPlCZpf40E9Wd', 'sw3pw1VXq'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, OFidUOEaL5BQRP6ZWv.cs	High entropy of concatenated method names: 'WCkQ4rxxaG', 'VPyQxkYrww', 'M4eQky8Byu', 'UH5Qg7N4HK', 'F7bQULW0Ko', 'O0vQlLf3FJ', 'RlTQIYDYxk', 'JG8QnhUeZm', 'hakQYyY6el', 'idEQLeQDkE'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, ArCH2EoQvAw1fqWKFp.cs	High entropy of concatenated method names: 'Aym7ssHk9c', 'Kym73R7TMf', 'KTn7QhPKtM', 'YZk7SaSo2F', 'dPH7WPmsU8', 'Gck707JAGr', 'jkV7jHmaUp', 'sl67oW2pBc', 'EA67Hy43AU', 'Clx7fweRJ5'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, r2YsjOQrC0liKvWJGi.cs	High entropy of concatenated method names: 'Dispose', 'HyJXYsriAY', 'PvaCMOs7vy', 'fvdRCcSqTs', 'y6QXLCFkc5', 'mCXXz67yJZ', 'ProcessDialogKey', 'S0uCPMHUux', 'fvyCXvDKPQ', 'ANxCCtseRc'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, E67jYcwHIZap81govC.cs	High entropy of concatenated method names: 'sZBXjFidUO', 'yL5XoBQRP6', 'NoQXfL97R4', 'H2TXZhK83T', 'MkiXuK0doe', 'UINXqAAwen', 'FfoR5lyAn8k9nW03mt', 'fghl2kjZMvmV1YuO46', 'VFyXXHZmPk', 'yUcX7OS9Sm'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, NoeUINbAAwenMQCKRx.cs	High entropy of concatenated method names: 'B9S0sciWIC', 'JkZ0Q4beyC', 'sw60WgJQUO', 'uGZ0j8IVXO', 'Q2r0op3IEh', 'zd4WUabWbU', 'SKtWlOntTl', 'naWWI6SBbw', 'C36WnHN1Xs', 'tLDWYRxrYj'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, MjFsd2coQL97R4M2Th.cs	High entropy of concatenated method names: 'wrgS5rxNSu', 'YBQSDJ66xW', 'TyLSECpSED', 'zy8Sc5lVir', 'Q9aSu5Dpnl', 'ebgSqQeArl', 'zm4SKycPAM', 'P0mSpMunhh', 'AwvSFHHnqn', 'LlJSTYEudx'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, q83TndJpCOFOuhkiK0.cs	High entropy of concatenated method names: 'mB2WA7kR8h', 'FFVWm1MD4B', 'NjaSRyMcvf', 'xPVS9KoGgH', 's2LS8Fux7E', 'gQbS1D1132', 'xwVSOuuZhR', 'x9nShDHVsv', 'BcoS23gBGo', 'pNvSdlZTjU'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, lyZjxZkjyOqh0CQWSg.cs	High entropy of concatenated method names: 'ToString', 'VeuqBOycuo', 'dTkqMkWgRI', 'rdFqRBmgBm', 'SxXq9jCTAK', 'FQ1q8p6ffY', 'n55q1GWYmB', 'pBDqOXQjqY', 'RAJqh15e68', 'TY0q2N1LXr'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, hf0ub2gWx3GrcWBuD0.cs	High entropy of concatenated method names: 'HtDKfunrgG', 'y9nKZ4edXg', 'ToString', 'uW1K3W2JOo', 'CYiKQiwAkr', 'uJfKSH99L4', 'q28KWuZANq', 'sXFK0YlRBW', 'I9kKjwoVbg', 'EWGKoGxQ78'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, y6StOj2VsAvgem3rYD.cs	High entropy of concatenated method names: 'wB0jNrQh0Q', 'zDhjaJKXyO', 'nWVjiIIP87', 'M1Xj5fHP2y', 'YebjAgUoCs', 'Ia8jDHQGhZ', 'tbhjmu0iQD', 'acUjEW8Kj2', 'nxNjc1AIko', 'mwCjJDqWqS'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, B32sUa4nRblmtfrWuT.cs	High entropy of concatenated method names: 'JCludfUcbJ', 'pEwuyjVIG5', 'UBqu49SN2M', 'j31uxZrKl2', 'teZuMPMs0w', 'Hg1uRYxx5W', 'bJBu9peGFU', 'tIpu8VqPBu', 'wy9u1E5OjD', 'Ei0uOPTNNI'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, oMHUuxY3vyvDKPQANx.cs	High entropy of concatenated method names: 'S1kFbZ7DrJ', 'a98FMfHc8K', 'MYhFRjoYpV', 'qwCF9M7ufF', 'tpEF8IHXh7', 'ydrF1LMogQ', 'RupFO7l7im', 'ST0FhU5aqb', 'eK1F2i6bp9', 'QN5FdOYKeP'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, wb3E6FzRZB9psCl1eV.cs	High entropy of concatenated method names: 'MavTD0alWC', 'X0gTEl74N0', 'auyTcHg8iQ', 'JOdTbMD9G4', 'vL5TMsXVgx', 'HvqT9KqqOJ', 'h91T8toG0X', 'EO8TtH2kcd', 'pYDTNCGudH', 'I5PTadyj7P'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.45c2120.1.raw.unpack, WFGXOCXXLtm89svQOhr.cs	High entropy of concatenated method names: 'USmTLWF30K', 'QdkTzseTsV', 'El4GPR3xBx', 'CatGX0olx5', 'pjqGCxPKJB', 'MkgG7AWaak', 'Ht3GwI2A9O', 'ileGsxcaMF', 'FbNG3rGfn7', 'HGAGQ9sOnm'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, UYw6rXMZTokZeFQJ55.cs	High entropy of concatenated method names: 'j4uiuXHDiGP8p2NqbRn', 'NNZ9rwHIPpQ1gcEHZxB', 'KMY59cH827xI5sMU0fl', 'xdo0pWUbvE', 'Ws10FtIJib', 'cSr0TUYIaU', 'MHdtS2HSw162uDRUxVt', 'r80y6ZHcWc4TOj9NusJ'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, yDpdN5XPVhFPBrl8kfO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gOYTBxCHR2', 'NrMTyoDYiV', 'BVhT6OIiv2', 'bBXT4r02Vk', 'LfNTxJCwlb', 'hYqTkEQmnd', 'Lp7Tgm6T5N'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, UGJkmc6RmahHpPMaPi.cs	High entropy of concatenated method names: 't0ZvExl7XX', 'HdmvcP3EyU', 'RobvbWhfbe', 'REuvMdGu19', 'fX3v9y1NtK', 'fqBv8B5O86', 'MeevOVgoTf', 'cWgvhAMBs9', 'JcDvd5SKYn', 'kMNvBf71jP'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, wseRcTLnhJ8VtoI1hI.cs	High entropy of concatenated method names: 'QZJTSaZV9I', 'qunTWVt2wu', 'EJvT0rH6NL', 'JDJTj7cH9c', 'ux4TFTfyuk', 'uxMTorftdg', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, UCBSKilNVMnhypwelq.cs	High entropy of concatenated method names: 'FSPKnnxKaE', 'y9oKLL8R2L', 'i5QpP9d7vl', 'cN4pXr7glq', 'xBmKBWwEcL', 'fVaKyqhlmP', 'ixMK6cw5WE', 'PLoK434chp', 'ITEKxxGhPN', 'U7cKkHiLfx'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, Ql25VeIvvRyJsriAYa.cs	High entropy of concatenated method names: 'RwaFuqMy8I', 'dRxFKxcTB2', 'c5vFFnPsgO', 'h4HFGYLoYM', 'fUyFrEhUYW', 'gFSFtm266c', 'Dispose', 'JW7p3pvHYu', 'ppkpQ8CjxU', 'YpTpSSxlOf'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, dnARV9CgbytmkGKx9D.cs	High entropy of concatenated method names: 'hfwiIDE7N', 'T8h59hCDl', 'QbfDVJyaF', 'iWQmc1RMX', 'I8mc0cET8', 'cDdJCDUdw', 'PVaIwCpVy68Ka0b4dQ', 'HFbBvrEmksRe4gWbCf', 'o7f9ybPlCZpf40E9Wd', 'sw3pw1VXq'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, OFidUOEaL5BQRP6ZWv.cs	High entropy of concatenated method names: 'WCkQ4rxxaG', 'VPyQxkYrww', 'M4eQky8Byu', 'UH5Qg7N4HK', 'F7bQULW0Ko', 'O0vQlLf3FJ', 'RlTQIYDYxk', 'JG8QnhUeZm', 'hakQYyY6el', 'idEQLeQDkE'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, ArCH2EoQvAw1fqWKFp.cs	High entropy of concatenated method names: 'Aym7ssHk9c', 'Kym73R7TMf', 'KTn7QhPKtM', 'YZk7SaSo2F', 'dPH7WPmsU8', 'Gck707JAGr', 'jkV7jHmaUp', 'sl67oW2pBc', 'EA67Hy43AU', 'Clx7fweRJ5'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, r2YsjOQrC0liKvWJGi.cs	High entropy of concatenated method names: 'Dispose', 'HyJXYsriAY', 'PvaCMOs7vy', 'fvdRCcSqTs', 'y6QXLCFkc5', 'mCXXz67yJZ', 'ProcessDialogKey', 'S0uCPMHUux', 'fvyCXvDKPQ', 'ANxCCtseRc'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, E67jYcwHIZap81govC.cs	High entropy of concatenated method names: 'sZBXjFidUO', 'yL5XoBQRP6', 'NoQXfL97R4', 'H2TXZhK83T', 'MkiXuK0doe', 'UINXqAAwen', 'FfoR5lyAn8k9nW03mt', 'fghl2kjZMvmV1YuO46', 'VFyXXHZmPk', 'yUcX7OS9Sm'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, NoeUINbAAwenMQCKRx.cs	High entropy of concatenated method names: 'B9S0sciWIC', 'JkZ0Q4beyC', 'sw60WgJQUO', 'uGZ0j8IVXO', 'Q2r0op3IEh', 'zd4WUabWbU', 'SKtWlOntTl', 'naWWI6SBbw', 'C36WnHN1Xs', 'tLDWYRxrYj'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, MjFsd2coQL97R4M2Th.cs	High entropy of concatenated method names: 'wrgS5rxNSu', 'YBQSDJ66xW', 'TyLSECpSED', 'zy8Sc5lVir', 'Q9aSu5Dpnl', 'ebgSqQeArl', 'zm4SKycPAM', 'P0mSpMunhh', 'AwvSFHHnqn', 'LlJSTYEudx'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, q83TndJpCOFOuhkiK0.cs	High entropy of concatenated method names: 'mB2WA7kR8h', 'FFVWm1MD4B', 'NjaSRyMcvf', 'xPVS9KoGgH', 's2LS8Fux7E', 'gQbS1D1132', 'xwVSOuuZhR', 'x9nShDHVsv', 'BcoS23gBGo', 'pNvSdlZTjU'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, lyZjxZkjyOqh0CQWSg.cs	High entropy of concatenated method names: 'ToString', 'VeuqBOycuo', 'dTkqMkWgRI', 'rdFqRBmgBm', 'SxXq9jCTAK', 'FQ1q8p6ffY', 'n55q1GWYmB', 'pBDqOXQjqY', 'RAJqh15e68', 'TY0q2N1LXr'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, hf0ub2gWx3GrcWBuD0.cs	High entropy of concatenated method names: 'HtDKfunrgG', 'y9nKZ4edXg', 'ToString', 'uW1K3W2JOo', 'CYiKQiwAkr', 'uJfKSH99L4', 'q28KWuZANq', 'sXFK0YlRBW', 'I9kKjwoVbg', 'EWGKoGxQ78'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, y6StOj2VsAvgem3rYD.cs	High entropy of concatenated method names: 'wB0jNrQh0Q', 'zDhjaJKXyO', 'nWVjiIIP87', 'M1Xj5fHP2y', 'YebjAgUoCs', 'Ia8jDHQGhZ', 'tbhjmu0iQD', 'acUjEW8Kj2', 'nxNjc1AIko', 'mwCjJDqWqS'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, B32sUa4nRblmtfrWuT.cs	High entropy of concatenated method names: 'JCludfUcbJ', 'pEwuyjVIG5', 'UBqu49SN2M', 'j31uxZrKl2', 'teZuMPMs0w', 'Hg1uRYxx5W', 'bJBu9peGFU', 'tIpu8VqPBu', 'wy9u1E5OjD', 'Ei0uOPTNNI'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, oMHUuxY3vyvDKPQANx.cs	High entropy of concatenated method names: 'S1kFbZ7DrJ', 'a98FMfHc8K', 'MYhFRjoYpV', 'qwCF9M7ufF', 'tpEF8IHXh7', 'ydrF1LMogQ', 'RupFO7l7im', 'ST0FhU5aqb', 'eK1F2i6bp9', 'QN5FdOYKeP'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, wb3E6FzRZB9psCl1eV.cs	High entropy of concatenated method names: 'MavTD0alWC', 'X0gTEl74N0', 'auyTcHg8iQ', 'JOdTbMD9G4', 'vL5TMsXVgx', 'HvqT9KqqOJ', 'h91T8toG0X', 'EO8TtH2kcd', 'pYDTNCGudH', 'I5PTadyj7P'
Source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.7f70000.4.raw.unpack, WFGXOCXXLtm89svQOhr.cs	High entropy of concatenated method names: 'USmTLWF30K', 'QdkTzseTsV', 'El4GPR3xBx', 'CatGX0olx5', 'pjqGCxPKJB', 'MkgG7AWaak', 'Ht3GwI2A9O', 'ileGsxcaMF', 'FbNG3rGfn7', 'HGAGQ9sOnm'

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

File created: C:\Users\user\AppData\Roaming\imOLmwQ.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp7551.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe PID: 6904, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: imOLmwQ.exe PID: 7400, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Memory allocated: 16A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Memory allocated: 3320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Memory allocated: 3130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Memory allocated: 8120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Memory allocated: 9120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Memory allocated: 92D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Memory allocated: A2D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Memory allocated: 1720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Memory allocated: 33D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Memory allocated: 3200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Memory allocated: F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Memory allocated: 2980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Memory allocated: 28D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Memory allocated: 7210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Memory allocated: 8210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Memory allocated: 83A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Memory allocated: 93A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Memory allocated: 1890000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Memory allocated: 3710000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Memory allocated: 1900000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 11999982

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5185	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5638	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Window / User API: threadDelayed 4372	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Window / User API: threadDelayed 5434	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Window / User API: threadDelayed 2244
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Window / User API: threadDelayed 7602

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 6976	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7228	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7192	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7224	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7388	Thread sleep count: 4372 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99745s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99388s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7388	Thread sleep count: 5434 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99039s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98930s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98811s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98702s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97483s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99543s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98838s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -98062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97602s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe TID: 7380	Thread sleep time: -97156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7464	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep count: 33 > 30
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -30437127721620741s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7736	Thread sleep count: 2244 > 30
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -199782s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99766s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7736	Thread sleep count: 7602 > 30
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99641s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99531s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99420s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99312s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99203s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99091s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98984s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98875s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98766s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98641s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98516s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98406s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98297s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98187s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98078s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97953s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97844s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97733s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97625s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97503s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97375s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99781s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99672s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99562s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99453s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99344s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99219s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98890s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98781s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98671s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98560s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98452s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98344s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98219s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -98109s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97990s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97859s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97750s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97641s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97531s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97422s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -97312s >= -30000s
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe TID: 7728	Thread sleep time: -11999982s >= -30000s

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99859	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99745	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99626	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99500	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99388	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99281	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99172	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99039	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98930	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98811	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98702	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98593	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98484	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98375	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98265	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98156	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98047	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97593	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97483	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97374	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97265	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97155	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99543	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98838	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98719	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98609	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98500	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98390	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98281	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98172	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 98062	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97953	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97844	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97719	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97602	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97484	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97375	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Thread delayed: delay time: 97156	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99891
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99766
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99641
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99531
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99420
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99312
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99203
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99091
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98984
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98875
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98766
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98641
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98516
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98406
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98297
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98187
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98078
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97953
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97844
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97733
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97625
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97503
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97375
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99781
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99672
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99562
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99453
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99344
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99219
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98890
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98781
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98671
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98560
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98452
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98344
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98219
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 98109
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97990
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97859
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97750
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97641
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97531
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97422
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 97312
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Thread delayed: delay time: 11999982

Source: imOLmwQ.exe, 00000009.00000002.1971415681.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-
Source: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109837896.0000000001595000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3109072613.00000000016D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe"
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\imOLmwQ.exe"
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\imOLmwQ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\imOLmwQ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp7551.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Process created: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8BD7.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process created: C:\Users\user\AppData\Roaming\imOLmwQ.exe "C:\Users\user\AppData\Roaming\imOLmwQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Process created: C:\Users\user\AppData\Roaming\imOLmwQ.exe "C:\Users\user\AppData\Roaming\imOLmwQ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\imOLmwQ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\imOLmwQ.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 8.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3112118306.000000000341F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3113375057.000000000375E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3107870895.000000000040B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3112118306.0000000003449000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3113375057.0000000003788000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3112118306.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3113375057.0000000003719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1923270481.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe PID: 6904, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe PID: 7216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: imOLmwQ.exe PID: 7636, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\imOLmwQ.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 8.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3107870895.000000000040B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3112118306.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3113375057.0000000003719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1923270481.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe PID: 6904, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe PID: 7216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: imOLmwQ.exe PID: 7636, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 8.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43f0e18.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.43b45f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3112118306.000000000341F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3113375057.000000000375E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3107870895.000000000040B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3112118306.0000000003449000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3113375057.0000000003788000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3112118306.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3113375057.0000000003719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1923270481.0000000004329000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe PID: 6904, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe PID: 7216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: imOLmwQ.exe PID: 7636, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	1 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	21 Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	35%	Virustotal		Browse
Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\imOLmwQ.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
zqamcx.com	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.sakkal.comrm$	0%	Avira URL Cloud	safe
http://www.ascendercorp.com/typedesigners.htmlr	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
zqamcx.com	78.110.166.82	true	true	10%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.comrm$	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929001727.00000000064B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1923270481.0000000004329000.00000004.00000800.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3107870895.000000000040B000.00000040.00000400.00020000.00000000.sdmp	false		high
http://r11.o.lencr.org0#	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109837896.0000000001595000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109308908.0000000001569000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123376456.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123303542.0000000006A50000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.0000000003427000.00000004.00000800.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003835000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3122984966.0000000006BE2000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3109072613.00000000016D4000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003766000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, imOLmwQ.exe.0.dr	false		high
http://www.carterandcone.coml	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109837896.0000000001595000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123376456.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123303542.0000000006A50000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.0000000003427000.00000004.00000800.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003835000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3122984966.0000000006BE2000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3109072613.00000000016D4000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003766000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109837896.0000000001595000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123376456.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123303542.0000000006A50000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.0000000003427000.00000004.00000800.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003835000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3122984966.0000000006BE2000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3109072613.00000000016D4000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003766000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ascendercorp.com/typedesigners.htmlr	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1928866653.0000000006470000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://zqamcx.com	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.0000000003427000.00000004.00000800.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003835000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003766000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1922034960.000000000337B000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 00000009.00000002.1972777595.00000000029DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000000.00000002.1929289318.0000000007662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r11.i.lencr.org/0#	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109837896.0000000001595000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3109308908.0000000001569000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123376456.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3123303542.0000000006A50000.00000004.00000020.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.0000000003427000.00000004.00000800.00020000.00000000.sdmp, Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, 00000008.00000002.3112118306.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003835000.00000004.00000800.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3122984966.0000000006BE2000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3109072613.00000000016D4000.00000004.00000020.00020000.00000000.sdmp, imOLmwQ.exe, 0000000E.00000002.3113375057.0000000003766000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.110.166.82	zqamcx.com	United Kingdom		42831	UKSERVERS-ASUKDedicatedServersHostingandCo-Location	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559007
Start date and time:	2024-11-20 03:19:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/15@1/1
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 137 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Musterino_94372478_Ekno_101_20241031410530_ekstre.exe, PID 6904 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:20:25	Task Scheduler	Run new task: imOLmwQ path: C:\Users\user\AppData\Roaming\imOLmwQ.exe
21:20:19	API Interceptor	1814213x Sleep call for process: Musterino_94372478_Ekno_101_20241031410530_ekstre.exe modified
21:20:22	API Interceptor	48x Sleep call for process: powershell.exe modified
21:20:26	API Interceptor	1246380x Sleep call for process: imOLmwQ.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
78.110.166.82	COB756883.vbs	Get hash	malicious	CobaltStrike	Browse	windowsupdatesolutions.com/ServerCOB.txt
	Ingreso_SII_Abril_2021.cmd	Get hash	malicious	Unknown	Browse	www.emolcl.com/namaste/puma.php
	Ingreso_SII_Abril_2021.cmd	Get hash	malicious	Unknown	Browse	www.emolcl.com/namaste/puma.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
zqamcx.com	Halkbank_Ekstre_20241118_081142_787116.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	PO NO170300999.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	41570002689_20220814_05352297_HesapOzeti.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	29.10.2024-29.10.2024.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UKSERVERS-ASUKDedicatedServersHostingandCo-Location	Halkbank_Ekstre_20241118_081142_787116.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	(#U0130TOSAM) 11 KASIM 2024 HAFTALIK EKONOM#U0130 B#U00dcLTEN#U0130.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	PO NO170300999.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	sora.mips.elf	Get hash	malicious	Mirai	Browse	78.157.201.124
	RKsVnThLLP.exe	Get hash	malicious	Njrat	Browse	94.46.207.10
	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	New Order (2).exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	41570002689_20220814_05352297_HesapOzeti.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	29.10.2024-29.10.2024.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	botnet.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	5.101.138.114

Process:	C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\imOLmwQ.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\imOLmwQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.379736180876081
Encrypted:	false
SSDEEP:	48:tWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeoPUyus:tLHyIFKL3IZ2KRH9OugYs
MD5:	10E0B87B6111C866FC3B823731B377C7
SHA1:	B646EB7AF6029026F543BD48696E70F6551AA62B
SHA-256:	B8FF8B3EB3D58E1CFA8BE5364CCAE333151F10B33CD4252E99D5165A6BE5B160
SHA-512:	C42EA2C6876D6BC067CC2556597E4475E584D83BF0187EBE1D41645F481D6C4725C3BF65E4D6BAA5BDA076E2702BCE9DBE74ECF8B8D3C0A219D50A84F8AB6DAA
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ch1oaio5.lfz.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e1cxgnta.5cv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nhkmyns0.yha.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojvm21lv.zha.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_shqmdqcf.q2f.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txnvzvxd.ugh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yth3knwj.lbs.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zzrgfmu0.exq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp7551.tmp

Download File

Process:	C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.10849441056804
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtapVxvn:cge1wYrFdOFzOzN33ODOiDdKrsuT2v
MD5:	BB2AB0DF6DB250930E664CC2A1519E30
SHA1:	B5A39E126088210DA318D90BE0398054FDFBC1AB
SHA-256:	59F3189BA9C35D1781E015EF7F0424A0E42B34EC9DB527C4EB7A86157597C176
SHA-512:	8C1CADD228FE9A40D46E397919E99CDB4F3CCEBE43E3BB71291FB8735FBFA3DC2086441C337864ECA4D9F48B7FA2E27668DCC3F06F4744113E0F11C4DA911E56
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp8BD7.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\imOLmwQ.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.10849441056804
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtapVxvn:cge1wYrFdOFzOzN33ODOiDdKrsuT2v
MD5:	BB2AB0DF6DB250930E664CC2A1519E30
SHA1:	B5A39E126088210DA318D90BE0398054FDFBC1AB
SHA-256:	59F3189BA9C35D1781E015EF7F0424A0E42B34EC9DB527C4EB7A86157597C176
SHA-512:	8C1CADD228FE9A40D46E397919E99CDB4F3CCEBE43E3BB71291FB8735FBFA3DC2086441C337864ECA4D9F48B7FA2E27668DCC3F06F4744113E0F11C4DA911E56
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\imOLmwQ.exe

Download File

Process:	C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	771080
Entropy (8bit):	7.934100256459323
Encrypted:	false
SSDEEP:	12288:VrOp+Ri3AgFdEswhJL6+pt8dQ9Hn/9J2bnDiFe1VQddXkAFEDQheJiySyOtt3MKD:7Q3AgEXhJL60t8Qb2DWY12dNhui13/BR
MD5:	7766FFC22475DBDB07730FDD97E9C0C5
SHA1:	F744E3B286F1DAF7C8CF3DF7CF3171D2E7C4675C
SHA-256:	F69515024DE365946C3A58CE3315898196DCCA5A2D5A9BA3F5B257818DF4055A
SHA-512:	DB2037BC633BCA7B9E0F8E75FA18868FC7EEF2E4DD1DA6FBACE26F5ECE3BF3C87BD0350A86640D5B7ED54BD937C98B514C25492045D409EA8C7FCA34B0DDC1DC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..../=g..............0..l... ........... ........@.. ....................................`.....................................O.......\|................6........................................................... ............... ..H............text....k... ...l.................. ..`.rsrc...\|............n..............@..@.reloc..............................@..B.......................H........6...(...........^...,............................................(......}.....{....r...p .....o5....{....o7...&....0...........{......o9.....}........&.......................0..t........o.....{.....{....r...p(....o:.......+%.....{.....o....o;.....o......&....X....i2..{.....o<.......&.{....o=..............+..E..........\b......2.{....oA...n.(......}......}.....(....*....0...........{....o......3...%..;.o......{....o.....s......{.......o....,ir5..p..o......+...(...

C:\Users\user\AppData\Roaming\imOLmwQ.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.934100256459323
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.98% Win32 Executable (generic) a (10002005/4) 49.93% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
File size:	771'080 bytes
MD5:	7766ffc22475dbdb07730fdd97e9c0c5
SHA1:	f744e3b286f1daf7c8cf3df7cf3171d2e7c4675c
SHA256:	f69515024de365946c3a58ce3315898196dcca5a2d5a9ba3f5b257818df4055a
SHA512:	db2037bc633bca7b9e0f8e75fa18868fc7eef2e4dd1da6fbace26f5ece3bf3c87bd0350a86640d5b7ed54bd937c98b514c25492045d409ea8c7fca34b0ddc1dc
SSDEEP:	12288:VrOp+Ri3AgFdEswhJL6+pt8dQ9Hn/9J2bnDiFe1VQddXkAFEDQheJiySyOtt3MKD:7Q3AgEXhJL60t8Qb2DWY12dNhui13/BR
TLSH:	D6F423817A781F11DA7847F0A5E212810F35BD3B2914C9CD19C91B4FABD2768C6E8F9A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..../=g..............0..l... ........... ........@.. ....................................`................................

File Icon


Icon Hash:	8bdb4b414d656d61

Static PE Info

General

Entrypoint:	0x4b8bf6
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673D2F1F [Wed Nov 20 00:36:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 00:00:00 08/11/2021 23:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb8ba4	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xba000	0x1d7c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb8e00	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb6bfc	0xb6c00	97e5837b941c2a4925a1cf66b066b45a	False	0.9597605484781122	data	7.940612345814647	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xba000	0x1d7c	0x1e00	6572d3e8c0a0c744a9e34eb2143e19c4	False	0.80625	data	7.320917777279392	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbc000	0xc	0x200	300a293513d2e3b0e814b8c09b643d2e	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xba100	0x1733	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9151372284896447
RT_GROUP_ICON	0xbb844	0x14	data	1.05
RT_VERSION	0xbb868	0x314	data	0.43274111675126903
RT_MANIFEST	0xbbb8c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 03:20:25.691132069 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:25.696029902 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:25.696106911 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:26.368973970 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:26.369952917 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:26.375194073 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:26.537760973 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:26.537971020 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:26.542870998 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:26.709705114 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:26.716906071 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:26.721848965 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:26.913279057 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:26.913325071 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:26.913361073 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:26.913443089 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:26.931724072 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:26.936602116 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:27.101604939 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:27.146519899 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:27.153208971 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:27.314543962 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:27.316133022 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:27.320996046 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:27.483717918 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:27.484077930 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:27.488960981 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:27.666388988 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:27.666733027 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:27.671788931 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:27.834573984 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:27.834804058 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:27.839659929 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:28.013581991 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:28.013784885 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:28.018641949 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:28.181256056 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:28.182303905 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:28.182375908 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:28.182389975 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:28.182415009 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:28.187294960 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:28.187338114 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:28.187372923 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:28.187388897 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:28.451390982 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:28.511672974 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:28.516525984 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:28.686357021 CET	587	49736	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:28.690304041 CET	49736	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:28.691358089 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:28.696296930 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:28.697570086 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:29.260633945 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:29.260799885 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:29.265696049 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:29.426975012 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:29.427119017 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:29.431967974 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:29.482530117 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:29.487456083 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:29.487703085 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:29.596244097 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:29.598035097 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:29.602847099 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:29.791377068 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:29.791409016 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:29.791424990 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:29.791472912 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:29.877441883 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:29.877511024 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:29.878987074 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:29.883902073 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.045746088 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.046955109 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.051758051 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.063126087 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.063750029 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.068594933 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.212011099 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.212382078 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.217191935 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.233392954 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.233726978 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.238584995 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.378463984 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.378863096 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.383683920 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.406928062 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.410830021 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.415690899 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.550586939 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.550924063 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.555754900 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.588140965 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.588162899 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.588179111 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.588232994 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.678575039 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.678644896 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.680265903 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.685081005 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.716253042 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.716514111 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.721344948 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.850684881 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.876033068 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.880896091 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.893086910 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:30.893337011 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:30.898164034 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.045312881 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.045856953 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.050672054 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.058334112 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.059993982 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.060220003 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.060220003 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.060252905 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.060424089 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.060447931 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.060472012 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.060525894 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.060549021 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.064893007 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.065023899 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.065038919 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.065287113 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.065311909 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.065392017 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.065406084 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.065418005 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.065540075 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.065551996 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.215807915 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.216346979 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.221146107 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.347132921 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.401367903 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.401866913 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.406804085 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.516520023 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.570987940 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.572031975 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.576860905 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.745418072 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.745635986 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.750485897 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.914825916 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.915824890 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.915900946 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.915934086 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.915985107 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:31.920804977 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.920836926 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:31.920871019 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:32.182503939 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:32.235270977 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:32.287040949 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:32.291884899 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:32.457045078 CET	587	49739	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:32.461587906 CET	49739	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:32.462733984 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:32.467546940 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:32.467648983 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:33.048914909 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.049093962 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:33.053975105 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.221709013 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.221949100 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:33.226908922 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.398705006 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.399297953 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:33.405446053 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.598756075 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.598778009 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.598793030 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.598808050 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.598846912 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:33.598903894 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:33.601006031 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:33.605876923 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.773092985 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.774507999 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:33.779423952 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.945871115 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:33.946212053 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:33.951133966 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.118314981 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.119115114 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.123964071 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.295665979 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.296390057 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.302659035 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.470202923 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.470455885 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.475341082 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.652803898 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.653042078 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.657879114 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.826086998 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.826674938 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.826776028 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.826824903 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.826888084 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.827033997 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.827091932 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.827157021 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.827181101 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.827233076 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:20:34.832082033 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.832092047 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.832159996 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.832169056 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:34.832180023 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:35.060146093 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:20:35.110289097 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:22:05.642002106 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:22:05.646935940 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:22:05.808867931 CET	587	49738	78.110.166.82	192.168.2.4
Nov 20, 2024 03:22:05.838193893 CET	49738	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:22:09.558959007 CET	49741	587	192.168.2.4	78.110.166.82
Nov 20, 2024 03:22:09.563987970 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:22:09.731829882 CET	587	49741	78.110.166.82	192.168.2.4
Nov 20, 2024 03:22:09.732558012 CET	49741	587	192.168.2.4	78.110.166.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 03:20:25.621047974 CET	50025	53	192.168.2.4	1.1.1.1
Nov 20, 2024 03:20:25.664935112 CET	53	50025	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 03:20:25.621047974 CET	192.168.2.4	1.1.1.1	0x19ed	Standard query (0)	zqamcx.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 03:20:25.664935112 CET	1.1.1.1	192.168.2.4	0x19ed	No error (0)	zqamcx.com		78.110.166.82	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 20, 2024 03:20:26.368973970 CET	587	49736	78.110.166.82	192.168.2.4	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Wed, 20 Nov 2024 02:20:26 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 20, 2024 03:20:26.369952917 CET	49736	587	192.168.2.4	78.110.166.82	EHLO 971342
Nov 20, 2024 03:20:26.537760973 CET	587	49736	78.110.166.82	192.168.2.4	250-cphost14.qhoster.net Hello 971342 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 20, 2024 03:20:26.537971020 CET	49736	587	192.168.2.4	78.110.166.82	STARTTLS
Nov 20, 2024 03:20:26.709705114 CET	587	49736	78.110.166.82	192.168.2.4	220 TLS go ahead
Nov 20, 2024 03:20:29.260633945 CET	587	49738	78.110.166.82	192.168.2.4	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Wed, 20 Nov 2024 02:20:29 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 20, 2024 03:20:29.260799885 CET	49738	587	192.168.2.4	78.110.166.82	EHLO 971342
Nov 20, 2024 03:20:29.426975012 CET	587	49738	78.110.166.82	192.168.2.4	250-cphost14.qhoster.net Hello 971342 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 20, 2024 03:20:29.427119017 CET	49738	587	192.168.2.4	78.110.166.82	STARTTLS
Nov 20, 2024 03:20:29.596244097 CET	587	49738	78.110.166.82	192.168.2.4	220 TLS go ahead
Nov 20, 2024 03:20:30.063126087 CET	587	49739	78.110.166.82	192.168.2.4	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Wed, 20 Nov 2024 02:20:29 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 20, 2024 03:20:30.063750029 CET	49739	587	192.168.2.4	78.110.166.82	EHLO 971342
Nov 20, 2024 03:20:30.233392954 CET	587	49739	78.110.166.82	192.168.2.4	250-cphost14.qhoster.net Hello 971342 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 20, 2024 03:20:30.233726978 CET	49739	587	192.168.2.4	78.110.166.82	STARTTLS
Nov 20, 2024 03:20:30.406928062 CET	587	49739	78.110.166.82	192.168.2.4	220 TLS go ahead
Nov 20, 2024 03:20:33.048914909 CET	587	49741	78.110.166.82	192.168.2.4	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Wed, 20 Nov 2024 02:20:32 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 20, 2024 03:20:33.049093962 CET	49741	587	192.168.2.4	78.110.166.82	EHLO 971342
Nov 20, 2024 03:20:33.221709013 CET	587	49741	78.110.166.82	192.168.2.4	250-cphost14.qhoster.net Hello 971342 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 20, 2024 03:20:33.221949100 CET	49741	587	192.168.2.4	78.110.166.82	STARTTLS
Nov 20, 2024 03:20:33.398705006 CET	587	49741	78.110.166.82	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	21:20:18
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe"
Imagebase:	0xeb0000
File size:	771'080 bytes
MD5 hash:	7766FFC22475DBDB07730FDD97E9C0C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1923270481.0000000004329000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1923270481.0000000004329000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:20:21
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe"
Imagebase:	0x4c0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:20:21
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:20:21
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\imOLmwQ.exe"
Imagebase:	0x4c0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:20:21
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:20:21
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp7551.tmp"
Imagebase:	0x900000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:20:21
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:20:22
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe"
Imagebase:	0xf70000
File size:	771'080 bytes
MD5 hash:	7766FFC22475DBDB07730FDD97E9C0C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.3112118306.000000000341F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.3107870895.000000000040B000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.3107870895.000000000040B000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.3112118306.0000000003449000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.3112118306.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.3112118306.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:20:25
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Roaming\imOLmwQ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\imOLmwQ.exe
Imagebase:	0x5a0000
File size:	771'080 bytes
MD5 hash:	7766FFC22475DBDB07730FDD97E9C0C5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:20:25
Start date:	19/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:20:27
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\imOLmwQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8BD7.tmp"
Imagebase:	0x900000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:20:27
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:20:27
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Roaming\imOLmwQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\imOLmwQ.exe"
Imagebase:	0x270000
File size:	771'080 bytes
MD5 hash:	7766FFC22475DBDB07730FDD97E9C0C5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:20:27
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Roaming\imOLmwQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\imOLmwQ.exe"
Imagebase:	0xfc0000
File size:	771'080 bytes
MD5 hash:	7766FFC22475DBDB07730FDD97E9C0C5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3113375057.000000000375E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3113375057.0000000003788000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.3113375057.0000000003719000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3113375057.0000000003719000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 0154D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919813569.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_154d000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7265e9ed2f9e5f36fe46def7fddce9ef97a982c4a7fdfd0902fcd4c8194a722a
Instruction ID: 202b4970524d0c0fadc485d66d299a560ebd867b51f2e4c62764f6ffaff2bc4c
Opcode Fuzzy Hash: 7265e9ed2f9e5f36fe46def7fddce9ef97a982c4a7fdfd0902fcd4c8194a722a
Instruction Fuzzy Hash: B2210071600240DFDB05DF58D9C0B6ABFB5FBA831CF20C669E9094F25AC736D456CAA2

Function 0155D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919914222.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb51ddbae3e13f469ad8f64260b32be202a728b15f1522fc23f671ba3e04e8ba
Instruction ID: 65eb432be48a701f01bcd0156dd68de702baed29e4e78e003de8f964fcee4403
Opcode Fuzzy Hash: eb51ddbae3e13f469ad8f64260b32be202a728b15f1522fc23f671ba3e04e8ba
Instruction Fuzzy Hash: 05210472504200EFDB45DF98D9D0B2ABBB5FB84364F20CA6EED094F256C37AD446CA61

Function 0155D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919914222.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf1729bb58bd399004218686a1b66fe2daa88a1f10a2b3742e5df3ea1c34d60
Instruction ID: feb26ceff6f0ee305b06b733880887e474c3f5743727bd972bb98fd1fbac2f4a
Opcode Fuzzy Hash: ebf1729bb58bd399004218686a1b66fe2daa88a1f10a2b3742e5df3ea1c34d60
Instruction Fuzzy Hash: 1E210072604200DFDB55DF58D994B2ABBB5FB84314F20C96ADC0A4F266D33AD447CA61

Function 0155D005 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919914222.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b3fe3d6dcd4f7378f2aba9b8e29cef4d9efe7ebc672f79eefbcca24e2ea423e
Instruction ID: 9f24b56a1e93cff660c95ae821c0d72c5b403d6e24650864be951de0b966ca6b
Opcode Fuzzy Hash: 8b3fe3d6dcd4f7378f2aba9b8e29cef4d9efe7ebc672f79eefbcca24e2ea423e
Instruction Fuzzy Hash: A6217F755083849FDB02CF64D994B15BF71FB46214F28C5EAD8498F2A7D33A980ACB62

Function 0154D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919813569.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_154d000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: aeeecc561b938a3bd4d62aed1bd439bff2c1b0f30534f5c778e5624f403df045
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 0211E172504280CFCB02CF54D5C4B5ABF71FB94318F24C6A9D8090F256C33AD45ACBA1

Function 0155D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919914222.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 15fa828efe36699009e8d50515675d201b9ad26b1f2c661d7b91955b4f19ff79
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 5F11A976504280DFDB42CF54C5D4B19BBB1FB84224F24C6AADC494F696C33AD44ACB61

Function 0154D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919813569.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_154d000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957f15de63c4b0a45e3c1a3a7231ae6a86c6baea489c43f4202d0a7880ef56c8
Instruction ID: 1dff8081f98fa26edd5c873a71fe3bc5f4b76d3ed6633d8abc4d3ecba7bb7da8
Opcode Fuzzy Hash: 957f15de63c4b0a45e3c1a3a7231ae6a86c6baea489c43f4202d0a7880ef56c8
Instruction Fuzzy Hash: 6E0188710043849BE711DA99CD84757BFF8FF51628F18C966ED094E246C2799440C671

Function 0154D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919813569.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_154d000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e3cf5e64d3d37cb4a18e4a1b30a75827b42db2056a1fc842c8d1dd510a5e79
Instruction ID: 4c4919a6e84d711c083c68f70a01feca77fb1bdcdb4254b2819ff66fde1b62a2
Opcode Fuzzy Hash: 14e3cf5e64d3d37cb4a18e4a1b30a75827b42db2056a1fc842c8d1dd510a5e79
Instruction Fuzzy Hash: 26F062724043849FE7118B5ADC88B66FFB8FF51628F18C85AED084E287C2799844CAB1

Analysis Process: Musterino_94372478_Ekno_101_20241031410530_ekstre.exePID: 7216, Parent PID: 6904COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	114
Total number of Limit Nodes:	9

Executed Functions

Function 06860040 Relevance: 8.4, Strings: 6, Instructions: 943COMMON

Download Yara Rule

Strings

$kq, xrefs: 06860D18
$kq, xrefs: 06860CD7
$kq, xrefs: 06860CF4
$kq, xrefs: 06860D24
$kq, xrefs: 06860CCB
$kq, xrefs: 06860D00

Memory Dump Source

Source File: 00000008.00000002.3122752310.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6860000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 2d6b54e9452a0b7d026a7b717774924c1c1f374bed992add80f66bf7e253b1fa
Instruction ID: b2ff7dc5e21727057b3f88d559c272e13ee0e51b1ac4496c89b96e02d2646e40
Opcode Fuzzy Hash: 2d6b54e9452a0b7d026a7b717774924c1c1f374bed992add80f66bf7e253b1fa
Instruction Fuzzy Hash: 30827E30E106158FCB64DF65CA44A9DB7F2FF89300F14C6A9E549AB264EB74ED85CB80

Function 06865760 Relevance: 3.0, Strings: 2, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06865D07
$kq, xrefs: 06865CFB

Memory Dump Source

Source File: 00000008.00000002.3122752310.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6860000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 3cc944fa19cdf7a45197a3b9cca132116f9c4e8f62e9ce43e9a469b99327558d
Instruction ID: afa359519f003decbd896ef000d3692029ba90427552e279d9697c2fddaaf9f8
Opcode Fuzzy Hash: 3cc944fa19cdf7a45197a3b9cca132116f9c4e8f62e9ce43e9a469b99327558d
Instruction Fuzzy Hash: E202AF30B102058FDB54DB6AD9946AEB7F2FF84700F148529E506EB394DB35EC86CB91

Function 0686DD3D Relevance: 2.8, Strings: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xoq, xrefs: 0686DEA7
$kq, xrefs: 0686DE8E

Memory Dump Source

Source File: 00000008.00000002.3122752310.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6860000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: Xoq$$kq
API String ID: 0-227003152
Opcode ID: 6a7f8bd0f9283f27c0f0020cccc92e738dd18dc806fc7ffd595c70a4f8462b10
Instruction ID: 2f6e9623f11a64cc14441187261f60734bb0a0f0d8915f9096a261738dcdabb4
Opcode Fuzzy Hash: 6a7f8bd0f9283f27c0f0020cccc92e738dd18dc806fc7ffd595c70a4f8462b10
Instruction Fuzzy Hash: 80B1F474B042188FDB58AB799C5527EBBA7BFC8741B14852DE107EB388DE34DC029791

Function 01729B40 Relevance: 2.8, Instructions: 2816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b7d5576a8c8d24bfdf6b85a3cdc2fe9b11bb8d62ffdd6f5ba806ebfa134daa
Instruction ID: 3c3315d1adaa1bb8ba8f7b886071c968e736c04d56bab63392a2cb27aa9cc136
Opcode Fuzzy Hash: 13b7d5576a8c8d24bfdf6b85a3cdc2fe9b11bb8d62ffdd6f5ba806ebfa134daa
Instruction Fuzzy Hash: D953F731D10B1A8ACB51EF68C880699F7B1FF99300F11D79AE4587B125FB70AAD5CB81

Function 0172CDC0 Relevance: 2.3, Instructions: 2297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767704dcd9b646e4bd452ebd5a4b9d9b3ade308b04aa19e72f8df742a3c18318
Instruction ID: 7d6c563862aa01d6b409a694a349a82d19b3dc73ef4afb6cfa585a40e99be2f9
Opcode Fuzzy Hash: 767704dcd9b646e4bd452ebd5a4b9d9b3ade308b04aa19e72f8df742a3c18318
Instruction Fuzzy Hash: 58332E31D10B198EDB15DF68C8846ADF7B1FF99300F15C79AE448A7225EB70AAC5CB81

Function 06862F08 Relevance: 1.8, Strings: 1, Instructions: 585
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 068632B2

Memory Dump Source

Source File: 00000008.00000002.3122752310.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6860000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: f21fd382053c19a716a9e157ee669a218eacdcef5f9d1ae6fa1f261616276dbe
Instruction ID: 997e16aed9fe2bb5c4a3ec593b914bb02edb0a8749f467ff0ec7aa44b9ae4d28
Opcode Fuzzy Hash: f21fd382053c19a716a9e157ee669a218eacdcef5f9d1ae6fa1f261616276dbe
Instruction Fuzzy Hash: F122C271E002198FDF64DBA6C5906AEBBB2FF88310F208569EA15EB354DB35DC45CB90

Function 01723E70 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\VLm, xrefs: 017240BB

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: \VLm
API String ID: 0-2808160488
Opcode ID: dabac037dc7be1e7b48c7c8ff9e498736d67edf9e0418813d741992e3e5191f1
Instruction ID: 2e36bf3ffa11a3534ea086cbc80cbb344c815d5d69055353dc06b760d7418956
Opcode Fuzzy Hash: dabac037dc7be1e7b48c7c8ff9e498736d67edf9e0418813d741992e3e5191f1
Instruction Fuzzy Hash: 97917E70E00219DFDF20CFA9D985B9DFBF2BF88314F248529E415A7254EB749886CB91

Function 01724A88 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f978e9cbc80d8be46851abc02ed35613fc597828da189ded291656fbf6724c
Instruction ID: 8138f91e7a0f0ce882c0140b4af36544478fcb166f86fe43173b1d6cc24e5559
Opcode Fuzzy Hash: a7f978e9cbc80d8be46851abc02ed35613fc597828da189ded291656fbf6724c
Instruction Fuzzy Hash: DCB14F71E00229CFDF15CFA9C9857ADFBF2AF88314F148129D516E7294EB749886CB81

Function 0172FCD8 Relevance: 2.7, Strings: 2, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 0172FEB2
(&kq, xrefs: 0172FDF3

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: (&kq$(oq
API String ID: 0-2620321033
Opcode ID: 6af131cfbdf2260f33a01f188db1f71acc2647063e1d7c511db2aeb14f8a5e7a
Instruction ID: d5fa51374219b702b87dee19545a276e929c676d6951f94e5cf998f12cdae0e8
Opcode Fuzzy Hash: 6af131cfbdf2260f33a01f188db1f71acc2647063e1d7c511db2aeb14f8a5e7a
Instruction Fuzzy Hash: BA71AF31F002299BDB15EFB9D8506AEBBB6AFC8700F14852DE501A7394DE34AD42C7A5

Function 017247F4 Relevance: 2.7, Strings: 2, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VLm, xrefs: 0172486F
\VLm, xrefs: 017249C2

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: \VLm$\VLm
API String ID: 0-1686317364
Opcode ID: b28c29584dda743aa655ab73a18f47e70527d20f3743e615796677d06d92e927
Instruction ID: 5b79b7d5d8ba37a02b9da8a5d9e94145835dfeabee5688e4d5fae2e40bb2a467
Opcode Fuzzy Hash: b28c29584dda743aa655ab73a18f47e70527d20f3743e615796677d06d92e927
Instruction Fuzzy Hash: 6D7148B0E00269DFDB14CFA9C88479EFBF1BF88314F148129E456AB254EB749942CF91

Function 01724800 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VLm, xrefs: 0172486F
\VLm, xrefs: 017249C2

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: \VLm$\VLm
API String ID: 0-1686317364
Opcode ID: 29166f9d172fb4d6d2abf7d7fd42b3110cd9c55bd2a8a5a969b2aa6c027bc52c
Instruction ID: 58c721feb620c9744b22af44e8b03a950726183c85f708ee87b7c5bcd5d70828
Opcode Fuzzy Hash: 29166f9d172fb4d6d2abf7d7fd42b3110cd9c55bd2a8a5a969b2aa6c027bc52c
Instruction Fuzzy Hash: 3A714BB0E00259DFDB14CFA9C88479EFBF2BF88314F148129E456AB254EB749942CF95

Function 01726EC7 Relevance: 2.6, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRkq, xrefs: 01726F96
LRkq, xrefs: 01726EFE

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: LRkq$LRkq
API String ID: 0-2882777380
Opcode ID: 0cdead7732f9eaae929390a7ba10df2dfc869a50965b084cbd55e80c113c831c
Instruction ID: 8c38dbb819ad56842b884b6dbc0b7c3724da1c8034765b3e3290c34c6b2afe30
Opcode Fuzzy Hash: 0cdead7732f9eaae929390a7ba10df2dfc869a50965b084cbd55e80c113c831c
Instruction Fuzzy Hash: E251B231A002558FDB25DF68C550BAEF7B2FF89300F20846AE405EB395EB759846CB51

Function 05F9EA40 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3122366821.0000000005F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f90000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2c5546af00adb139c036395b2894fb56eaf7a1ca7fe924fce5950fd36325cfb0
Instruction ID: eaebd690a448e42dd502d5345162932fd7f4dfd789172407c299782c01d0e402
Opcode Fuzzy Hash: 2c5546af00adb139c036395b2894fb56eaf7a1ca7fe924fce5950fd36325cfb0
Instruction Fuzzy Hash: 03812470A00B059FEB28DF29D44476ABBF6FF88304F10892DD58AD7A50D779E849CB91

Function 0686E228 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3122752310.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6860000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde548ae646b6554129184c2155053ef4f2a5f3b71fa4fd4ed0c6aaa03d5816f
Instruction ID: 4d9f090a0e163d42b0431252e153124a5ac247a438b68d7ee024dcccc174d7c0
Opcode Fuzzy Hash: bde548ae646b6554129184c2155053ef4f2a5f3b71fa4fd4ed0c6aaa03d5816f
Instruction Fuzzy Hash: 62411372D083968FCB14CFB9D8046EEBFF5AF89210F15866AE444E7391DB349845CBA1

Function 05F96780 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05F96807

Memory Dump Source

Source File: 00000008.00000002.3122366821.0000000005F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f90000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 08a66001e1db060026e57e8c8cc4e19ae73cb89b789b3e789a416b636ea1e847
Instruction ID: c4066638d774fb8565e34dcc720230a8f68f29aff212390f4411f1e0aee109e0
Opcode Fuzzy Hash: 08a66001e1db060026e57e8c8cc4e19ae73cb89b789b3e789a416b636ea1e847
Instruction Fuzzy Hash: 5F21B3B59002589FDB10CF9AD584ADEBBF4EB48310F14841AE954A7250D378A944CFA5

Function 05F9677B Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05F96807

Memory Dump Source

Source File: 00000008.00000002.3122366821.0000000005F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f90000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4e3370d25886313bbb7849562e6c79cd83edc1a2664f88a6ee8b315f3cbfa1d9
Instruction ID: 25b4267572b3036a1e4d5a81e1d1511d745cd0ca19b1ccbe7435b97057e2eb7a
Opcode Fuzzy Hash: 4e3370d25886313bbb7849562e6c79cd83edc1a2664f88a6ee8b315f3cbfa1d9
Instruction Fuzzy Hash: 1B21E2B5D00208DFDB10CFAAD584ADEBBF4FB48310F14841AE955A3360C378A944CFA1

Function 0686E310 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(8B550583), ref: 0686E377

Memory Dump Source

Source File: 00000008.00000002.3122752310.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6860000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 9031fe9a0d0ccc10ac0a1d99d72e95b47f0e32fe2245db6887318bfbec7f6d2a
Instruction ID: 539f613d36030587efb163109d414d038288a71f6003f8dd3c1127c79917547e
Opcode Fuzzy Hash: 9031fe9a0d0ccc10ac0a1d99d72e95b47f0e32fe2245db6887318bfbec7f6d2a
Instruction Fuzzy Hash: 5C1120B1C00269DBCB10CF9AC548BDEFBF4AF48320F11812AE918A7250D378A944CFE5

Function 05F9DF24 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,05F9EA5C), ref: 05F9EC96

Memory Dump Source

Source File: 00000008.00000002.3122366821.0000000005F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f90000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f7b828dae1bc28b6c6566658bd96eb5f3ad1ed4bfcd421e177f100edbfc308e5
Instruction ID: efc4e1238c10821bd54f68e691391970c9a26c1f845adf3ea1c8a0bcf0a71f06
Opcode Fuzzy Hash: f7b828dae1bc28b6c6566658bd96eb5f3ad1ed4bfcd421e177f100edbfc308e5
Instruction Fuzzy Hash: E41120B6C006488FDB24DF9AC444ADEFBF8AB48210F10842AD559B7210C379A545CFA1

Function 01723E64 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

\VLm, xrefs: 017240BB

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: \VLm
API String ID: 0-2808160488
Opcode ID: b715eebc672cc586b9514e44dcb61e419096a05e9b8717219d8d3ca7ab320a60
Instruction ID: 750cbcd6b92315eda559df365a4e13b8645edbf2c3694863a7624835af2b3ad6
Opcode Fuzzy Hash: b715eebc672cc586b9514e44dcb61e419096a05e9b8717219d8d3ca7ab320a60
Instruction Fuzzy Hash: 8E917C70E00219DFDB20CFA8D985BDDFBF2BF88314F248129E415A7254EB349986CB91

Function 0172F31D Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

PHkq, xrefs: 0172F46B

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: b1e729bdf9d67065bdfea4b45a59fdb9ec093c938fe6b610c34cd6707ff2b281
Instruction ID: c41838229bada1b0214eecb32dedd0be5bbfeea5450f705e86477643cf363a01
Opcode Fuzzy Hash: b1e729bdf9d67065bdfea4b45a59fdb9ec093c938fe6b610c34cd6707ff2b281
Instruction Fuzzy Hash: 7231DF30B002118FDB159B38DA5466EBBF3AB89600B24456CD406DB3A9DE79DC46CB95

Function 01726F68 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

LRkq, xrefs: 01726F96

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 4167b2623cc1c12f156748715f1115294db20d0740747d930bd466251244e6ae
Instruction ID: f7cccaf54dfeffc0ca02a64b4767bec06679d9f327a83f92b8e668e811c637ab
Opcode Fuzzy Hash: 4167b2623cc1c12f156748715f1115294db20d0740747d930bd466251244e6ae
Instruction Fuzzy Hash: 6F318134E002298FDF29CF69D551BAEF7B1FF45300F10846AE905EB245EB759846CB91

Function 01726B91 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

LRkq, xrefs: 01726BC7

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 7e5e395c0497d35e29dea736953cf327c5cf383f6f5c3635dbeb8133d29652f4
Instruction ID: 1478cea55ac361c307776627de735924489f797830604b6b9de798111cac4542
Opcode Fuzzy Hash: 7e5e395c0497d35e29dea736953cf327c5cf383f6f5c3635dbeb8133d29652f4
Instruction Fuzzy Hash: 4821C4306052508FC716EB38E8506AEBBF2FFCA710F0484AED055CB769DA399D85C795

Function 01727910 Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f68c7f575ca776a032ea3723d5e43896ce144eb2bddd87e26a2e256bcc0f85
Instruction ID: 096eb8812d15a9681862ca416c4a5ae8dd102a223a4803bca80ee1f37345a13b
Opcode Fuzzy Hash: 20f68c7f575ca776a032ea3723d5e43896ce144eb2bddd87e26a2e256bcc0f85
Instruction Fuzzy Hash: 3B123D317012169FCB2AAB38E99462DB2B6FB89711F20993DD405CB365CF35DC86C791

Function 017296E8 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d038e4816690cdad4bdd4adb57ee48390d4c366bb45374a9a59bd6832215c1
Instruction ID: 60e077d0034ddf6888f40ba59ef211d3110ffa1d6324bec8b8855e5d7433dbb4
Opcode Fuzzy Hash: 20d038e4816690cdad4bdd4adb57ee48390d4c366bb45374a9a59bd6832215c1
Instruction Fuzzy Hash: 17C1A170B002258FDB15CF69D8807AEFBB2FB88314F18856AE609DB395DB74D945CB90

Function 0172936C Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d166415e1c77840091ec7c9e8e990bb33d28ee12c5dc1f2b0087bc2d40fa92
Instruction ID: e33cf343193011c6534fd3f9b575752ab197ffa6e974a308b79c88586075d15b
Opcode Fuzzy Hash: 28d166415e1c77840091ec7c9e8e990bb33d28ee12c5dc1f2b0087bc2d40fa92
Instruction Fuzzy Hash: 0EB15D34B002248FDB15DF68D594AADBBF2FB88314F188569E906E7355DB34ED42CB50

Function 01724A7C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7deed1c4254a45e88833157e1d16378cb172c1e749d9e5fc665392232917e056
Instruction ID: 9dd58c4343be3298f19fb0b5182cef9d45842b432ffd61bc1a5939489de3f7f0
Opcode Fuzzy Hash: 7deed1c4254a45e88833157e1d16378cb172c1e749d9e5fc665392232917e056
Instruction Fuzzy Hash: 38B15E70E00229DFDB11CFA9C98579DFBF2BF88314F148129D916E7254EB749986CB81

Function 01726CCD Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af771cffd2fc049418ed2f183b8a49f696c9c6eec6394a70ecd70363f7cad899
Instruction ID: 8867d9f3400bb3723c02467ac2fb8adb45e76062e1a118bf6ecad8d7378d4b8c
Opcode Fuzzy Hash: af771cffd2fc049418ed2f183b8a49f696c9c6eec6394a70ecd70363f7cad899
Instruction Fuzzy Hash: B651F470D102288FDB18CFA9C884BADFBB1BF48710F15816AE815AB265D7749885CF95

Function 01726CD8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307be81e62124d32d37279fdc919a7cf7a4f56a5cac34d2a3347bacd263c1561
Instruction ID: e07d390a7d7e9e1dc5e70be00d28081e6c39dd824848d1a130ab3260d9fde9c0
Opcode Fuzzy Hash: 307be81e62124d32d37279fdc919a7cf7a4f56a5cac34d2a3347bacd263c1561
Instruction Fuzzy Hash: 6C51E470D102288FDB14CFA9C884B9DFBB1BF48710F15812AE815AB365D774A885CF95

Function 0172FCC8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5808f4dccb11aa91d3a1c146521b9b812ed5e6e4b0676c94a6eca64b085b3afa
Instruction ID: 512180ba47b0dd851d6f6a2d4c07da4042ef26458c8f707519ece33f4cf4e6bc
Opcode Fuzzy Hash: 5808f4dccb11aa91d3a1c146521b9b812ed5e6e4b0676c94a6eca64b085b3afa
Instruction Fuzzy Hash: CB419471E00219DBDB15DFA9C990ADEFBF6BF88700F248529E511B7254EB70A942CB90

Function 0172112A Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb18e5655707175d0da9b0983743674303397f027ffcef59ab385b18c0f71af5
Instruction ID: 37fbb26acd03abe1ee225f6dac2878f8290d2efe7aea0d7f6557fc6a3768992d
Opcode Fuzzy Hash: bb18e5655707175d0da9b0983743674303397f027ffcef59ab385b18c0f71af5
Instruction Fuzzy Hash: 8351DC306432458FC715DB39FE8096A7B6AF79A314F00B6A9D0044B739DB38AD4ACF52

Function 01721138 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391a7999ea95c8eeec0d8675e11ac99a8db48efef17cf614f94b41cccb245a03
Instruction ID: e9dda5a5714f72569e9ec96acc63d422666558bc527cc681de729a3d60870bb2
Opcode Fuzzy Hash: 391a7999ea95c8eeec0d8675e11ac99a8db48efef17cf614f94b41cccb245a03
Instruction Fuzzy Hash: 9F51DD306432458FC715DB39FE8096A7B6AF799314F00B5A9D0044B739DB38AD4ACF92

Function 0172F1E0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83f5048e4dd42dcaf52b940dbab39e7eb045dc901fefe453164366217b4baa5
Instruction ID: 12c92f6d7e1d2f8b2bd37ec04c96c974a239e876ef49a4957dcea09be4b97410
Opcode Fuzzy Hash: e83f5048e4dd42dcaf52b940dbab39e7eb045dc901fefe453164366217b4baa5
Instruction Fuzzy Hash: 1D315C34E142159FCB15CFA8D594AAEFBF2BF8A300F108529E806E7360DB71AC42CB50

Function 017226CE Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1fc57b16c093ee468d7305ade27d24927b83b92d6b60074ebd4693a0524487
Instruction ID: 97fccf67896bd0b5a75e1ad9fc479d101dd6bb1ef9d7294d1735753940dedce6
Opcode Fuzzy Hash: ac1fc57b16c093ee468d7305ade27d24927b83b92d6b60074ebd4693a0524487
Instruction Fuzzy Hash: CC41D0B0D00359DFDB10DFA9C584ADEBFB5FF48310F24842AE809AB264DB759946CB90

Function 0172F1F0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f6b271d5d6c89752f491310a9d5e6d5f6513026fb1f9614afa95a13d054fd1
Instruction ID: c2b6c4737d99f27034dc7da15a26ce5ef42b73507a4c7babd8b900093b8db49d
Opcode Fuzzy Hash: 31f6b271d5d6c89752f491310a9d5e6d5f6513026fb1f9614afa95a13d054fd1
Instruction Fuzzy Hash: 71315E34E142159BCB19CFA9D554A9EF7F6FF8A300F108529E806E7354DB71AC46CB50

Function 017226D8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4aa6bf840c752dbfb5d1e994b3e23745e1278429a000306fb1d59c4855e0fb3
Instruction ID: ba6280473fbafbce60f53f33d79645a666f8a4643e8e1e02e89e4954dccbd935
Opcode Fuzzy Hash: e4aa6bf840c752dbfb5d1e994b3e23745e1278429a000306fb1d59c4855e0fb3
Instruction Fuzzy Hash: C741CEB0D00359DFDB10DFA9C584A9EBFB5FF48310F248429E819AB254DB75A946CB90

Function 01725098 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387a90cee1189fb6c9c7a413706ae448988c793f54bba5f8083e820802711ddf
Instruction ID: 3a02f3f1f24d717065abae218a3c5a6a0771361d296af6ad2e3facb5dd424b17
Opcode Fuzzy Hash: 387a90cee1189fb6c9c7a413706ae448988c793f54bba5f8083e820802711ddf
Instruction Fuzzy Hash: 0E314234701225CFDB29DB78D9546AEB7B6BF89200F2005B8D502EB394DB3ADC02CB91

Function 01725087 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e964fccc95ea2966d262c15a6cbf63cca986267f67ad3c7b360f36921294c2
Instruction ID: bed01555764cf0f098f0fa4c38bd1f05541e236a0fe977f05b9b892fa6c1f22b
Opcode Fuzzy Hash: 99e964fccc95ea2966d262c15a6cbf63cca986267f67ad3c7b360f36921294c2
Instruction Fuzzy Hash: 42314F34701221CFDB29DB38D9546AEB7B6BF89304F6105A8D502AB395DB39DC42CB91

Function 01729257 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2330d94973dd25c9d8bc9047dd5249fd917be1342e6c58b27684752ad94f95ec
Instruction ID: 4dc8ac2502a1d9c3d8c27f5adbb1a689fb271b5656186669b4b07605df1accdc
Opcode Fuzzy Hash: 2330d94973dd25c9d8bc9047dd5249fd917be1342e6c58b27684752ad94f95ec
Instruction Fuzzy Hash: F2319F31E002259FCB15CFA8D98469EF7B6FF89304F148629E905EB355DB71AC46CB90

Function 0172168F Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580e830a1f3f142739fa8e84820514334f20fc3bd82f749c04e4dc105bb0bb03
Instruction ID: 112745a5531bf13b6b638cf281184e33578abeb8bcab723b6d5806942974f682
Opcode Fuzzy Hash: 580e830a1f3f142739fa8e84820514334f20fc3bd82f749c04e4dc105bb0bb03
Instruction Fuzzy Hash: DA21A3306051514FCF32DB28F984B6D77AAEB89300F505976D406CB36ADB38DC4A8F92

Function 01729268 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc2118ec51e70d68829a4f1d89be0f4daaad10befb9e71668d423f88cb14ad2
Instruction ID: e3ee6648ecc8f7daca5e1ed1823381e11b204985c67024fff441adc59d79580d
Opcode Fuzzy Hash: 6fc2118ec51e70d68829a4f1d89be0f4daaad10befb9e71668d423f88cb14ad2
Instruction Fuzzy Hash: D6219E30E0022A9BDB15CFA8D58069EF7B6FF89304F148629E905EB345DB71EC46CB90

Function 01724F7A Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4e0156560d03be8ee470c0ff9634de132d52aada31e52ef4faae0ca6d3516b
Instruction ID: 0f1aea5298ecd8225e1f98bf54a37687a14187dbb11403ea1045ab08c9fda03d
Opcode Fuzzy Hash: 9e4e0156560d03be8ee470c0ff9634de132d52aada31e52ef4faae0ca6d3516b
Instruction Fuzzy Hash: A021F534700215CFDB64DF78D958AADBBF1EB89304B1045A8E406EB3A5DB7A9D02CB51

Function 01729159 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61aee833d77ce696cc8552f71b6dec4a2532e51e109055cfdff838a187340466
Instruction ID: 56bfc7faa167cef34f538b45c09e61e71ba6931a547a60902de31a1315d50b5c
Opcode Fuzzy Hash: 61aee833d77ce696cc8552f71b6dec4a2532e51e109055cfdff838a187340466
Instruction Fuzzy Hash: 3421A431E00225DBCB15CFA9D8546EEF7B2EF89304F148629E912F7355DB70A942CB50

Function 01721868 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c7be1b56852d45b75bccfd45e8c31a699bcb9cbf5dbba38b675173605917d1
Instruction ID: 68ef21a44edd8f867d70dabb61700e302aefbb2bcc951c1fca8afcb611538b19
Opcode Fuzzy Hash: 31c7be1b56852d45b75bccfd45e8c31a699bcb9cbf5dbba38b675173605917d1
Instruction Fuzzy Hash: 3F215C30B002658FDB29DB68C9546AEB7F5BF89344F5004ADD446EB264DB369D02CB91

Function 016DD124 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3110455446.00000000016DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_16dd000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd6a69ec3d5f26efcdad44dbdc85bfb7d64e55338950ab7547e9996ce3ea934
Instruction ID: af6d8ce23bd0b47d6dd7348297902009f02dc61baed31c14f4065d8b2a05224a
Opcode Fuzzy Hash: 9dd6a69ec3d5f26efcdad44dbdc85bfb7d64e55338950ab7547e9996ce3ea934
Instruction Fuzzy Hash: 2C210771A04240EFDB05EF78CDC0B26BB65FB84315F20C66DD9494B396C336D446CA61

Function 01729168 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c27555228319ba035d35fa13e72f5c16689f67e80cf85b344a32aebe49149d
Instruction ID: 8ca63a484cc3fdbe676295115ff0f3f9801b5af5459cb0283d5f01e9b2d9e885
Opcode Fuzzy Hash: b4c27555228319ba035d35fa13e72f5c16689f67e80cf85b344a32aebe49149d
Instruction Fuzzy Hash: 7E21A430E002299BCB19CFA5D85499EF7B6EF89304F24852AED15FB351DB70AD46CB50

Function 01721370 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2fffa6ef05536f83dcb0ddf6d1c3c9538e907a87778c4cfe792cdfec6f6a51
Instruction ID: 3326c2b4d4235f7d7b775851cba54f7b421dfd7b3b3de03bbec6b8ac8b68411a
Opcode Fuzzy Hash: ab2fffa6ef05536f83dcb0ddf6d1c3c9538e907a87778c4cfe792cdfec6f6a51
Instruction Fuzzy Hash: B121E470A052608FEB365B3CE844378BB56FB46314F94056EE40AC7397DA39CC86C746

Function 01721878 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 529fcbc947806526f3e4468f7c704667816f0ae5a7b4c50c4882758a29d0e487
Instruction ID: 4e42a96f7e6fd0a32d6dcb8d49285ddbdcf440e322aae82e3a955b68110ce2c8
Opcode Fuzzy Hash: 529fcbc947806526f3e4468f7c704667816f0ae5a7b4c50c4882758a29d0e487
Instruction Fuzzy Hash: 8B213D30B002698FDB24EB78C5546AEB7F5FB89240F9004B8D546EB364DB359D02CBA2

Function 017216A0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1ea25e1ffdc05810fdb8625841e064fb892287376d3b5ac2190623dc9e0e87
Instruction ID: adf69b41b612a1ab06aae0be3c5878ea4d143b1357d3baaa232803b55c0be62e
Opcode Fuzzy Hash: de1ea25e1ffdc05810fdb8625841e064fb892287376d3b5ac2190623dc9e0e87
Instruction Fuzzy Hash: CE214D346011114FDF32DB28F984B2DB76AE789310F505A75E406CB36ADA39DC8A8F92

Function 01724F88 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24c1e02a5412c165f1a0e7d0a942a705846ccd4de553e0de31b5f5bbd317d32b
Instruction ID: 80592df57d4e0bf90363b6ce243dc2639799083171d0ba3d6c6ffc017d2e1944
Opcode Fuzzy Hash: 24c1e02a5412c165f1a0e7d0a942a705846ccd4de553e0de31b5f5bbd317d32b
Instruction Fuzzy Hash: BC213630700224CFDB24DB78D958AAEBBF1EB8C304F1001A8E406EB3A4DB769D01CB91

Function 0172FEB8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5089aca287017b0b0daa9c97834898734de7f615f781c073d808cb0ba7971c
Instruction ID: c3601b805e32bf175dbdeba8912a0194631fb4c7fc63fe043f2596fd4c9743e2
Opcode Fuzzy Hash: 4d5089aca287017b0b0daa9c97834898734de7f615f781c073d808cb0ba7971c
Instruction Fuzzy Hash: DC11D0327083545FCB076F7858105AE3FB7EFC6210750486AE945DB392DE358D06C3A6

Function 01720848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069f681d6ff5f7a64507756a9d6c60891695abd7ac92feb2bbcce427cacaeda9
Instruction ID: 90c8eb666c81d8623ae97f592d423b1868d2b3e7b3ea81a96d9ca696f50e874b
Opcode Fuzzy Hash: 069f681d6ff5f7a64507756a9d6c60891695abd7ac92feb2bbcce427cacaeda9
Instruction Fuzzy Hash: 2311C430B412245FDF255A7CD84473FF256EB45310F204979F506DB342DAA5CC828BE2

Function 01720838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc908917ce16a184f20ebb6b9712a2abd96190c4c6052722a1534b2e3f2573ad
Instruction ID: af958cad2c0961f0d2d443f141f456bb674cebd586dd95feab2bdd1dfdcf67f5
Opcode Fuzzy Hash: bc908917ce16a184f20ebb6b9712a2abd96190c4c6052722a1534b2e3f2573ad
Instruction Fuzzy Hash: DC119131B452249FEF265A78D84437FF7A2EB45314F10497AF506DB242DAA5CC828BE2

Function 01721478 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63bce03b78ac3950a10f2f9c5aca1fc2bd59ac701f0a3a36ab7fad4a11e896e
Instruction ID: ee3695039791b247667692d48c2c704ceffa5e21cadf7aaa585fe5377faca3e7
Opcode Fuzzy Hash: b63bce03b78ac3950a10f2f9c5aca1fc2bd59ac701f0a3a36ab7fad4a11e896e
Instruction Fuzzy Hash: 1311C631E012658FCB61EFB884546ADBBF5FF98210F6445B9E805E7241E735C9438BA0

Function 017217B2 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e23fb7c3044dcfca8cddfbc3bfa54c13daf7da1cd0976687ef449aab955c08
Instruction ID: fe05f042ffc976466f0696f72c93a8d99c4e735f62f7b946df144bef4d73379d
Opcode Fuzzy Hash: c2e23fb7c3044dcfca8cddfbc3bfa54c13daf7da1cd0976687ef449aab955c08
Instruction Fuzzy Hash: C611E575B012529FCB319F749848A6FBBE5FB8C250F104469E906D7308E73889418B81

Function 016DD11F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3110455446.00000000016DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_16dd000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 1d42db9972ce482e57f70151d238c1894ffbdcb4fabdc3b586e8ca3f14f41d23
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: E0118B76904280DFDB06DF68D9C4B15BFA2FB84214F24C6AAD8494B796C33AD44ACB61

Function 01721488 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6216a65e945db285679746551dc763b848b5df64abf5d9680d78eff66667ef
Instruction ID: 2cdbc2fcc70345072250bd8a9333fe37dce35e113ba0a5af3561efce7a5bd6e9
Opcode Fuzzy Hash: 2b6216a65e945db285679746551dc763b848b5df64abf5d9680d78eff66667ef
Instruction Fuzzy Hash: E7018031E002658FCB21EFBD84545ADFBF5FF59221F6404BAE909E7241E631D8438BA1

Function 01729890 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09dac038fe5c43192e0e27d627dba46b0b0c6484537f11bed1ba704c8f03839a
Instruction ID: 4b6d9921c0d8a63fa2bd2f448f30f29963d844c6988cc987c11d50b50e974a28
Opcode Fuzzy Hash: 09dac038fe5c43192e0e27d627dba46b0b0c6484537f11bed1ba704c8f03839a
Instruction Fuzzy Hash: 48110831A002458FDB00DF64D98468AFF71FF81310F58C2A9C8485F3AAD770A949C7A0

Function 01727080 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a3db50f7cc1281b7f8f66c2bcf494353fb4c6503cf78eed5e16a3a99654c56
Instruction ID: 8a01fad7212893f4d033d37f3959d563c3bc8d249bcfc58b02ccb2afbd03664b
Opcode Fuzzy Hash: e5a3db50f7cc1281b7f8f66c2bcf494353fb4c6503cf78eed5e16a3a99654c56
Instruction Fuzzy Hash: 3F01E439B00214CFDB28DF64D698B6C77B2EF88715F1440A8E5069B3A8DB35AD82CB41

Function 017280F8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f9fd04327543c4530bd95f894ed7e0bc910b0607e5902b46ed62bc20fa4bc2
Instruction ID: 5e41334f1988a75f243dbbae37a4214155d8717df1d057aa744c321bdc46fe1b
Opcode Fuzzy Hash: d9f9fd04327543c4530bd95f894ed7e0bc910b0607e5902b46ed62bc20fa4bc2
Instruction Fuzzy Hash: FE0184305012459FCB01EB68FD809ACBB73EF45710F4047A8C4116B2A5DF356E45CB95

Function 01721514 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe4b69798744c2a655dbc373e577f991e5b8f8edb75b84398d1bf84be25837d
Instruction ID: 8dd034dfb4f653f3164df232e0a476608d728f49692886403aaa5dd473bdf94c
Opcode Fuzzy Hash: 7fe4b69798744c2a655dbc373e577f991e5b8f8edb75b84398d1bf84be25837d
Instruction Fuzzy Hash: FBF02B37A04270CBDB21CFE994501ACFFA1FE6911179800D7D90ADB251D334D943C751

Function 01728108 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe9bdd5cccadeb479a081035f82a4d13757579f9b3b14ccef2969f8de8e5d51
Instruction ID: b1f50881fad25b11bf711177b86154199ca2d39c63e3b7241a1475f050af4db6
Opcode Fuzzy Hash: 1fe9bdd5cccadeb479a081035f82a4d13757579f9b3b14ccef2969f8de8e5d51
Instruction Fuzzy Hash: 20F04430A011099FCB00EFA4FA515ADBBB7EB44700F5096B8C405A7364EF31AE49CB95

Function 0172FF88 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2332c4c820b03784d220b8f348bb9f0188d379470c41eac676547cdc051c5c65
Instruction ID: 9c37e06a16ee56409bbf606d4f3cf875f641f39ada2d4acde1e0dad3e7525f74
Opcode Fuzzy Hash: 2332c4c820b03784d220b8f348bb9f0188d379470c41eac676547cdc051c5c65
Instruction Fuzzy Hash: 21D05E311497928FC3124F64B0200C6BBB0BB57662358026BE9D2CA1A2DB250456DB91

Non-executed Functions

Function 06865068 Relevance: 13.0, Strings: 10, Instructions: 477COMMON

Download Yara Rule

Strings

$kq, xrefs: 06865532
$kq, xrefs: 068655DA
$kq, xrefs: 06865195
$kq, xrefs: 06865164
$kq, xrefs: 068655C4
$kq, xrefs: 06865189
$kq, xrefs: 068655E6
$kq, xrefs: 068655D0
$kq, xrefs: 06865158
$kq, xrefs: 06865526

Memory Dump Source

Source File: 00000008.00000002.3122752310.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6860000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1324371161
Opcode ID: 6f3d67dc983d39118e224233625ba22cffddf8486464dafe2c5a61bc8578bf4f
Instruction ID: e9a8cdf0f10bc95646d6b700f3c6a060df50227597e900df655d0a511fbf983d
Opcode Fuzzy Hash: 6f3d67dc983d39118e224233625ba22cffddf8486464dafe2c5a61bc8578bf4f
Instruction Fuzzy Hash: 27123F30B00219CFDB64DF65C954AAEB7B2BF89300F2085A9E509EB364DB359D85CF91

Function 068649E8 Relevance: 7.9, Strings: 6, Instructions: 442COMMON

Download Yara Rule

Strings

$kq, xrefs: 06864EE5
$kq, xrefs: 06864D4E
$kq, xrefs: 06864CCA
$kq, xrefs: 06864D42
$kq, xrefs: 06864F55
$kq, xrefs: 06864F61

Memory Dump Source

Source File: 00000008.00000002.3122752310.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6860000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 07562b92db91bf45f42098920c61bdaa0adfdf5fa94874120144d1d835217f66
Instruction ID: 9511c4ae1d3e34070ce2e0d7329c2a30e8656b573cf8d0725f4da29755fbfb2c
Opcode Fuzzy Hash: 07562b92db91bf45f42098920c61bdaa0adfdf5fa94874120144d1d835217f66
Instruction Fuzzy Hash: 8E022930A00219CFDB58EBA5C554A6EB7F2FF94705F24C529E405EB3A8DA35DC82CB91

Function 0686BD90 Relevance: 4.3, Strings: 3, Instructions: 568COMMON

Download Yara Rule

Strings

0oNp, xrefs: 0686BE28
DqNp, xrefs: 0686BE34
PHkq, xrefs: 0686BFF0

Memory Dump Source

Source File: 00000008.00000002.3122752310.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6860000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: 0oNp$DqNp$PHkq
API String ID: 0-4000632471
Opcode ID: d14b99b1adfdc4815031ade09e5f50c27d4b6d8154fcc521645d12c0dd4a3385
Instruction ID: c2fd708985c85debe58a0f81388da4c23deadc8a9290ae43dffa4d222f3fe7c3
Opcode Fuzzy Hash: d14b99b1adfdc4815031ade09e5f50c27d4b6d8154fcc521645d12c0dd4a3385
Instruction Fuzzy Hash: 14228C30B001058FDB64DB69D984BAEB7E2FF88310F208569E506DB3A5DB75EC85CB91

Function 06863637 Relevance: 2.9, Strings: 2, Instructions: 414COMMON

Download Yara Rule

Strings

XPpq, xrefs: 068638CF
\Opq, xrefs: 06863752

Memory Dump Source

Source File: 00000008.00000002.3122752310.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6860000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: XPpq$\Opq
API String ID: 0-2429731126
Opcode ID: 8be7834e64136d0a4e1ad8d5df37fc6ffe44e52ba7dd5aab8dafb96fe98bfd3b
Instruction ID: aed14a8d90b302a0bd5f03c9d1f63b05f209c9973124f7529c6e86f1a6cc9a62
Opcode Fuzzy Hash: 8be7834e64136d0a4e1ad8d5df37fc6ffe44e52ba7dd5aab8dafb96fe98bfd3b
Instruction Fuzzy Hash: 0DD10431F101148FDF54DB69D890AAEB7F2FB89314F24946AE606EB391CA35EC45CB90

Function 017241B8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VLm, xrefs: 0172446F

Memory Dump Source

Source File: 00000008.00000002.3111060106.0000000001720000.00000040.00000800.00020000.00000000.sdmp, Offset: 01720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1720000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID: \VLm
API String ID: 0-2808160488
Opcode ID: 62e4430235c3efd0ddadc4921fa12b09e494ad9807be0cfeac831a844b1f4e45
Instruction ID: cdb3f809c194b3b21df84b049b9e8cb02bec1dd68bf82a10af87ffcc9cc7cf4b
Opcode Fuzzy Hash: 62e4430235c3efd0ddadc4921fa12b09e494ad9807be0cfeac831a844b1f4e45
Instruction Fuzzy Hash: 39B13C71E00229CFDF14CFA9C9857ADFBF2BF89314F148129D856A7294EB749846CB81

Function 05F910B8 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3122366821.0000000005F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f90000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579fca7e73e5bdc57854c4b3f354acbdf86fd745776cc14757847b95a72ada7c
Instruction ID: 8a79b6dbfd995e493cefa17892cb82cd29e5d3d80cc409d682214960f4e01bad
Opcode Fuzzy Hash: 579fca7e73e5bdc57854c4b3f354acbdf86fd745776cc14757847b95a72ada7c
Instruction Fuzzy Hash: 47B19471E0061A9FDF24DFA9C840BAFBBB6FB89710F10852AD505E7390CB399945CB91

Function 05F9C9A0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3122366821.0000000005F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f90000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48362d4d43425a222970ae4cd346adde33bb3d07a39b38455c33d50b7e190d96
Instruction ID: 242f02f3754c40a55e2a0aeefd694d7ee55e7305da8ebb8689d8eb1e1e91dd93
Opcode Fuzzy Hash: 48362d4d43425a222970ae4cd346adde33bb3d07a39b38455c33d50b7e190d96
Instruction Fuzzy Hash: 3DA17132F00609CFDF09DFB4C88499EB7B6FF85300B25856AE906AB261DB35D955CB80

Function 05F91480 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3122366821.0000000005F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f90000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fcca4b49cbcded307ea1a47499db97cbade017c860fa8271115f8210d0836ac
Instruction ID: 693675e6ce6b6733aa55e37542bbd2572480977358109a343724e8cc86defdd6
Opcode Fuzzy Hash: 4fcca4b49cbcded307ea1a47499db97cbade017c860fa8271115f8210d0836ac
Instruction Fuzzy Hash: 77814F75D0064A8FEF25CF99C580EEEBBB2FB48310F15852AE44AE7251C338D941CB91

Function 05F9F370 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3122366821.0000000005F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f90000_Musterino_94372478_Ekno_101_20241031410530_ekstre.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edce572633e4c6d63d200cddfe4d2b85858b7a0c3db4476ff4fb6263b56a4b4c
Instruction ID: 428a3e48ad9a6f5dc744ecf08537860190a8f4e6c75ee3ba6c5a33638735d57e
Opcode Fuzzy Hash: edce572633e4c6d63d200cddfe4d2b85858b7a0c3db4476ff4fb6263b56a4b4c
Instruction Fuzzy Hash: B6C1E6B08097468BF730DF65E94C1D97BB1BB85324F528709D1616B2E9EBB8148BCF84

Analysis Process: imOLmwQ.exePID: 7400, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	67
Total number of Limit Nodes:	2

Executed Functions

Function 00F8AD08 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F8AF5E

Memory Dump Source

Source File: 00000009.00000002.1972313450.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f80000_imOLmwQ.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ecebb83e925ab54cd64bb02240bb24100314c1ce453cdc214df973ced57e0ef2
Instruction ID: b114e28bab3ae12a3f135e121be6df2a23ac7764aee1bb304445a63e49459a49
Opcode Fuzzy Hash: ecebb83e925ab54cd64bb02240bb24100314c1ce453cdc214df973ced57e0ef2
Instruction Fuzzy Hash: 25714670A00B058FE724EF2AD44179ABBF5FF88314F00892ED48AD7A50D775E949DB91

Function 00F858EC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F859A9

Memory Dump Source

Source File: 00000009.00000002.1972313450.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f80000_imOLmwQ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8301cc9114e4839335e8df63dea2b78dae52caa0472ee45e49ee07743123a8b0
Instruction ID: a4e736426ab6d82e4c4dc326a140e22de7ad1e55ca34ef434967672d8d4d61e3
Opcode Fuzzy Hash: 8301cc9114e4839335e8df63dea2b78dae52caa0472ee45e49ee07743123a8b0
Instruction Fuzzy Hash: 3F41DFB0C00719CFDB24DFA9C8847CDBBB5BF89714F24816AD408AB265DB796946CF90

Function 00F844B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F859A9

Memory Dump Source

Source File: 00000009.00000002.1972313450.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f80000_imOLmwQ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7410d2a9090347dea5bec84d67b2ffed7331cf8f256501854da9dec70449a3bd
Instruction ID: 05ede79a0864ffd235af7903b3da27824a009afbc366d8f1f30157b8737ce976
Opcode Fuzzy Hash: 7410d2a9090347dea5bec84d67b2ffed7331cf8f256501854da9dec70449a3bd
Instruction Fuzzy Hash: 3341E2B0C0071DCBDB24DFA9C884BCDBBB5BF89704F20816AD408AB255DB756945CF90

Function 00F8D1DC Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F8D5B6,?,?,?,?,?), ref: 00F8D677

Memory Dump Source

Source File: 00000009.00000002.1972313450.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f80000_imOLmwQ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 65adabb1cae3abb297fe9abd8509a061bb1ec74ab017e709f1f0a7f1768fc343
Instruction ID: afcdca81079424d27b344b3a5f60d58668d5e756d9d1caf2b2ba2f2b7328dc72
Opcode Fuzzy Hash: 65adabb1cae3abb297fe9abd8509a061bb1ec74ab017e709f1f0a7f1768fc343
Instruction Fuzzy Hash: C921E3B5D00208EFDB10DF9AD984ADEBBF4EB48324F14801AE918A7351D374A940DFA4

Function 00F8D5E9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F8D5B6,?,?,?,?,?), ref: 00F8D677

Memory Dump Source

Source File: 00000009.00000002.1972313450.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f80000_imOLmwQ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a9b9a94f78721d7ab5ba76d9cc8c88be26c011be41b5791ef9640df730d35b0f
Instruction ID: b1e8dac0efbf88cc94ea71779befec009df6c7ab69459e2462daafa0ce02ed4b
Opcode Fuzzy Hash: a9b9a94f78721d7ab5ba76d9cc8c88be26c011be41b5791ef9640df730d35b0f
Instruction Fuzzy Hash: AB21E6B5D00259EFDB10CF9AD984ADEBFF5EB48324F14801AE958A3350D378A944CFA4

Function 00F8AEF8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F8AF5E

Memory Dump Source

Source File: 00000009.00000002.1972313450.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f80000_imOLmwQ.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6b22b4d3adbd39304a7abe0d18174eecb082834497201028afc9c970ecf72a71
Instruction ID: 5fd734bc8f3f22ec838329d40197577772b91077674d02070fa8e93325c71170
Opcode Fuzzy Hash: 6b22b4d3adbd39304a7abe0d18174eecb082834497201028afc9c970ecf72a71
Instruction Fuzzy Hash: 3511E0B5C002498FDB20DF9AD844ADEFBF4EF88324F10846AD559A7214C379A545CFA5

Function 00D1D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1971926306.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d1d000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 749f42b3ac41fec87641d9652f6a91d1d9e3b97b377306609cef261d423ee7e5
Instruction ID: 06c7097c8aadb23f539f05484267632e0c2f8d1af1f0b7deae7a48c4a845009f
Opcode Fuzzy Hash: 749f42b3ac41fec87641d9652f6a91d1d9e3b97b377306609cef261d423ee7e5
Instruction Fuzzy Hash: 7F216A71100200EFDB04DF04E9C0B57BF66FB98314F24C169E8090B256C736E886C7B2

Function 00F3D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1972101526.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f3d000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef53c812816cb2145ffc78a3003dba315a556ee515d1682e11211ad4e00a7661
Instruction ID: 19aabfbd39324e077728a1739482deeb19e995ba52b7e1bb92d9f119cc1591d0
Opcode Fuzzy Hash: ef53c812816cb2145ffc78a3003dba315a556ee515d1682e11211ad4e00a7661
Instruction Fuzzy Hash: 6F212671904204EFDB05DF14E9C0B27BBA5FB84334F20C66DE8494B396C736D846DA61

Function 00F3D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1972101526.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f3d000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651eb50c6c71ab8e7efe9e2b07ad15a29b9c3889e99ebce97fe8aef138a1b0ed
Instruction ID: 4b8e47fa1f3cab78e1349494b7119c2c97f4fd9a92f89d709df95d5de2a12137
Opcode Fuzzy Hash: 651eb50c6c71ab8e7efe9e2b07ad15a29b9c3889e99ebce97fe8aef138a1b0ed
Instruction Fuzzy Hash: BC21F5B1504200DFCB18DF14E5C4B16BB65FB84734F20C569D84A4B25AC336D847DA61

Function 00F3D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1972101526.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f3d000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4aa16b31d7653e9c761bb92d50922c0f6bd1fbe2463d511fd6857de2ae0b683
Instruction ID: 437544e1a76286c47c7034fc79f19344b6cc6d7ec93ebd85d0783ff2431734ca
Opcode Fuzzy Hash: d4aa16b31d7653e9c761bb92d50922c0f6bd1fbe2463d511fd6857de2ae0b683
Instruction Fuzzy Hash: 192180755093808FCB06CF24D994715BF71EB46324F28C5EAD8498F2A7C33A980ADB62

Function 00D1D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1971926306.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d1d000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: a7c7e23eecc2e78060e2c8d82c1b25ad5c19f8d9f77cc12cd167fabf05f0dcca
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: A2112672504240DFCB16CF00D5C4B56BF72FB94324F28C6A9DC090B256C33AE85ACBA1

Function 00F3D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1972101526.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f3d000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 996be3665a5de8b36d41f48cdb1adbbff3b48ad0309448b7e336a27446082e41
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 8C11BB75904280DFCB06CF10D9C4B16BBA1FB84324F24C6AAD8494B296C33AD80ADB61

Function 00D1D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1971926306.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d1d000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83288d38a4b32ffbd94db1a0ae5c22f0c9b4a54491040d5ec4cb469c38bb8c3
Instruction ID: 89acf373fd1047bebbf9314820e1f4d26e04ff0716c52b0e0e7ee0423a3a417a
Opcode Fuzzy Hash: d83288d38a4b32ffbd94db1a0ae5c22f0c9b4a54491040d5ec4cb469c38bb8c3
Instruction Fuzzy Hash: FC01A771108340AAE7204A29ED847A7FFD9EF51324F1CC92AED4A4A2C6CB79DC80C671

Function 00D1D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1971926306.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d1d000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b08d5569a9098194a96cfc21f91efe32fec3f8d81d100dde78b3f7e7d44a23
Instruction ID: 1da0af74411d150cfc81f7f017e4dcdf20f4039662f45a641e559e2b2a49087a
Opcode Fuzzy Hash: b7b08d5569a9098194a96cfc21f91efe32fec3f8d81d100dde78b3f7e7d44a23
Instruction Fuzzy Hash: 21F06871408344AEE7208A16DC84762FFE8EF51734F18C45AED094A286C7799C44CA71

Analysis Process: imOLmwQ.exePID: 7636, Parent PID: 7400COMMON

Execution Graph

Execution Coverage:	15.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	3

Executed Functions

Function 01899B40 Relevance: 2.8, Instructions: 2822COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 173b4d18f956c078eaa2d876c9d129372913e961ad340401953885d2c47dd1a0
Instruction ID: d13df004172ac16de8565dda0479c823cd9e2a7321ea8aa95e5ece166320755b
Opcode Fuzzy Hash: 173b4d18f956c078eaa2d876c9d129372913e961ad340401953885d2c47dd1a0
Instruction Fuzzy Hash: 6A530931C10B1A8ACB55EF68C880599F7B1FF99300F55D79AE458BB125FB70AAC4CB81

Function 0189CDC0 Relevance: 2.3, Instructions: 2310COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f13926ddf638ce955a2ed5c0449a8c562fb82f9d2c2126ec801398850c672a
Instruction ID: 49d9f8a52892e7211304c36a6a654b63cda55e56ac1341a22f93f0a161abdd5b
Opcode Fuzzy Hash: 91f13926ddf638ce955a2ed5c0449a8c562fb82f9d2c2126ec801398850c672a
Instruction Fuzzy Hash: 95331E31D10B198EDB15DF68C8846ADF7B1FF99300F15C79AE448A7225EB70AAC5CB81

Function 01893E70 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\VLm, xrefs: 018940BB

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID: \VLm
API String ID: 0-2808160488
Opcode ID: 41f8c4fad666b445804d8a2cca8f78a76f9cbe790b769f68956ace4eae799a31
Instruction ID: bcd5e7f89b0d8f934c3a3566974c28ee480563e0bfd437d22ae8ad33351687c7
Opcode Fuzzy Hash: 41f8c4fad666b445804d8a2cca8f78a76f9cbe790b769f68956ace4eae799a31
Instruction Fuzzy Hash: 00913E70E00209DFDF14CFA9DA8579DBBF2BF88314F188129E415E7254DB749946CB91

Function 01894A88 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f2f198a5850daea0b03ce2a3fa96ccc9a5d79da63d9d74c6aa0245682aa1fa
Instruction ID: b97968c02cc93d7ad2c82455ce5ea191fae66f6c087782743b3e5482547ab85b
Opcode Fuzzy Hash: c5f2f198a5850daea0b03ce2a3fa96ccc9a5d79da63d9d74c6aa0245682aa1fa
Instruction Fuzzy Hash: 8BB14E74E00209CFDF14CFA9CA9179DBBF2AF88314F188529D815E7394EB749946CB81

Function 0189FCD8 Relevance: 2.7, Strings: 2, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(&kq, xrefs: 0189FDF3
(oq, xrefs: 0189FEB2

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID: (&kq$(oq
API String ID: 0-2620321033
Opcode ID: 52cb582723754fbb429a7f356254b7f2242df1d7b3f9ed997d75803e50b87627
Instruction ID: 8e5e8d4781d06f7e3474e6fc94f3007de225d4953605aaef3d5eab8a34629d97
Opcode Fuzzy Hash: 52cb582723754fbb429a7f356254b7f2242df1d7b3f9ed997d75803e50b87627
Instruction Fuzzy Hash: 9F719D31F002199BDB19DFA9C850AAEBBF6AFC8700F148529E505EB384DF34AD41C7A5

Function 018947F4 Relevance: 2.7, Strings: 2, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VLm, xrefs: 018949C2
\VLm, xrefs: 0189486F

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID: \VLm$\VLm
API String ID: 0-1686317364
Opcode ID: 1706ac30e42cb1d2525dd93e52dbff54d858add6fa48fbef97858d4107f73915
Instruction ID: 20720ef57715aaf8c765579eb48ea56b1ba4e40eb2f03bbb7d05014d51c8cad6
Opcode Fuzzy Hash: 1706ac30e42cb1d2525dd93e52dbff54d858add6fa48fbef97858d4107f73915
Instruction Fuzzy Hash: F3714B70E002499FDF10CFA9CA817DEBBF1AF89314F188129E415EB264EB749946CB95

Function 01894800 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VLm, xrefs: 018949C2
\VLm, xrefs: 0189486F

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID: \VLm$\VLm
API String ID: 0-1686317364
Opcode ID: 2a2e1eeb45966bb77992655105ee5a023d5fd5156c152b1e4d1fcd4b783b6add
Instruction ID: fa470bcd5986fca402da06ff390997be0aaf7306c6303e3439ce6a874f30053c
Opcode Fuzzy Hash: 2a2e1eeb45966bb77992655105ee5a023d5fd5156c152b1e4d1fcd4b783b6add
Instruction Fuzzy Hash: E7714D71E002499FDF14CFA9CA807DEBBF2AF88314F188129E415EB254EB749946CB95

Function 01896EC7 Relevance: 2.6, Strings: 2, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRkq, xrefs: 01896F96
LRkq, xrefs: 01896EFE

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID: LRkq$LRkq
API String ID: 0-2882777380
Opcode ID: afd59ae9b21c4445495a7aa2af9c624a1491144a67b821b8112ac25dd925ac37
Instruction ID: 95253a9f5e05ff33f4ebad895aa7a8fb1a607f403577f7db674ff07670218c1c
Opcode Fuzzy Hash: afd59ae9b21c4445495a7aa2af9c624a1491144a67b821b8112ac25dd925ac37
Instruction Fuzzy Hash: 4F519230A102499FDF16DF78C4547AEBBB2EF86300F2484AAE405EB351EB759D46CB51

Function 068BE228 Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.3122275206.00000000068B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68b0000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c3e4e861064d337b170b21cbd4bcd24025a1ab42625960b1d2e5e3213688c3
Instruction ID: bcbcca2aa1044ed4ecb4f63e96ed428718d2757d1fb82db75c02e662c211c117
Opcode Fuzzy Hash: c4c3e4e861064d337b170b21cbd4bcd24025a1ab42625960b1d2e5e3213688c3
Instruction Fuzzy Hash: F4412372D0435A8FCB04DFA9D8146EEBBF5AF89210F15866AD408E7351DB389984CBE1

Function 068BE310 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(8B550214), ref: 068BE377

Memory Dump Source

Source File: 0000000E.00000002.3122275206.00000000068B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68b0000_imOLmwQ.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: dd6ae2e7cbef9cf0462aa57b5366ca79b5487a686fc0d16ae5f96c4582e31ac4
Instruction ID: 578245d630395d74e24a1f97ae16bd397447fa244699423e757819d9c698f3f6
Opcode Fuzzy Hash: dd6ae2e7cbef9cf0462aa57b5366ca79b5487a686fc0d16ae5f96c4582e31ac4
Instruction Fuzzy Hash: C21120B1C002699FCB10CF9AC544BDEFBF8AF48320F10816AE818A7350D378A944CFA5

Function 01893E64 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

\VLm, xrefs: 018940BB

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID: \VLm
API String ID: 0-2808160488
Opcode ID: 8bad13afa123ffb7d6a82746ea02b7a4360ab0606c9af88c7d211701f1fb89d2
Instruction ID: de9e59f8f6962ce081591d6308000a0654c916ce14a213fe16d59115648bea55
Opcode Fuzzy Hash: 8bad13afa123ffb7d6a82746ea02b7a4360ab0606c9af88c7d211701f1fb89d2
Instruction Fuzzy Hash: FA913BB0E00609CFDF10CFA9DA8179DBBF2BF48314F188129E855E7254DB749986CB91

Function 0189F31D Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

PHkq, xrefs: 0189F46B

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 593edfe8aaf479eb1ddcfc92521d145dbfeaa498dda18d1a544d8fc82f9e337a
Instruction ID: d6413b518a639eaecb532cf18d89d0699eec3f697bb29d94c9c7369913aae5dc
Opcode Fuzzy Hash: 593edfe8aaf479eb1ddcfc92521d145dbfeaa498dda18d1a544d8fc82f9e337a
Instruction Fuzzy Hash: C541B130B002058FDF199B38C5946AE7FA6EF89310F288468D506DB395DF39DD46CB91

Function 01896F68 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

LRkq, xrefs: 01896F96

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: d2f1b6b79928b15e36780cb0782e1e87c30fad6926da3a2336cdc2ebbe8a0869
Instruction ID: b5791b9de0d77140e8808910dedb4559f7b2b24d06cab3d681341ae5cb74713d
Opcode Fuzzy Hash: d2f1b6b79928b15e36780cb0782e1e87c30fad6926da3a2336cdc2ebbe8a0869
Instruction Fuzzy Hash: 9D319E34E1030A8FDF25CFA8C54479EB7B2FF85300F248429E505EB250EB75AA81CB50

Function 01896B91 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

LRkq, xrefs: 01896BC7

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: d229555bfbd54b7d64d6eb9135fe282c40a9995cbc35771856c957df9c74d87d
Instruction ID: 679448852ea069f151dca10d979a202f4afaae9f4d1fc6eef2317d70e5456926
Opcode Fuzzy Hash: d229555bfbd54b7d64d6eb9135fe282c40a9995cbc35771856c957df9c74d87d
Instruction Fuzzy Hash: CC11A3307092854FC7126B3884606AEBFB2EF8B310B1488EAD085CB3A2DE355C86C751

Function 01897910 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d380d96b8fc4eb8aa1a533b840f0a4182f79b26177703569bda398b07a7ba1
Instruction ID: f33b0b965c0866d15b71d7881e9956d6bba20dcc87b94207b1dcebc7adc4dbef
Opcode Fuzzy Hash: e6d380d96b8fc4eb8aa1a533b840f0a4182f79b26177703569bda398b07a7ba1
Instruction Fuzzy Hash: A1124D30B503029FCB16AB3CE994669B3A2FBC9355B244939D005DB765CF39EC86CB91

Function 018996E8 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31db3d84c772a0ca3a050678a349eb542bbb387014dbc33373b95a00fd63211
Instruction ID: d8c79399018764464503a464ea91963b1950051c04667604bc5c285ae79b015e
Opcode Fuzzy Hash: b31db3d84c772a0ca3a050678a349eb542bbb387014dbc33373b95a00fd63211
Instruction Fuzzy Hash: BFD1CF70F002058FDF11CF69D8807AEBBB6EB89314F18856AE509EB396DB34D945CB91

Function 0189936C Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f5b2de120b357c14178b72687b8adc04c13111c97685347fdf2568efb4b796
Instruction ID: 76ec2a630fc30abde8146596e88178a48673b0ffe679f551a29bb76daf34d00f
Opcode Fuzzy Hash: 27f5b2de120b357c14178b72687b8adc04c13111c97685347fdf2568efb4b796
Instruction Fuzzy Hash: 1AC16C74E002049FDF15DF68D984AAEBBF2EF89314F188469E906E7355DB349D82CB90

Function 01894A7C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58394bc9f5aa9296d84e429ca6c867d1a55c762816aae2a158ab7cd0bf4cd59
Instruction ID: a6798211ce5bc7972d6892a35be99daafd8cd89b5b2c3fc9d23b63e27f13c6c4
Opcode Fuzzy Hash: d58394bc9f5aa9296d84e429ca6c867d1a55c762816aae2a158ab7cd0bf4cd59
Instruction Fuzzy Hash: F8B13C74E00249CFDF14CFA9CA917DDBBF1AF48314F188129E815EB254EB749986CB81

Function 0189CB38 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7593b724b3c091e84cf8141b759b1dfe40dd415500052fb7b8f8be042042df21
Instruction ID: 5b8f25281e92b05beaaf1a526c867726a4c585ac16dc43e57782ece0bb79b241
Opcode Fuzzy Hash: 7593b724b3c091e84cf8141b759b1dfe40dd415500052fb7b8f8be042042df21
Instruction Fuzzy Hash: FC61B172E101598BDF25CB58C9807BEFBF2EB84310F1D896AD445EB642C336AE44DB90

Function 01896CCD Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c97cd52234cc216796d441f5f8cef66d3e84b5ef1811d321a4c05501c1dbfc4
Instruction ID: 114c6d98839d8355bbad9cee9ffc17f8c0ee48fcd90d2991c51751983752cdda
Opcode Fuzzy Hash: 3c97cd52234cc216796d441f5f8cef66d3e84b5ef1811d321a4c05501c1dbfc4
Instruction Fuzzy Hash: 0E5113B0D002188FDF14CFA9C994B9DBBF1BF48310F288129E819AB355E774A984CF95

Function 01896CD8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b5297175c42ef37b5753b89a1c9126a6bb8b6fa71ed916920d121ed2007e22
Instruction ID: 29d06dd82703b3b0c1962af0db32db6cd8b373d82836bad995ee8432e90cb702
Opcode Fuzzy Hash: 24b5297175c42ef37b5753b89a1c9126a6bb8b6fa71ed916920d121ed2007e22
Instruction Fuzzy Hash: 1251F3B0D002188FDF14CFA9C994B9DBBF1BF48710F288129E819AB355D774A984CF95

Function 0189FCC8 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc81a0ed6cc8d4516fb98ae620e38f75532bd7f47f644892c1b0aa2464a6c8e
Instruction ID: 2993bc1bcbbd2dae6088d64ba44682a4687e2e80b6d9654d02cdb5ce15c78c78
Opcode Fuzzy Hash: 6fc81a0ed6cc8d4516fb98ae620e38f75532bd7f47f644892c1b0aa2464a6c8e
Instruction Fuzzy Hash: 40415371E002199BDF14CFA9C980ADEBBF5BF88700F288129E515F7354DB70AA45CB90

Function 0189112A Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dece5e0ffbae3d8e76833d27abb77961da57890b36e2ffe05fa91c3a7b21bf6
Instruction ID: e732daa2baf0a5257978aa7fd9d7a06a4bd2b4afb2f7a1847dbf08624154f18e
Opcode Fuzzy Hash: 6dece5e0ffbae3d8e76833d27abb77961da57890b36e2ffe05fa91c3a7b21bf6
Instruction Fuzzy Hash: F151D7352552868FDB15DB3CFE80A947F72FB92714304C5A9D0056B23BDA386E89CF81

Function 01891138 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78072d03a476be80b0bc357cf7c17a49672280c9df069546acc7a5fc1f07370
Instruction ID: 8d8eb3de5cc091b7d13c08263ad0b859f72f8e60dfd2ce330a56ed4ccd190dc2
Opcode Fuzzy Hash: c78072d03a476be80b0bc357cf7c17a49672280c9df069546acc7a5fc1f07370
Instruction Fuzzy Hash: CE51B7352552868FDB15DB2CFE80A847F62F792714300C6A9D0056B33ADB786E89DF92

Function 0189F1E0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7600a74825a5b2fdc8ef6cb916bbc730f978ee397eec6cadd3c7a05588319db5
Instruction ID: 50f2a3223357c88dc6486dbad5e3cac3c155d47127972d9bdf17342c09071c5c
Opcode Fuzzy Hash: 7600a74825a5b2fdc8ef6cb916bbc730f978ee397eec6cadd3c7a05588319db5
Instruction Fuzzy Hash: 18315234E102469FCB19CFA9C5946AEBBF2FF89310F148569E906E7350DB70AD82CB50

Function 018926CE Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3dea2ff5cda65256a1852e7c63855a0e01ddccc4dc3c858541e04172c20ccc3
Instruction ID: 30b54f366eb4a2f4359ab6114143ed69a3f9a97ba6996c7164c9bfeb75e89049
Opcode Fuzzy Hash: b3dea2ff5cda65256a1852e7c63855a0e01ddccc4dc3c858541e04172c20ccc3
Instruction Fuzzy Hash: 7941FFB0D00349EFDB10DFA9C584ADEBFB5FF48310F148429E809AB254DB759946CB90

Function 0189F1F0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6364602ecb178e2189ad909829b597c3592c66fb817a1d8221da395462e9a632
Instruction ID: 477f3f1d4af8f370f3f32a5ebd84a1451b19784e61ef58629037753da3db30a1
Opcode Fuzzy Hash: 6364602ecb178e2189ad909829b597c3592c66fb817a1d8221da395462e9a632
Instruction Fuzzy Hash: 6C313034E102099BCF19CFA9D95469EBBF2BF89310F148529E90AE7354DB71AD82CB50

Function 018926D8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bddfdd6717129b28f0d6b84b8c5d0460a415c2f2b4eb081a560c3bb8a9726a
Instruction ID: e7ba2bdea2b70b1b4180524ffc1803fce18a19fad35119c46df7473b0372dfc5
Opcode Fuzzy Hash: b0bddfdd6717129b28f0d6b84b8c5d0460a415c2f2b4eb081a560c3bb8a9726a
Instruction Fuzzy Hash: 9F41CEB0D00349EFDB10DFA9C584ADEBFB5FF48314F148429E819AB254DB75A945CB90

Function 0189925A Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a67bfc3902ad9e5c85cdbe6e787c77dccb0bd51a005ed127bd12a8ef88cd75
Instruction ID: d579bdd949e2c8e13ce0c60a05518f7c6e7220133aa851b2a9421fafe95e2691
Opcode Fuzzy Hash: 74a67bfc3902ad9e5c85cdbe6e787c77dccb0bd51a005ed127bd12a8ef88cd75
Instruction Fuzzy Hash: FD318F30E0024A9BDF05CFA9D59069EFBB6FF89304F148669E809FB251DB709982CB50

Function 01899268 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb89906981c441fdd5ee3185b52ea2e19002456ff8966ee6419c69aec680ba38
Instruction ID: 0bf333ef051cb32dfb69d7ef2a7aab6239d95b255f8aa3cd1bb529ce6a988f91
Opcode Fuzzy Hash: cb89906981c441fdd5ee3185b52ea2e19002456ff8966ee6419c69aec680ba38
Instruction Fuzzy Hash: FA215C34E0020A9BDF15CFA9D58069EF7B6BF89304F148629E819FB255DB709986CB90

Function 0189168F Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e39b514b9f29e75d4de9fcd56f1d1acf8e3b259d57035d154f7242efd119a4
Instruction ID: 49dc4e71e4ab5e4228b002cc47750d683b0f7ec0eb89fa6f6f5517e8cef6358e
Opcode Fuzzy Hash: 50e39b514b9f29e75d4de9fcd56f1d1acf8e3b259d57035d154f7242efd119a4
Instruction Fuzzy Hash: 8A21D6306041025FEF22D73CE98879D3B66EB41720F148961D406CB27ADB38DE858B91

Function 01899159 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa0d658b157af14c7d9ce0d048833922c7fd46f494ed733ccd71ccff89b5efe
Instruction ID: d26c55499523cd5e7a081963b888cb3d8218d1a3377d3db04735004731482d47
Opcode Fuzzy Hash: 6fa0d658b157af14c7d9ce0d048833922c7fd46f494ed733ccd71ccff89b5efe
Instruction Fuzzy Hash: 1D21C470E006059BCF19CFA8C4546EEBBB2BF89314F14856EE815F7351EB709A42CB50

Function 01891868 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6a34e76e568f1756f417ab822f2bc711cbd94934b2da6af5c0d0a74c6d74bf
Instruction ID: c95e73b337cd4b0c71634fcca9b47140747b94b3226dd410c2bcda025c880b1e
Opcode Fuzzy Hash: ff6a34e76e568f1756f417ab822f2bc711cbd94934b2da6af5c0d0a74c6d74bf
Instruction Fuzzy Hash: 68218B307082468FDF25EB78C9597AE77F1AF4A354F5404A8D406EB261DB369E01CB92

Function 01891370 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6519cb96d813eab06edf688507def8bdf1f65093e6ba667cfa70bf3a0a254e
Instruction ID: cf4fc366a0738fea1082c0327ea0a3b1b102bdb170b880e5a811153fc15dd63f
Opcode Fuzzy Hash: 4f6519cb96d813eab06edf688507def8bdf1f65093e6ba667cfa70bf3a0a254e
Instruction Fuzzy Hash: 4021A770A483428BEF32577DD4883687B62E746325F18486AD447CB362DB2DCA45C781

Function 01894F7A Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1dd109b05c1923df3a7019d0840b685a2d03a38f8b99354a0fcd3661a1905a
Instruction ID: a00440c4e5ffe62b27576e3a11d8d3b1c63d3221818ea5c1cfeb9b15032c0029
Opcode Fuzzy Hash: ea1dd109b05c1923df3a7019d0840b685a2d03a38f8b99354a0fcd3661a1905a
Instruction Fuzzy Hash: 2F212630700246CFDF55DB78C958AAD7BF1EF89315B2444A9E406EB361EB369E01CB51

Function 0184D124 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110357411.000000000184D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0184D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_184d000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b482c4dfbbd7d054f30785d27c6ca33463ef66f929e9ee328fd301e402cc6bd
Instruction ID: 1fa546dba82966f6949e08e49692683f48fb19c3db06421c36d61a3de26bf17f
Opcode Fuzzy Hash: 8b482c4dfbbd7d054f30785d27c6ca33463ef66f929e9ee328fd301e402cc6bd
Instruction Fuzzy Hash: 24213471600608DFDB01DF58C9C0B26FBA5FB94318F20C66DEC0A8B352CB3AD546CA61

Function 01899168 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf7a464060fa12643980325382e0f4a310a75bdc7cf6cf765b6761629272ab8
Instruction ID: 97e1f18718014cb1ebad8adf3e2aa7b10921e11331fe58c42bd49fa397e19985
Opcode Fuzzy Hash: 4bf7a464060fa12643980325382e0f4a310a75bdc7cf6cf765b6761629272ab8
Instruction Fuzzy Hash: EB218E70E0060A9BCF19CFA9C95499EB7B6AF89314F14852EE815FB350EB70AA41CB50

Function 01891878 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db514662290a870fcea250894ad1bafcedc9acc0d38a3c1d9c889e4acde5a51
Instruction ID: e92dbcd485b6150dac897bf1762f08809a374bc97c2f1459107c10c1504ea628
Opcode Fuzzy Hash: 2db514662290a870fcea250894ad1bafcedc9acc0d38a3c1d9c889e4acde5a51
Instruction Fuzzy Hash: 1C213C30B0820A8FDF14EB68C9596AE77F5AB89355F5404A8D506FB364DB369E00CB92

Function 018916A0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fadb741fdb0e02d82eb1a79cc3ebd8b14959196fc35fd9b00dede42e06323847
Instruction ID: 43e3d4ecf8f9ec28501e0428997ed41c97ef739ba82a8cdc5eb81242e9b02d6a
Opcode Fuzzy Hash: fadb741fdb0e02d82eb1a79cc3ebd8b14959196fc35fd9b00dede42e06323847
Instruction Fuzzy Hash: 70219334A441025FEF22D73CE988B9D7756E745720F148935D40BD727ADB38DE848B91

Function 01894F88 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3804e7171bb7faf48d1cc3605f1f35459d9dffecb0f69763bf05065cdf2cffb
Instruction ID: 72a5dc78df4a5f2ad2185afd1be7e06673eed5ceb4f0850ec2a5a9f061985ed9
Opcode Fuzzy Hash: f3804e7171bb7faf48d1cc3605f1f35459d9dffecb0f69763bf05065cdf2cffb
Instruction Fuzzy Hash: D4211634700205CFDF24DB78C958AAE7BF1EF89355B1444A9E406EB3A5DB369E01CB91

Function 0189FEB8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4089f852eeed921d94fbb46bec86a55f81a1e97469ef3c8934575c8c8eba1856
Instruction ID: 62cf62711cf527917fb683b00cccb392f70d4ae0e7518643df34c6f8cf93d64d
Opcode Fuzzy Hash: 4089f852eeed921d94fbb46bec86a55f81a1e97469ef3c8934575c8c8eba1856
Instruction Fuzzy Hash: 6911E632B483545FCB066FBC581066F3FA7EFC5250B544469E509DB392DE348D1183A5

Function 01890838 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5ea42797d332411325e0f6c01e159f7332b10df0151213601224e6bc2ff794
Instruction ID: 6b5c8a4c94ca7d251440c3b60bda072ff8ba16390d7f49bc3486da82d9c0400c
Opcode Fuzzy Hash: 9f5ea42797d332411325e0f6c01e159f7332b10df0151213601224e6bc2ff794
Instruction Fuzzy Hash: F4119430B053049BEF22567C8C5037A7759EB42319F28497AF506EF343DA65CE858BD1

Function 01891478 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef5fceef573bb4cbb1f862fd55711f536dcd513e3347d9c5f6c0e8d0fcb8908
Instruction ID: 16fb6c2ddf655c877f93e7e5935eb1e53eb881599383ac1c9e3297d7b5809a84
Opcode Fuzzy Hash: 3ef5fceef573bb4cbb1f862fd55711f536dcd513e3347d9c5f6c0e8d0fcb8908
Instruction Fuzzy Hash: 5E119432E052568FCF529FBC84941ED7FF5AF5A360B2C00B9E845EB242D631CA42CB91

Function 01890848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3166415493a68cd014add3ab679cefd52e155d92f94986b336bda990b9c170e
Instruction ID: 1b5ad9e171023cab2b26e7c7ccea781f0dcbd16986788689a92ff60185ef53fb
Opcode Fuzzy Hash: a3166415493a68cd014add3ab679cefd52e155d92f94986b336bda990b9c170e
Instruction Fuzzy Hash: D311A030B002089BEF659A7CCC4477E739AEB45315F288979F506EF352DA65CE858BC1

Function 018917B2 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b0126fb03d0ee525534b8ffffb46de765ef272ffadfb7bc5bd57d19101e2e3
Instruction ID: 05d1c556690eb22b500683342a781e1041d772190167cb895a25fe436c3b188a
Opcode Fuzzy Hash: a3b0126fb03d0ee525534b8ffffb46de765ef272ffadfb7bc5bd57d19101e2e3
Instruction Fuzzy Hash: 9011CA75F003525FDF119B7854496AEBFF5FF88260F1484A5E946E7315EA388901CB81

Function 0184D11F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110357411.000000000184D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0184D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_184d000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: dc4d0dfdbd4be388f51b1b5016aee96c44a07f56c44cf8adf2e19816352f9694
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 8B11A9755046848FDB02CF58C9C4B15FBA2FB84314F24C6AADC498B652C33AD44ACB61

Function 01891488 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1806193088c32ca870d0e470ef0f069fec7d160dffa49f3912f0b0f39f9cead5
Instruction ID: a6220f3f5687520786c3ca88055daa26d153e6d0ddc54d86c3a6e4d2b8cd038e
Opcode Fuzzy Hash: 1806193088c32ca870d0e470ef0f069fec7d160dffa49f3912f0b0f39f9cead5
Instruction Fuzzy Hash: B2018432E002168FCF21EFBC84441AD7BF9EF59361F190479E806E7341E631DA428B91

Function 01899890 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30af352ac4ab63836504169e24bfe8fe0ce9cec3d3054c3058de3ebbaf75c69
Instruction ID: d486384decb59ea957dc32fcc7fd3f81e802d094a3b7b6f2a98b7e07e8107347
Opcode Fuzzy Hash: d30af352ac4ab63836504169e24bfe8fe0ce9cec3d3054c3058de3ebbaf75c69
Instruction Fuzzy Hash: CF11C230A002454FDB11DF68D98468ABFB1EF81310F18C2A9C8489F29AD7749D4ACBA0

Function 018980F8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8490b7a92dd82c3ab101e95c0c59a7072ef0f29a90b3b290ca142aaaf1d3b3ea
Instruction ID: 0269069b670d7e85c4dd9111aab3846e732f40d26c4a4dcbe57ca50ae0fd7147
Opcode Fuzzy Hash: 8490b7a92dd82c3ab101e95c0c59a7072ef0f29a90b3b290ca142aaaf1d3b3ea
Instruction Fuzzy Hash: F00171709401499FDB01EFB8EA915DDFF72EB41700B4086A9C445AB265EF31AE498B94

Function 01897080 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c074be7165f6c7543baca210735cff9268bde1d1539139af870d0a80462ea4a1
Instruction ID: f0f3f5fe91084368684ea9e9889eb8f5d5662baa86804204554248ebc8ef8072
Opcode Fuzzy Hash: c074be7165f6c7543baca210735cff9268bde1d1539139af870d0a80462ea4a1
Instruction Fuzzy Hash: D901D639B40204CFDB14DB64D558B6837B2FB89315F1444A8E506DB2B4DB35AE52CF40

Function 01891514 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0fc61e824a112d275d7c509f1bdbcc5f4d316647be91f3260b8ffc75392340
Instruction ID: 230684befc90f7b1ed513bc75fd487b9ae804eb756aa99e08a0151923cf8dab9
Opcode Fuzzy Hash: 8f0fc61e824a112d275d7c509f1bdbcc5f4d316647be91f3260b8ffc75392340
Instruction Fuzzy Hash: 27F0F637A08252CBDF218BAC94941ACBFA1EE6933175D00D7E806DB251D334DB42C751

Function 01898108 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc4fc9d20a18fda02305930a3f74f8ddcb0f568ed930ea4138ba12ec991df4b
Instruction ID: 1e11a960e222fdee87afa561e75151093cc6b8169c6f2e163a1e079eeab82894
Opcode Fuzzy Hash: 7dc4fc9d20a18fda02305930a3f74f8ddcb0f568ed930ea4138ba12ec991df4b
Instruction Fuzzy Hash: D6F0E170950109AFDB00EFB8FA5169DFBB2EB40700F5086B8C405BB274EF35AE458B95

Function 0189FF88 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3110738188.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1890000_imOLmwQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3860101f18144dd2961b4d08fbbd2f53998d3ec2e4e2e755c7f455da82ebe9
Instruction ID: bc89bafe95435e06feec79aee5523d20b67e86bfc7accafac2d8457a7b9f4d16
Opcode Fuzzy Hash: 6d3860101f18144dd2961b4d08fbbd2f53998d3ec2e4e2e755c7f455da82ebe9
Instruction Fuzzy Hash: 87C0127664442057D3140B8DB524697B7F4F7C9B66B08463FF90A83600CB3009528B80

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Musterino_94372478_Ekno_101_20241031410530_ekstre.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\imOLmwQ.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ch1oaio5.lfz.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e1cxgnta.5cv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nhkmyns0.yha.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojvm21lv.zha.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_shqmdqcf.q2f.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txnvzvxd.ugh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yth3knwj.lbs.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zzrgfmu0.exq.ps1

C:\Users\user\AppData\Local\Temp\tmp7551.tmp

C:\Users\user\AppData\Local\Temp\tmp8BD7.tmp

C:\Users\user\AppData\Roaming\imOLmwQ.exe

Windows Analysis Report
Musterino_94372478_Ekno_101_20241031410530_ekstre.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre