Edit tour

Windows Analysis Report
PO] G_24370-24396_SI2_S25_8658.exe

Overview

General Information

Sample name:	PO] G_24370-24396_SI2_S25_8658.exe
Analysis ID:	1559143
MD5:	adc8d552e00251dbbdcd0aafe5bd3739
SHA1:	bdccf1531860ea4e5c139864707332252ca6d62b
SHA256:	0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64_ra

PO] G_24370-24396_SI2_S25_8658.exe (PID: 7060 cmdline: "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe" MD5: ADC8D552E00251DBBDCD0AAFE5BD3739)

powershell.exe (PID: 6292 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6240 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 2676 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 2864 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PO] G_24370-24396_SI2_S25_8658.exe (PID: 6524 cmdline: "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe" MD5: ADC8D552E00251DBBDCD0AAFE5BD3739)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.2477991883.000000000342E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2477991883.00000000033E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2477991883.00000000033E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 7060	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 7060	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 7060	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 6524	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 6524	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3173d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31859:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31935:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a5b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3173d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31859:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31935:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a5b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dceb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dde7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de79:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6dee3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df55:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6dfeb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e07b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa870b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa877d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8807:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8899:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8903:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8975:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a0b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe", ParentImage: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe, ParentProcessId: 7060, ParentProcessName: PO] G_24370-24396_SI2_S25_8658.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe", ProcessId: 6292, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe, Initiated: true, ProcessId: 6524, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe", ParentImage: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe, ParentProcessId: 7060, ParentProcessName: PO] G_24370-24396_SI2_S25_8658.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp", ProcessId: 2864, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe", ParentImage: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe, ParentProcessId: 7060, ParentProcessName: PO] G_24370-24396_SI2_S25_8658.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe", ProcessId: 6292, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe", ParentImage: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe, ParentProcessId: 7060, ParentProcessName: PO] G_24370-24396_SI2_S25_8658.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp", ProcessId: 2864, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PO] G_24370-24396_SI2_S25_8658.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe

Avira: detection malicious, Label: HEUR/AGEN.1306899

Found malware configuration

Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: PO] G_24370-24396_SI2_S25_8658.exe

Joe Sandbox ML: detected

Source: PO] G_24370-24396_SI2_S25_8658.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PO] G_24370-24396_SI2_S25_8658.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 4x nop then jmp 07CABD16h		0_2_07CAB5E9
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 4x nop then jmp 07CABD16h		0_2_07CAB69E

Source: Joe Sandbox View

IP Address: 46.175.148.58 46.175.148.58

Source: global traffic

TCP traffic: 192.168.2.16:49705 -> 46.175.148.58:25

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.iaa-airferight.com

Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000008.00000002.2477991883.0000000003438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1273906340.00000000032CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp, PO] G_24370-24396_SI2_S25_8658.exe, 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, SKTzxzsJw.cs	.Net Code: sf6jJs8S
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack, SKTzxzsJw.cs	.Net Code: sf6jJs8S

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_018BD51C	0_2_018BD51C
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA2320	0_2_07CA2320
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CACF19	0_2_07CACF19
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA57B8	0_2_07CA57B8
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA5380	0_2_07CA5380
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA72C8	0_2_07CA72C8
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA6028	0_2_07CA6028
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA6027	0_2_07CA6027
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA5BE9	0_2_07CA5BE9
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA5BF0	0_2_07CA5BF0
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 8_2_01A6D0F8	8_2_01A6D0F8
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 8_2_01A6B010	8_2_01A6B010
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 8_2_01A6A3F8	8_2_01A6A3F8
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 8_2_01A6A740	8_2_01A6A740
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 8_2_06972130	8_2_06972130
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 8_2_06973078	8_2_06973078
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 8_2_069754B8	8_2_069754B8

Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1276526253.0000000005B00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1278253591.0000000007FA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1273906340.00000000032CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277724023.0000000007BB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamejaUa.exe6 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1272577083.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1274541036.00000000044D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000000.1225431580.0000000000DF8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamejaUa.exe6 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000008.00000002.2476084613.00000000014F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PO] G_24370-24396_SI2_S25_8658.exe
Source: PO] G_24370-24396_SI2_S25_8658.exe	Binary or memory string: OriginalFilenamejaUa.exe6 vs PO] G_24370-24396_SI2_S25_8658.exe

Source: PO] G_24370-24396_SI2_S25_8658.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: PO] G_24370-24396_SI2_S25_8658.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: VxQjXFYhdkY.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, MVfNXuELv1PY47s9c1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, MVfNXuELv1PY47s9c1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@13/12@1/1

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

File created: C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe

Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6300:120:WilError_03
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Mutant created: \Sessions\1\BaseNamedObjects\OvgQqnLtifSbE

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

File created: C:\Users\user\AppData\Local\Temp\tmpE291.tmp

Jump to behavior

Source: PO] G_24370-24396_SI2_S25_8658.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO] G_24370-24396_SI2_S25_8658.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

File read: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: PO] G_24370-24396_SI2_S25_8658.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO] G_24370-24396_SI2_S25_8658.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs	.Net Code: D1DV1tIN8q System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs	.Net Code: D1DV1tIN8q System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA4783 push es; retf	0_2_07CA4792
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA4774 push es; retf	0_2_07CA4782
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA5368 push ecx; retf 0007h	0_2_07CA536A
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA5282 push es; retf	0_2_07CA5283
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA50C4 push es; retf	0_2_07CA50C5
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA508A push es; retf	0_2_07CA508C
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA509B push es; retf	0_2_07CA50A2
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA5091 push es; retf	0_2_07CA5092
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA50A7 push es; retf	0_2_07CA50A8
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA4F84 push es; retf	0_2_07CA4F8D
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA4F38 push es; retf	0_2_07CA4F39
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA4E33 push es; retf	0_2_07CA4E34
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA4CCB push es; retf	0_2_07CA4CCD
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA4CD2 push es; retf	0_2_07CA4CD3
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA4CFF push es; retf	0_2_07CA4D00
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 0_2_07CA48E3 push cs; retf	0_2_07CA48F2
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 8_2_01A6BFE8 push esp; ret	8_2_01A6BFFD
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 8_2_0697ECB0 push es; ret	8_2_0697ECC0
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Code function: 8_2_06977102 push es; ret	8_2_06977110

Source: PO] G_24370-24396_SI2_S25_8658.exe	Static PE information: section name: .text entropy: 7.933918976784444
Source: VxQjXFYhdkY.exe.0.dr	Static PE information: section name: .text entropy: 7.933918976784444

Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, vtch46YO90XtOrUTp9.cs	High entropy of concatenated method names: 'l2qmXtvHfV', 'JxOmOVUmWn', 'UgLmjGJHWY', 'hHpmGf2Dgr', 'PCFmWhVOZO', 'YcImw3KJ11', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, d77XqbcqvedpqQSLRG.cs	High entropy of concatenated method names: 'o3CjonacIU', 'EYTjpSflXD', 'HUDj1Q5tg7', 'hVEjh89L7w', 'zWEjL84VmL', 'IstjK62vxE', 'R9njuWXLHW', 'hE2j3iA6rW', 'cGpuhpkdfDXbeohtfBv', 'KiyEqOkDY1S8dEGVp8U'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, i8TCGSzhIFNXFrCaNb.cs	High entropy of concatenated method names: 'I3gmLX4Iu7', 'Kx8mEZCHok', 'bHgmuANhHv', 'LMkmRnbXPX', 'QhjmUQdsEc', 'wAJmcOQSPM', 'GlQmvx1yRt', 'WZ5moWX6yG', 'bo4mpJNXWW', 'BjPmyhnvPG'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, BVJ8we3yZQ2puFy4KA.cs	High entropy of concatenated method names: 'LR7OAgRJMQ', 'E4uOKsdhwB', 'xMfXF6hhqP', 'bNVXcujqKB', 'y51XvBGgd8', 'rGOXauVi5Y', 'AP9Xf0toTt', 'IUCX9xI4bB', 'MfUXMWPyrA', 'BWZX6R8f2x'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, xi93dHxsxDMH8omRsiw.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'GchmBd2OYj', 'DfFmbFcQCt', 'm0Tm4T8Maa', 'wHomISaRPc', 'zY0mrPLfnI', 'tYomNbXQMg', 'yuKmSfoDfs'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, hCgUrr0eFkI5XY0P4W.cs	High entropy of concatenated method names: 'GtfWkICWTb', 'KbaWQsQ1WL', 'bKOWWyIr2V', 'bHqWiuKl20', 'GjQWgQxmVm', 'sgJWoH2lKj', 'Dispose', 'gFBlnoE5lJ', 'lWQlqlc2Ym', 'KZKlXkO7gQ'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, qhJWnR4EwQykKKej0S.cs	High entropy of concatenated method names: 'HDDJEG1Qqf', 'dxmJuVbn9l', 'vPkJR0D1vH', 'LN2JUNSBER', 'tdtJcyWOgh', 'TtMJvj6EYF', 'ddMJfHLlx2', 'udWJ9EJniF', 'Q1jJ6YUiyc', 'KvUJBA3Sqk'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, blHjFhtXDjatYEddY4.cs	High entropy of concatenated method names: 'QmGWRmraH3', 'miaWUxh4iv', 'C3TWFqqF6B', 'XhJWcJ20eD', 'OMVWvhusjo', 'J93WaUgD9H', 'U8JWfhWmsn', 'Lj7W9tx4BR', 'FYDWMCn4j0', 'M4yW6RT8fx'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, lE3xLExx4yRHP8Gjl8O.cs	High entropy of concatenated method names: 'B2smYDNg1A', 'YtZmz1PNCJ', 'QLrisJeZCw', 'B3Jix5sZZ3', 'Y6nidej2W2', 'w8JiH8UMDi', 'qG6iVgdNyi', 'FHriPXxnp6', 'k0sin8dKcc', 'X3biq9D7tq'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, PYuXog2XHWZlDMdMZy.cs	High entropy of concatenated method names: 'G5MQeJ0Ob7', 'PEEQYEUKYb', 'of4lsFanGg', 'dfNlxH9RbC', 'S58QB3w1jB', 'pBuQbywOwv', 'SCUQ43UfhK', 'hK2QI4uOv9', 'WsjQrhOZyT', 'MXaQNmorXB'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, WUyltgI5o6ZgK2WP1H.cs	High entropy of concatenated method names: 'bCQk6M31ke', 'vUkkb9G1H3', 'YcfkIvqPJc', 'fi2krwVuEH', 'vjWkUH3Drb', 'sjrkFKIxtJ', 'phFkcwEDEs', 'McdkvnqgW2', 'f08kaBGGF8', 'VCTkf9PuqD'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, MVfNXuELv1PY47s9c1.cs	High entropy of concatenated method names: 'xw9qI6KflP', 'jIsqrUgrmu', 'svXqNoGA0m', 'P25qSlo5hZ', 'uBUq7yQ6cQ', 'XHJq20tKwH', 'tPVq0QBg6H', 'Amyqe1e9Sd', 'W6Rqt2gKIm', 'PIvqYVN2vO'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs	High entropy of concatenated method names: 'VkAHPjx3Ue', 'Hm9HnOWjZL', 'lHaHqeknC5', 'LfwHXNk6Xx', 'xLoHOQiBDx', 'dU0HjcMSAf', 'tUlHGdbiwT', 'WFgHwJxAn5', 'o6pHZoO5nc', 'xhSHTjpRNG'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, eQFYfaRl2B3Rg6Kqil.cs	High entropy of concatenated method names: 'TL6jPs59Fh', 'amajq6huXG', 'wRGjOmWsQt', 'GT5jGZGaro', 'og1jwxHyeV', 'KKOO7tg1Ki', 'VCXO2MjQha', 'uTyO02HDUO', 'EfpOepLVrK', 'YN1OtKGM3I'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, gv9lp2f3vfoYOKUnw4.cs	High entropy of concatenated method names: 'QrEGnYHB03', 'd53GXFy96i', 'RhGGjLpxwl', 'MeOjYXfZUO', 'n9GjzU0GoM', 'MsEGsFLXd0', 'chpGxxAOH3', 'mNnGdi1vV4', 'tGSGHMI6n6', 'e77GVFehL1'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, mCEUSLu2HVAxcj9MLj.cs	High entropy of concatenated method names: 'V9BXhBIUbd', 'm0xXLtovpu', 'L7SXE9HGrE', 'pKxXujmZ3w', 'ivOXkw2LuK', 'SGUXDk48dn', 'AxuXQROkph', 'dgXXlbM47C', 'YndXWs1H2W', 'r7cXm2p4jT'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, QHRLEaq8QafEmkxm8E.cs	High entropy of concatenated method names: 'Dispose', 'oI5xtXY0P4', 'msvdU1CFyp', 'v6DTuKI9CU', 'sfdxYBQ2CG', 'sA1xzyjk4R', 'ProcessDialogKey', 'o2ddslHjFh', 'gDjdxatYEd', 'cY4ddgtch4'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, XfhyyuxdptwT9CrFpp3.cs	High entropy of concatenated method names: 'ToString', 'ouPiEGTKM1', 'YyMiuoSdl3', 'LhXi3ewOx4', 'U5ZiR094RB', 'XyCiUZAbhr', 'woSiFn8HcO', 'T5yicwJgU9', 't6sIwkJqc9qMNPagiVR', 'ceatSGJUHyolCxFdX29'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, xJiUvJdSOwk2IKU3P2.cs	High entropy of concatenated method names: 'vgv1gxJ9H', 'HpEhKq0ty', 'mQ8LgeCXV', 'aUNKaL315', 'pKXu3LCAT', 'e8a35MEqS', 'npKUlIpgVyyMVT3pwC', 'g5pKgAfoGnJHdW6Rs2', 'UwylkqEPR', 'oR7m3IsnN'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, We5DyIM5S1d3v5tWUG.cs	High entropy of concatenated method names: 'J6nGp9gbLZ', 'V64GyJTFie', 'cQDG1chDOy', 'HVRGhMZ1w3', 'pE2GASNeXm', 'JvKGLD55dG', 'xnvGKhN9LX', 'oBcGENVCiZ', 'mmmGudObO5', 'OmCG3BCh4R'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, uwGRIvVnaJ1rs3AesQ.cs	High entropy of concatenated method names: 'VpMxGVfNXu', 'Bv1xwPY47s', 'C2HxTVAxcj', 'MMLx8jLVJ8', 'Hy4xkKAPQF', 'YfaxDl2B3R', 'FhagZlCNxMUqcSrPqy', 'qXDoarbT7v1YjOpJNk', 'EjQxx56GKj', 'CyqxHv2bHW'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, y7vHnpXbTQd5M9AyJn.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'giEdtFBhtj', 'Y8rdYvB5gM', 'TTudziAoAL', 'zrhHsAtTML', 'udvHxqkGgx', 'wVHHd5Ub1J', 'PrqHHfoyrK', 'jrqb4m9j6ThpOaxlqDf'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.7fa0000.4.raw.unpack, q7suDPU5dkfR4akZOW.cs	High entropy of concatenated method names: 'it6vAMkLtVLUwPuEJF4', 'yALYx7kS22WuwU4UBNF', 'phsjlaJIeI', 'rGejWaKHgS', 't94jmuPEcm', 'VWGMvIkmmp34uBHUGCT', 'XebBfZkG88kn1H1fkDd'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, vtch46YO90XtOrUTp9.cs	High entropy of concatenated method names: 'l2qmXtvHfV', 'JxOmOVUmWn', 'UgLmjGJHWY', 'hHpmGf2Dgr', 'PCFmWhVOZO', 'YcImw3KJ11', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, d77XqbcqvedpqQSLRG.cs	High entropy of concatenated method names: 'o3CjonacIU', 'EYTjpSflXD', 'HUDj1Q5tg7', 'hVEjh89L7w', 'zWEjL84VmL', 'IstjK62vxE', 'R9njuWXLHW', 'hE2j3iA6rW', 'cGpuhpkdfDXbeohtfBv', 'KiyEqOkDY1S8dEGVp8U'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, i8TCGSzhIFNXFrCaNb.cs	High entropy of concatenated method names: 'I3gmLX4Iu7', 'Kx8mEZCHok', 'bHgmuANhHv', 'LMkmRnbXPX', 'QhjmUQdsEc', 'wAJmcOQSPM', 'GlQmvx1yRt', 'WZ5moWX6yG', 'bo4mpJNXWW', 'BjPmyhnvPG'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, BVJ8we3yZQ2puFy4KA.cs	High entropy of concatenated method names: 'LR7OAgRJMQ', 'E4uOKsdhwB', 'xMfXF6hhqP', 'bNVXcujqKB', 'y51XvBGgd8', 'rGOXauVi5Y', 'AP9Xf0toTt', 'IUCX9xI4bB', 'MfUXMWPyrA', 'BWZX6R8f2x'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, xi93dHxsxDMH8omRsiw.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'GchmBd2OYj', 'DfFmbFcQCt', 'm0Tm4T8Maa', 'wHomISaRPc', 'zY0mrPLfnI', 'tYomNbXQMg', 'yuKmSfoDfs'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, hCgUrr0eFkI5XY0P4W.cs	High entropy of concatenated method names: 'GtfWkICWTb', 'KbaWQsQ1WL', 'bKOWWyIr2V', 'bHqWiuKl20', 'GjQWgQxmVm', 'sgJWoH2lKj', 'Dispose', 'gFBlnoE5lJ', 'lWQlqlc2Ym', 'KZKlXkO7gQ'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, qhJWnR4EwQykKKej0S.cs	High entropy of concatenated method names: 'HDDJEG1Qqf', 'dxmJuVbn9l', 'vPkJR0D1vH', 'LN2JUNSBER', 'tdtJcyWOgh', 'TtMJvj6EYF', 'ddMJfHLlx2', 'udWJ9EJniF', 'Q1jJ6YUiyc', 'KvUJBA3Sqk'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, blHjFhtXDjatYEddY4.cs	High entropy of concatenated method names: 'QmGWRmraH3', 'miaWUxh4iv', 'C3TWFqqF6B', 'XhJWcJ20eD', 'OMVWvhusjo', 'J93WaUgD9H', 'U8JWfhWmsn', 'Lj7W9tx4BR', 'FYDWMCn4j0', 'M4yW6RT8fx'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, lE3xLExx4yRHP8Gjl8O.cs	High entropy of concatenated method names: 'B2smYDNg1A', 'YtZmz1PNCJ', 'QLrisJeZCw', 'B3Jix5sZZ3', 'Y6nidej2W2', 'w8JiH8UMDi', 'qG6iVgdNyi', 'FHriPXxnp6', 'k0sin8dKcc', 'X3biq9D7tq'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, PYuXog2XHWZlDMdMZy.cs	High entropy of concatenated method names: 'G5MQeJ0Ob7', 'PEEQYEUKYb', 'of4lsFanGg', 'dfNlxH9RbC', 'S58QB3w1jB', 'pBuQbywOwv', 'SCUQ43UfhK', 'hK2QI4uOv9', 'WsjQrhOZyT', 'MXaQNmorXB'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, WUyltgI5o6ZgK2WP1H.cs	High entropy of concatenated method names: 'bCQk6M31ke', 'vUkkb9G1H3', 'YcfkIvqPJc', 'fi2krwVuEH', 'vjWkUH3Drb', 'sjrkFKIxtJ', 'phFkcwEDEs', 'McdkvnqgW2', 'f08kaBGGF8', 'VCTkf9PuqD'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, MVfNXuELv1PY47s9c1.cs	High entropy of concatenated method names: 'xw9qI6KflP', 'jIsqrUgrmu', 'svXqNoGA0m', 'P25qSlo5hZ', 'uBUq7yQ6cQ', 'XHJq20tKwH', 'tPVq0QBg6H', 'Amyqe1e9Sd', 'W6Rqt2gKIm', 'PIvqYVN2vO'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, mwp7Eiwcp4pwiQj9Xn.cs	High entropy of concatenated method names: 'VkAHPjx3Ue', 'Hm9HnOWjZL', 'lHaHqeknC5', 'LfwHXNk6Xx', 'xLoHOQiBDx', 'dU0HjcMSAf', 'tUlHGdbiwT', 'WFgHwJxAn5', 'o6pHZoO5nc', 'xhSHTjpRNG'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, eQFYfaRl2B3Rg6Kqil.cs	High entropy of concatenated method names: 'TL6jPs59Fh', 'amajq6huXG', 'wRGjOmWsQt', 'GT5jGZGaro', 'og1jwxHyeV', 'KKOO7tg1Ki', 'VCXO2MjQha', 'uTyO02HDUO', 'EfpOepLVrK', 'YN1OtKGM3I'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, gv9lp2f3vfoYOKUnw4.cs	High entropy of concatenated method names: 'QrEGnYHB03', 'd53GXFy96i', 'RhGGjLpxwl', 'MeOjYXfZUO', 'n9GjzU0GoM', 'MsEGsFLXd0', 'chpGxxAOH3', 'mNnGdi1vV4', 'tGSGHMI6n6', 'e77GVFehL1'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, mCEUSLu2HVAxcj9MLj.cs	High entropy of concatenated method names: 'V9BXhBIUbd', 'm0xXLtovpu', 'L7SXE9HGrE', 'pKxXujmZ3w', 'ivOXkw2LuK', 'SGUXDk48dn', 'AxuXQROkph', 'dgXXlbM47C', 'YndXWs1H2W', 'r7cXm2p4jT'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, QHRLEaq8QafEmkxm8E.cs	High entropy of concatenated method names: 'Dispose', 'oI5xtXY0P4', 'msvdU1CFyp', 'v6DTuKI9CU', 'sfdxYBQ2CG', 'sA1xzyjk4R', 'ProcessDialogKey', 'o2ddslHjFh', 'gDjdxatYEd', 'cY4ddgtch4'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, XfhyyuxdptwT9CrFpp3.cs	High entropy of concatenated method names: 'ToString', 'ouPiEGTKM1', 'YyMiuoSdl3', 'LhXi3ewOx4', 'U5ZiR094RB', 'XyCiUZAbhr', 'woSiFn8HcO', 'T5yicwJgU9', 't6sIwkJqc9qMNPagiVR', 'ceatSGJUHyolCxFdX29'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, xJiUvJdSOwk2IKU3P2.cs	High entropy of concatenated method names: 'vgv1gxJ9H', 'HpEhKq0ty', 'mQ8LgeCXV', 'aUNKaL315', 'pKXu3LCAT', 'e8a35MEqS', 'npKUlIpgVyyMVT3pwC', 'g5pKgAfoGnJHdW6Rs2', 'UwylkqEPR', 'oR7m3IsnN'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, We5DyIM5S1d3v5tWUG.cs	High entropy of concatenated method names: 'J6nGp9gbLZ', 'V64GyJTFie', 'cQDG1chDOy', 'HVRGhMZ1w3', 'pE2GASNeXm', 'JvKGLD55dG', 'xnvGKhN9LX', 'oBcGENVCiZ', 'mmmGudObO5', 'OmCG3BCh4R'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, uwGRIvVnaJ1rs3AesQ.cs	High entropy of concatenated method names: 'VpMxGVfNXu', 'Bv1xwPY47s', 'C2HxTVAxcj', 'MMLx8jLVJ8', 'Hy4xkKAPQF', 'YfaxDl2B3R', 'FhagZlCNxMUqcSrPqy', 'qXDoarbT7v1YjOpJNk', 'EjQxx56GKj', 'CyqxHv2bHW'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, y7vHnpXbTQd5M9AyJn.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'giEdtFBhtj', 'Y8rdYvB5gM', 'TTudziAoAL', 'zrhHsAtTML', 'udvHxqkGgx', 'wVHHd5Ub1J', 'PrqHHfoyrK', 'jrqb4m9j6ThpOaxlqDf'
Source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4509a28.0.raw.unpack, q7suDPU5dkfR4akZOW.cs	High entropy of concatenated method names: 'it6vAMkLtVLUwPuEJF4', 'yALYx7kS22WuwU4UBNF', 'phsjlaJIeI', 'rGejWaKHgS', 't94jmuPEcm', 'VWGMvIkmmp34uBHUGCT', 'XebBfZkG88kn1H1fkDd'

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

File created: C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp"

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (129).png

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 7060, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Memory allocated: 18B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Memory allocated: 3270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Memory allocated: 5270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Memory allocated: 8120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Memory allocated: 9120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Memory allocated: 92D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Memory allocated: A2D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Memory allocated: 1A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Memory allocated: 33E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Memory allocated: 3320000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5877	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3643	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5431	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4097	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Window / User API: threadDelayed 9776	Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 7084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3972	Thread sleep count: 5877 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3972	Thread sleep count: 3643 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6604	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6588	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 5452	Thread sleep count: 90 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -99889s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 5452	Thread sleep count: 9776 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -99777s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -99665s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -99554s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -99442s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -99314s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -99186s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -99076s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -98964s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -98853s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -98741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -98629s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -98501s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -98373s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -98261s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -98150s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -98039s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -97927s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -97799s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -97671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -97559s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -97447s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -97335s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -97223s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -97095s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -96967s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -96857s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -96745s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -96633s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -96521s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -96393s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -96265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -96153s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -96041s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -95929s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -95817s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -95689s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -95561s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -95449s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -95338s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -95226s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -95114s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -94986s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -94858s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -94746s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -94634s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -94522s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -94410s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe TID: 2760	Thread sleep time: -94282s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 99889	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 99777	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 99665	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 99554	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 99442	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 99314	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 99186	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 99076	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 98964	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 98853	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 98741	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 98629	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 98501	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 98373	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 98261	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 98150	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 98039	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 97927	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 97799	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 97671	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 97559	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 97447	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 97335	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 97223	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 97095	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 96967	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 96857	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 96745	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 96633	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 96521	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 96393	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 96265	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 96153	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 96041	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 95929	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 95817	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 95689	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 95561	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 95449	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 95338	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 95226	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 95114	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 94986	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 94858	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 94746	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 94634	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 94522	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 94410	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Thread delayed: delay time: 94282	Jump to behavior

Source: PO] G_24370-24396_SI2_S25_8658.exe, 00000008.00000002.2476600579.0000000001759000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe"
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

Memory written: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Process created: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\userbrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\userbrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\userbrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\userbriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\userFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\userFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\userFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\userST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\userSTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\userSTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\userSTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.3031.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.3031.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2477991883.000000000342E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2477991883.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 6524, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2477991883.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 6524, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 8.2.PO] G_24370-24396_SI2_S25_8658.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.433d278.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO] G_24370-24396_SI2_S25_8658.exe.4302858.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2477991883.000000000342E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2477991883.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO] G_24370-24396_SI2_S25_8658.exe PID: 6524, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	11 Masquerading	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	1 Credentials in Registry	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO] G_24370-24396_SI2_S25_8658.exe	100%	Avira	HEUR/AGEN.1306899
PO] G_24370-24396_SI2_S25_8658.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe	100%	Avira	HEUR/AGEN.1306899
C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.iaa-airferight.com	46.175.148.58	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.apache.org/licenses/LICENSE-2.0	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designersG	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/?	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
https://account.dyn.com/	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp, PO] G_24370-24396_SI2_S25_8658.exe, 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers?	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mail.iaa-airferight.com	PO] G_24370-24396_SI2_S25_8658.exe, 00000008.00000002.2477991883.0000000003438000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.tiro.com	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.goodfont.co.kr	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.carterandcone.coml	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.typography.netD	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/cabarga.htmlN	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/staff/dennis.htm	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://fontfabrik.com	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/frere-jones.html	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.jiyu-kobo.co.jp/	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers8	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fonts.com	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sandoll.co.kr	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.zhongyicts.com.cn	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1273906340.00000000032CB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sakkal.com	PO] G_24370-24396_SI2_S25_8658.exe, 00000000.00000002.1277053062.0000000007682000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559143
Start date and time:	2024-11-20 08:08:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO] G_24370-24396_SI2_S25_8658.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@13/12@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 38 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: PO] G_24370-24396_SI2_S25_8658.exe

Simulations

Behavior and APIs

Time	Type	Description
02:09:03	API Interceptor	183x Sleep call for process: PO] G_24370-24396_SI2_S25_8658.exe modified
02:09:06	API Interceptor	27x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
46.175.148.58	[PO SHEET]PO24S1458(SEQ 2).exe	Get hash	malicious	AgentTesla	Browse
	New Tooling CT240230231CTA240714.exe	Get hash	malicious	AgentTesla	Browse
	New Tooling CT240230231CTA240714.exe	Get hash	malicious	AgentTesla	Browse
	new order PO 4535005948.exe	Get hash	malicious	AgentTesla	Browse
	Purchase order.exe	Get hash	malicious	AgentTesla	Browse
	Purchase Order November 2024.exe	Get hash	malicious	AgentTesla	Browse
	PO. WW-1580 (DPEBO1-2SDC S25- Nov.exe	Get hash	malicious	AgentTesla	Browse
	z14PO31634724MIA0066-0067.exe	Get hash	malicious	AgentTesla	Browse
	new order - PO 351081.exe	Get hash	malicious	AgentTesla	Browse
	Bill_Of _Lading.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	[PO SHEET]PO24S1458(SEQ 2).exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	New Tooling CT240230231CTA240714.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	New Tooling CT240230231CTA240714.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	new order PO 4535005948.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Purchase Order November 2024.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO. WW-1580 (DPEBO1-2SDC S25- Nov.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	z14PO31634724MIA0066-0067.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	new order - PO 351081.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Bill_Of _Lading.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLAGIDKOM-NETUA	[PO SHEET]PO24S1458(SEQ 2).exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	New Tooling CT240230231CTA240714.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	New Tooling CT240230231CTA240714.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	new order PO 4535005948.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Purchase Order November 2024.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO. WW-1580 (DPEBO1-2SDC S25- Nov.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	1730880367d56600a7d0ea47c56ed9b8d8deeddf01b8ca4755058c0ee09aab2d2be61d6702838.dat-decoded.exe	Get hash	malicious	PureLog Stealer	Browse	46.175.146.21
	z14PO31634724MIA0066-0067.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	new order - PO 351081.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	22364
Entropy (8bit):	5.6123920819467665
Encrypted:	false
SSDEEP:	384:FKz31JofKdJ2b5LsBMiXJC7Gg7eskzD1vMNWQwiaVjJwBCP9qpZ8mGtn8eeN:wESdwbxsyiXUB7e9GNvfaNJj9mZpGt8l
MD5:	35D8580F29299A44B4AE446AB9A05829
SHA1:	25080C6794723CDBDB8D7DCB192E2FA5C571F3E1
SHA-256:	9BFC16362D776C6923A02124308165070839B02391D11336AFC1C10DEFED2B8C
SHA-512:	69ACF16A83D4A5DA09AD8D1CF4FC9ABF4E1357664784BC01B91A7B5F4BB7A29BEE5C0B1B374D5F7F960D3EA6023E2E4DEAA21F439E6AB1B2ECB685E393286BB5
Malicious:	false
Reputation:	low
Preview:	@...e.....................w.B.8...../.c..............@..........H...............o..b~.D.poM...Q..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation4...............<."..Ke@...j..........System.Core.0.................Vn.F..kLsw..........System..4.................%...K... ...........System.Xml..L.................gQ?O.....x5.\|.....#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4..................~..2K..}...0".......System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3uf0lb2g.usv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5k2ngf05.xz2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bruopfhl.co2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dbt3um3i.nf4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gukgzo5h.elo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2haumev.525.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sjpy1ipl.oq0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vleerk1f.2ou.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpE291.tmp

Download File

Process:	C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1570
Entropy (8bit):	5.1118023477738115
Encrypted:	false
SSDEEP:	24:2di4+S2qhL1Ly1mYUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt2xvn:cgeLwYrFdOFzOzN33ODOiDdKrsuT6v
MD5:	B89F427DCB6537E5BD7B0D14C0A4EF84
SHA1:	28399349106FF4C573F328E0F17D111CCFDD1D37
SHA-256:	1EB1DF17134763CF06EAC48517729D9F8CF98E114C3AC81F268CA9F3DE8E77D3
SHA-512:	C5EB319C4205E96762B99E6C795598A50D6E0E8CE3EA267F61B3B3B0303EEFE65D8A06F31E851F0E2A394D9B0C61FF2766A159AEFE4E9BC835CE2F212EE82D21
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe

Download File

Process:	C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	959488
Entropy (8bit):	7.470651221550584
Encrypted:	false
SSDEEP:	12288:drOn+Ri3AgFdmcdsjDbxl7qu4Q0eAxpqz4A501t5z7clqO65SAvzP0zoP7r9r/+l:pQ3AgNubfqK2pqz4/5Kq3Co1q
MD5:	ADC8D552E00251DBBDCD0AAFE5BD3739
SHA1:	BDCCF1531860EA4E5C139864707332252CA6D62B
SHA-256:	0B06F6A3A4102C27376F21CBCD09D3C0BF5E6CC7E92F9B9A3810FC386AC8184D
SHA-512:	4AB5EEE11AEC80B2894D51F1B666461E779A012E5BB94AC536366520C2E3BD9DBD5FE40685BD522697C1DB94CBB19C7612C16E9FDB855EAA35338512EF62E680
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....1=g..............0..N...T......Nm... ........@.. ....................................`..................................l..O........P........................................................................... ............... ..H............text...TM... ...N.................. ..`.rsrc....P.......R...P..............@..@.reloc..............................@..B................0m......H........6...(...........^..H.............................................(......}.....{....r...p .....o5....{....o7...&....0...........{......o9.....}........&.......................0..t........o.....{.....{....r...p(....o:.......+%.....{.....o....o;.....o......&....X....i2..{.....o<.......&.{....o=..............+..E..........\b......2.{....oA...n.(......}......}.....(....*....0...........{....o......3...%..;.o......{....o.....s......{.......o....,ir5..p..o......+...(...

C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.470651221550584
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PO] G_24370-24396_SI2_S25_8658.exe
File size:	959'488 bytes
MD5:	adc8d552e00251dbbdcd0aafe5bd3739
SHA1:	bdccf1531860ea4e5c139864707332252ca6d62b
SHA256:	0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d
SHA512:	4ab5eee11aec80b2894d51f1b666461e779a012e5bb94ac536366520c2e3bd9dbd5fe40685bd522697c1db94cbb19c7612c16e9fdb855eaa35338512ef62e680
SSDEEP:	12288:drOn+Ri3AgFdmcdsjDbxl7qu4Q0eAxpqz4A501t5z7clqO65SAvzP0zoP7r9r/+l:pQ3AgNubfqK2pqz4/5Kq3Co1q
TLSH:	3B15DFC5E98455A0DC19AB71AA37CD3542237DFDA834952C29CE3E2B3FFB3936025462
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....1=g..............0..N...T......Nm... ........@.. ....................................`................................

File Icon


Icon Hash:	c5a484988c94a04b

Static PE Info

General

Entrypoint:	0x4b6d4e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673D3196 [Wed Nov 20 00:47:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb6cfc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb8000	0x35010	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xee000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb4d54	0xb4e00	78de7e697208fe6e1a5f6496cdc47dd1	False	0.9590937068071873	data	7.933918976784444	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb8000	0x35010	0x35200	c58cf3e5674fa09196f29e43410df31d	False	0.20978400735294117	data	4.45628723918486	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xee000	0xc	0x200	955b90efba5ef4660127dbf0044d3a99	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb8490	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	0.3225609756097561
RT_ICON	0xb8af8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	0.43951612903225806
RT_ICON	0xb8de0	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	0.4016393442622951
RT_ICON	0xb8fc8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	0.4831081081081081
RT_ICON	0xb90f0	0x35e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9907192575406032
RT_ICON	0xbc6d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.4584221748400853
RT_ICON	0xbd578	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.47382671480144406
RT_ICON	0xbde20	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.45564516129032256
RT_ICON	0xbe4e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.3504335260115607
RT_ICON	0xbea50	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.07868508221933042
RT_ICON	0xcf278	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.15114568005045195
RT_ICON	0xd8720	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	0.1543233082706767
RT_ICON	0xdef08	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.175184842883549
RT_ICON	0xe4390	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.15948275862068967
RT_ICON	0xe85b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.24107883817427386
RT_ICON	0xeab60	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.2678236397748593
RT_ICON	0xebc08	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.37459016393442623
RT_ICON	0xec590	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.42819148936170215
RT_GROUP_ICON	0xec9f8	0x102	data	0.5775193798449613
RT_GROUP_ICON	0xecafc	0x14	data	1.05
RT_VERSION	0xecb10	0x314	data	0.43274111675126903
RT_MANIFEST	0xece24	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:09:08.165489912 CET	49705	25	192.168.2.16	46.175.148.58
Nov 20, 2024 08:09:09.166383028 CET	49705	25	192.168.2.16	46.175.148.58
Nov 20, 2024 08:09:11.179394960 CET	49705	25	192.168.2.16	46.175.148.58
Nov 20, 2024 08:09:15.191396952 CET	49705	25	192.168.2.16	46.175.148.58
Nov 20, 2024 08:09:23.199424982 CET	49705	25	192.168.2.16	46.175.148.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:09:08.139853954 CET	59315	53	192.168.2.16	1.1.1.1
Nov 20, 2024 08:09:08.152579069 CET	53	59315	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 08:09:08.139853954 CET	192.168.2.16	1.1.1.1	0x7ada	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 08:09:08.152579069 CET	1.1.1.1	192.168.2.16	0x7ada	No error (0)	mail.iaa-airferight.com		46.175.148.58	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	02:09:02
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"
Imagebase:	0xd40000
File size:	959'488 bytes
MD5 hash:	ADC8D552E00251DBBDCD0AAFE5BD3739
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1274541036.0000000004271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:09:04
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"
Imagebase:	0x2f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:09:04
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:09:04
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe"
Imagebase:	0x2f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:09:04
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:09:04
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VxQjXFYhdkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE291.tmp"
Imagebase:	0x340000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:09:04
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:09:05
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO] G_24370-24396_SI2_S25_8658.exe"
Imagebase:	0xfb0000
File size:	959'488 bytes
MD5 hash:	ADC8D552E00251DBBDCD0AAFE5BD3739
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2477991883.000000000342E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2475525442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2477991883.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2477991883.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	02:09:07
Start date:	20/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6899f0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	162
Total number of Limit Nodes:	11

Executed Functions

Function 07CACF19 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2a8ca631d2c3967756af12f83245a9c791f9df2b4bcaca6a43cb6efdb1b649
Instruction ID: 969a4f30944cc59154eab1949037afa8705415df8de0b5534df1e180e50691e2
Opcode Fuzzy Hash: 3d2a8ca631d2c3967756af12f83245a9c791f9df2b4bcaca6a43cb6efdb1b649
Instruction Fuzzy Hash: 10E1EDB0B01206AFDB29DB79C490BAEB7F6AF89305F10446DD146DB794CB34EA01CB52

Function 07CA2320 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cd5fba65cccfc6268a281f0aec18c236b239c38a220a79bd9b099831979c39
Instruction ID: 5d6ae9a43b3d5158272324ff4092ebd0d58f000b7725f65b3dfb5f6578c81b54
Opcode Fuzzy Hash: c6cd5fba65cccfc6268a281f0aec18c236b239c38a220a79bd9b099831979c39
Instruction Fuzzy Hash: 6C21E3B0D046199BEB18CFABC9557EEFBF6BFC9304F04C46AD409A6254DB7409468FA0

Function 07CAB5E9 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d603613a6453ffbe038677f3768bcd2d5877600cb53af9e77dc62eaf8b4fb2f
Instruction ID: cbb0fd4c687194e26a61fbb8c01cbff6264bfa2a8fae9c5d147f2c497fd6c4fb
Opcode Fuzzy Hash: 7d603613a6453ffbe038677f3768bcd2d5877600cb53af9e77dc62eaf8b4fb2f
Instruction Fuzzy Hash: 77E04FF486E24FEBC701DF26D4805B9BBB8AB0B219F002395C41AA7292D7309C44CB05

Function 07CAB69E Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c950de49daea967cd2f8a5db216e68b0cf170df4212bf9d7ca6314259efd8c6
Instruction ID: f5508053b449749829f331237e18d63d9d0d10babe1e4048bdcba2694c69af33
Opcode Fuzzy Hash: 2c950de49daea967cd2f8a5db216e68b0cf170df4212bf9d7ca6314259efd8c6
Instruction Fuzzy Hash: 3AE0ECF485D249EBD701DF65D8815FDBBB8AB0F309F012195C00AA7252D6309D84CB05

Function 018BCF90 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 018BD01E
GetCurrentThread.KERNEL32 ref: 018BD05B
GetCurrentProcess.KERNEL32 ref: 018BD098
GetCurrentThreadId.KERNEL32 ref: 018BD0F1

Memory Dump Source

Source File: 00000000.00000002.1273520044.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18b0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f92ee1fff7fd2db3d8a4f8348984784a968e6a90a705a93c9c6c53fe9cf6a144
Instruction ID: 1ad680e78fa64663a0e8d21b764a85a4ddfab921458e4d585036e73547ba5d97
Opcode Fuzzy Hash: f92ee1fff7fd2db3d8a4f8348984784a968e6a90a705a93c9c6c53fe9cf6a144
Instruction Fuzzy Hash: 3A51A6B49007499FDB28DFAAD588BDEBBF0FF48304F208559D408A7360D735A985CB66

Function 018BCFA0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 018BD01E
GetCurrentThread.KERNEL32 ref: 018BD05B
GetCurrentProcess.KERNEL32 ref: 018BD098
GetCurrentThreadId.KERNEL32 ref: 018BD0F1

Memory Dump Source

Source File: 00000000.00000002.1273520044.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18b0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ee7560d8e46dc7eb34cd96af114a98b0d6bbbf45d52564d6731e92f805dfe9ae
Instruction ID: 59a2b2b9fbb65197ea025c5b8fa0cd05ff9bd6cdd5fb492fe78a58c0154a2e38
Opcode Fuzzy Hash: ee7560d8e46dc7eb34cd96af114a98b0d6bbbf45d52564d6731e92f805dfe9ae
Instruction Fuzzy Hash: 925195B49007499FDB28DFAAD588BDEBBF0FB48304F208559D408A7360D7359985CB66

Function 07CA7FBD Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07CA81F6

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fcdfcaf0415ce0ad5978579f7e51774b7fe1ab0f235f4cd411d8df46ac0f05a7
Instruction ID: 7d764a7a421a7a43735437f9358def20b82624cddd9c089c19e547aabc8a5f31
Opcode Fuzzy Hash: fcdfcaf0415ce0ad5978579f7e51774b7fe1ab0f235f4cd411d8df46ac0f05a7
Instruction Fuzzy Hash: 0B915DB1D0071A9FEB25CF68C8847EDBBF2BF48315F148169E808A7240DB759A85CF91

Function 07CA7FC0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07CA81F6

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fdef4ce6d9ca44221eefa767ff9a8a5270191719db375321e3cdcd05ae494f9e
Instruction ID: 470d4e88411039538faf02a1b9131610bdb2837c44a48efb72e5ef704ff6222a
Opcode Fuzzy Hash: fdef4ce6d9ca44221eefa767ff9a8a5270191719db375321e3cdcd05ae494f9e
Instruction Fuzzy Hash: 7C915DB1D0071A9FEB25CF68C8807EDBBF2BF44315F148169E808A7240DB759A85CF91

Function 018BAD08 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 018BAF5E

Memory Dump Source

Source File: 00000000.00000002.1273520044.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18b0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4b1fc9677edfd6546bd4f58be940dca92c624c3e40379b2817aa0a8677b587b0
Instruction ID: 4c419197b6a375bcaa012809fba8bc5f0a9af6675c39c7d82e12995f41fb4af5
Opcode Fuzzy Hash: 4b1fc9677edfd6546bd4f58be940dca92c624c3e40379b2817aa0a8677b587b0
Instruction Fuzzy Hash: 31712470A00B058FE729DF29D48479ABBF5FB88304F048A2DD44AD7B50D735EA49CB91

Function 018B58EC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 018B59A9

Memory Dump Source

Source File: 00000000.00000002.1273520044.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18b0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e3a1b937743aa29705fcad1e4f4a3cd16febe1cc265480b28431f81fe1d938a3
Instruction ID: 421f1ec59e7b18b5c8a0a43fb29bcc1a014ca59d512bbd2d2ddc76bac80d524f
Opcode Fuzzy Hash: e3a1b937743aa29705fcad1e4f4a3cd16febe1cc265480b28431f81fe1d938a3
Instruction Fuzzy Hash: AC41BFB1D00719CFDB24DFAAC884BCDBBB1BF49304F24815AD418AB251DB756A46CF90

Function 018B44B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 018B59A9

Memory Dump Source

Source File: 00000000.00000002.1273520044.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18b0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 23f7c58dfb9b3cf718930ef9ea64894a7d73d8fa0674419ead8438c2a969fea3
Instruction ID: 1b0a7bb74f3ab1ff4c731d4a88141667778b4c223ba94b76c6c0d7d8b79c332f
Opcode Fuzzy Hash: 23f7c58dfb9b3cf718930ef9ea64894a7d73d8fa0674419ead8438c2a969fea3
Instruction Fuzzy Hash: D441B170C00719CFDB24DFAAC884BDDBBB5BF49704F50816AD418AB251DB756945CF90

Function 07CA7D38 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07CA7DC8

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 13b95ee386c557f7625c3fa6fc48c5559cb601b5331f66b492ae10e28a39ff03
Instruction ID: 7743651172541002c0dfc8c7e1abaf6922aa4574bcdbda4951cf193c3019953e
Opcode Fuzzy Hash: 13b95ee386c557f7625c3fa6fc48c5559cb601b5331f66b492ae10e28a39ff03
Instruction Fuzzy Hash: 2B212CB5D003499FDB10CFA9C884BEEBBF5FF48314F10842AE518A7240D7799544CB64

Function 018BD5E9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 018BD677

Memory Dump Source

Source File: 00000000.00000002.1273520044.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18b0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 48b84e787f172a1b1f4a0ec54dd6759f60577ab5ec542ee98d5eb2e1fb6712a4
Instruction ID: 162e65ce229e2c6e55598d4e0fc13c6845d3c178ad15d3f848e71e01d3b9f250
Opcode Fuzzy Hash: 48b84e787f172a1b1f4a0ec54dd6759f60577ab5ec542ee98d5eb2e1fb6712a4
Instruction Fuzzy Hash: 722114B5900249AFDB10CFAAD484ADEBFF4EB48314F14851AE918A7310D379AA40CFA4

Function 07CA7E28 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07CA7EA8

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: bcba64474b84466c23fb090d7ec9976b793e218714876d233c8b237218e61b3a
Instruction ID: 2b73e979cc86744d75084fa75e2e6defa96cca3fe91714f83b924d1dbcc63ef0
Opcode Fuzzy Hash: bcba64474b84466c23fb090d7ec9976b793e218714876d233c8b237218e61b3a
Instruction Fuzzy Hash: F42128B1C003499FDB10DFAAC884BDEBBF5FF48310F50842AE518A7250D7399945CBA4

Function 07CA7BA0 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07CA7C1E

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9e9ac8fee5c52bfc541778a2ab30c3f0e0f92432662ebac0f4c557049b27d0b5
Instruction ID: ba4ece5be147949c029ee2fe01027d44c01190f3ae5a27407ddd6f757d0ac4c8
Opcode Fuzzy Hash: 9e9ac8fee5c52bfc541778a2ab30c3f0e0f92432662ebac0f4c557049b27d0b5
Instruction Fuzzy Hash: 3C2135B1D003499FDB14DFAAC4847AEBBF4EF48224F14842AD419A7240DB78AA45CFA4

Function 018BD5F0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 018BD677

Memory Dump Source

Source File: 00000000.00000002.1273520044.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18b0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4ceadac4c187775a063972ab60577257c40b6bf0bd8d2e87536891ec76ab6df1
Instruction ID: 1919455cf86246b75a5a421856776cbc5d0f1a501aa92de3512a6c1f6492cdb0
Opcode Fuzzy Hash: 4ceadac4c187775a063972ab60577257c40b6bf0bd8d2e87536891ec76ab6df1
Instruction Fuzzy Hash: 9D21E4B5900249AFDB10CFAAD484ADEBBF4EB48310F14851AE918A7350D379A944CFA4

Function 07CA7C70 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07CA7CE6

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c16bacb29efd760fb4cfffc0703b3d57cd410c318e45d5c06d783abceed09a81
Instruction ID: 140afa3b0a2fef018d02ce13e1d77f5da04bdfdba9ccdb194c21f91822a7415e
Opcode Fuzzy Hash: c16bacb29efd760fb4cfffc0703b3d57cd410c318e45d5c06d783abceed09a81
Instruction Fuzzy Hash: AF116AB69003499FDB24DFAAC844BDFBBF5EF48324F14881AE515A7250C739A940CFA4

Function 07CA7C78 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07CA7CE6

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 452f24deca9b03c03147ecf92b41decb3ae81a093c14138227a2d3065790e5b5
Instruction ID: 06726d432953a7f86e2c1463a0c337d749725728a3f6212ce5a4414e166d2ad5
Opcode Fuzzy Hash: 452f24deca9b03c03147ecf92b41decb3ae81a093c14138227a2d3065790e5b5
Instruction Fuzzy Hash: 67116A769003499FDB24DFAAC844BDFBBF5EF48314F14881AD515A7250C739A540CFA4

Function 07CA7AE8 Relevance: 1.6, APIs: 1, Instructions: 52
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 07CA7B52

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9a0833a2f87c161de6793f37a66012ec7e69c4b42f0e6673a42308ae16df3f63
Instruction ID: f35c84a96985f46256cd1b203cfe400eb12001508f9da2d515ec9972043155b7
Opcode Fuzzy Hash: 9a0833a2f87c161de6793f37a66012ec7e69c4b42f0e6673a42308ae16df3f63
Instruction Fuzzy Hash: 08118BB5D003498FDB24DFAAD4447EEFBF4EB48214F24842ED419A7240CB39A944CFA4

Function 07CA7AF0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07CA7B52

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 434b5374d424d7570a30d29e8dfad4bf7bc0999dcb45623c65925a7175406631
Instruction ID: 1079bcdc0a950154e7e90f2f9af28ad2e9698be5eaef4c99e2c71869f7f8bd19
Opcode Fuzzy Hash: 434b5374d424d7570a30d29e8dfad4bf7bc0999dcb45623c65925a7175406631
Instruction Fuzzy Hash: 561155B1D003498FDB24DFAAD4847DEBBF4EB88214F24881AC519A7240CB39A944CFA4

Function 07CA4A10 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07CAC265

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6b259e65cbaa69fc6eed0ac6a2d415d37ab87097f0fb05c1f5bd7c5b9de249dc
Instruction ID: caaecf8d695cef30b15e7a5290d95ca7fba72cc2c58ce03cf4e28306fd5abfeb
Opcode Fuzzy Hash: 6b259e65cbaa69fc6eed0ac6a2d415d37ab87097f0fb05c1f5bd7c5b9de249dc
Instruction Fuzzy Hash: 721103B5800349EFDB20DF9AD484BDEBBF8EB48714F10891AE518A7610C379A944CFA5

Function 018BAEF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 018BAF5E

Memory Dump Source

Source File: 00000000.00000002.1273520044.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18b0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b900c9f494c80065a633b8d0b1e7f5ccb55f3fe7f056316c2992f67332538141
Instruction ID: 1e3461c7ac0c428479e67cd870ee8a4039ebb6a8b0585fe2c2d8c79271fc6304
Opcode Fuzzy Hash: b900c9f494c80065a633b8d0b1e7f5ccb55f3fe7f056316c2992f67332538141
Instruction Fuzzy Hash: F7110FB6C006498FDB24CF9AD484BDEFBF4EB88314F14851AD528A7350C379A645CFA5

Function 0185D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1273170900.000000000185D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0185D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_185d000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6a75c53d318980518ca7653f3a154d3fa921a894a29b3b4a39f8ee66872ccd
Instruction ID: be677f336fa2266914ff2711c93df00aadaa239e71a005773c2084aa395d68d1
Opcode Fuzzy Hash: 4c6a75c53d318980518ca7653f3a154d3fa921a894a29b3b4a39f8ee66872ccd
Instruction Fuzzy Hash: D1210371500244DFDB55DF58D9C0B26BF65FB8831CF20C669EC058B256C336D556CBA2

Function 0186D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1273252368.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_186d000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417703bd9f39880cf9466353e0fa9e14340fc95e4e4b85314e29d159ea95b8f7
Instruction ID: b7335747e32d6f27432c4ba9739f3550c501336fd4f4550415b1ff4b66d0c14e
Opcode Fuzzy Hash: 417703bd9f39880cf9466353e0fa9e14340fc95e4e4b85314e29d159ea95b8f7
Instruction Fuzzy Hash: 32212571A04244DFDB15DF54D5C0B26BBA9FB88324F24C66DD8898F352C336E546CB61

Function 0186D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1273252368.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_186d000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4261daa611eaa0151bda757b5ed05084e52f5ec77a1c6ef5ed0f6e97e2567062
Instruction ID: 5db2ca28cae4a0abc7a3e43bed3f8bb1e02b99fa725d3534544b72457f8f6abb
Opcode Fuzzy Hash: 4261daa611eaa0151bda757b5ed05084e52f5ec77a1c6ef5ed0f6e97e2567062
Instruction Fuzzy Hash: 58212575604344DFDB15DF54D5C0B16BBA9EB88314F20C66DD88A8B242C33BD547CB62

Function 0185D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1273170900.000000000185D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0185D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_185d000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697a99710317c54f7bb984e23a66932092e377a29f2f678e4ea71861c0222b0b
Instruction ID: a24dc4e7393df5c57d71f27d00d3eaf66bbc189ba1715d1232f073fef5d8fc97
Opcode Fuzzy Hash: 697a99710317c54f7bb984e23a66932092e377a29f2f678e4ea71861c0222b0b
Instruction Fuzzy Hash: D311AF76504280CFCB16CF54D5C4B16BF72FB88318F24C6A9EC494B656C336D55ACBA1

Function 0186D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1273252368.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_186d000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6052acfa68c4fe46fadad0eff0bea71195c393da8741e650ac4709680a852a
Instruction ID: 1eaf593185edb86c3ee2151aefdb810503de8e2acaaebe0183968421d8b09670
Opcode Fuzzy Hash: 9a6052acfa68c4fe46fadad0eff0bea71195c393da8741e650ac4709680a852a
Instruction Fuzzy Hash: 0D11BB75604280CFCB12CF14D5C4B15BBB2FB88314F24C6AAD8498B656C33AD54ACBA2

Function 0186D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1273252368.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_186d000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6052acfa68c4fe46fadad0eff0bea71195c393da8741e650ac4709680a852a
Instruction ID: 43b6a089a9fa6b264d58a73bd355cb74bbd26870cefc7c3e56a97b249aa181e6
Opcode Fuzzy Hash: 9a6052acfa68c4fe46fadad0eff0bea71195c393da8741e650ac4709680a852a
Instruction Fuzzy Hash: 7011BB75604280DFCB12CF54D5C0B15BBB2FB84324F28C6A9D8898B796C33AE44ACB61

Function 0185D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1273170900.000000000185D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0185D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_185d000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962f5973cae4e151194a9b671b2ae121ab2fa3f2598a7c95f7380c34864b6edb
Instruction ID: d090bb645c507f82b2ab21442db641677ad638cdda3cb977302866f52ebe3889
Opcode Fuzzy Hash: 962f5973cae4e151194a9b671b2ae121ab2fa3f2598a7c95f7380c34864b6edb
Instruction Fuzzy Hash: A601F231004384AAE7605B69DD84B26BB98DF41324F18C61AED088F286C2799940CAB2

Function 0185D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1273170900.000000000185D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0185D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_185d000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae43243b847bc6fa08ee72e97052f0b9eaa1000139a4d4d79e531d68032febb
Instruction ID: 4794fa68b1b1a0786ab0b36228c7ab224f7c862ac58365f147a4b1fe72b63558
Opcode Fuzzy Hash: cae43243b847bc6fa08ee72e97052f0b9eaa1000139a4d4d79e531d68032febb
Instruction Fuzzy Hash: 4CF0C8710043809EE7208A15DC84B62FFA8EF40724F18C55AED084B297C2795840CAB1

Non-executed Functions

Function 07CA57B8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97dd7758d463d9bf4b5465d8b5267c6c2ced5be6ac8cc0439b73fe47136f131
Instruction ID: 8c90bfb68126d30cc0d6a925bd9d3cb766f6cf0c2aeeae510a1713a7f33d95f9
Opcode Fuzzy Hash: a97dd7758d463d9bf4b5465d8b5267c6c2ced5be6ac8cc0439b73fe47136f131
Instruction Fuzzy Hash: FAE1FAB4E0021A9FDB14CFA9D584AAEBBB2FF89305F24C169D415AB356D730AD41CF60

Function 07CA5BF0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9758d481adbee82e928d207883b95a60d0f41c719dbc90fff460d0ee380fa4
Instruction ID: 0b92ad30b39858a4865493fad0da1396f21528e39fd6695643cd677b0eeba61c
Opcode Fuzzy Hash: ec9758d481adbee82e928d207883b95a60d0f41c719dbc90fff460d0ee380fa4
Instruction Fuzzy Hash: 60E118B4E0021A9FDB14CFA9D5849AEBBB2FF89305F24C169D415AB316D730AD41CFA0

Function 07CA5380 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fc16ac61020dfff6174fee94946de7829152fe940c93af445d720885bab8c48
Instruction ID: d885e10ceb193bd03e30555aa6d101de4e0df25e7e68541da96b88e5b41afc9c
Opcode Fuzzy Hash: 4fc16ac61020dfff6174fee94946de7829152fe940c93af445d720885bab8c48
Instruction Fuzzy Hash: 5EE1F9B4E0021A9FDB14CFA9D584AAEBBB2FF89305F24C169D415AB356D730AD41CF60

Function 07CA72C8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025f45e57c9090ca63d6bfd8e71d5186d25791d7f5a7273e6331eabd0f2ec74b
Instruction ID: fecd14bb27cfd89ab93e40497258aca33f6ec6f59a13de770f884d282343cb85
Opcode Fuzzy Hash: 025f45e57c9090ca63d6bfd8e71d5186d25791d7f5a7273e6331eabd0f2ec74b
Instruction Fuzzy Hash: A3E1FDB4E0021A9FDB14CFA9C584AAEFBB2FF89305F248169D415AB356D731AD41CF60

Function 07CA6028 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53fba051365e889ee9002ee236d10cdfcd3d6d67d3d62585f937b3bfcaddaba
Instruction ID: 6e5475f4ab0e3ceeca46d5b29edc0e23afc7a3d91ccf93cc3d454a8b9de14706
Opcode Fuzzy Hash: f53fba051365e889ee9002ee236d10cdfcd3d6d67d3d62585f937b3bfcaddaba
Instruction Fuzzy Hash: 1AE1EAB4E0021A9FDB14CFA9C5849AEFBB2FF89305F248169D415AB356D730AD41CFA1

Function 018BD51C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1273520044.00000000018B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18b0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da7f91fe343afa35601f69c03121315061dbeefd3e3bf5fffec8bfe031006fb0
Instruction ID: d4e9aa72a25959089f29b9d7074d49fc79400b40dde339d59395a9fe87a304d3
Opcode Fuzzy Hash: da7f91fe343afa35601f69c03121315061dbeefd3e3bf5fffec8bfe031006fb0
Instruction Fuzzy Hash: DCA15032A1060A8FCF15DFB8C8805DEBBB2FF85300B158569EA05EB365DB71DA56CB40

Function 07CA5BE9 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23b339e34f6ff9b70fb581445b18b41bb3ddc7e6c6128a548de44598efe530d
Instruction ID: ce3b3f403ebb8e3f20e1720f7f51a33ce368966d58efc5b22d4aad4407449298
Opcode Fuzzy Hash: a23b339e34f6ff9b70fb581445b18b41bb3ddc7e6c6128a548de44598efe530d
Instruction Fuzzy Hash: 8851F8B4E0021A8FDB14CFA9D5845AEBBB2FF89305F24C16AD419A7216D7359D42CFA0

Function 07CA6027 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278021954.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0b0cdd66b25c8c5119f855ebd2e94c2acffc58c2327b28c98f8f97b0ad9dab
Instruction ID: 612eba58b068e97c5e3c22c4e52c6a9404bb21ae80ad47d643da4a9799406702
Opcode Fuzzy Hash: 3a0b0cdd66b25c8c5119f855ebd2e94c2acffc58c2327b28c98f8f97b0ad9dab
Instruction Fuzzy Hash: 0851F8B4E0021A8BDB14CFA9C5855AEFBF2EF89305F24816AD518B7216D7319942CFA1

Analysis Process: PO] G_24370-24396_SI2_S25_8658.exePID: 6524, Parent PID: 7060COMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	22
Total number of Limit Nodes:	2

Executed Functions

Function 06978758 Relevance: 1.7, APIs: 1, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2483190240.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6970000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e1be6902817efb5796e31d3340bfafffffd2aa6d590fd002b807a6dfe8bca08
Instruction ID: 6614e3a8cd52ca4b500a907eb8ff086171d7d6db5b5c047959c4c4896bb76c86
Opcode Fuzzy Hash: 9e1be6902817efb5796e31d3340bfafffffd2aa6d590fd002b807a6dfe8bca08
Instruction Fuzzy Hash: C6411331E143559FCB15CB66DC046EEBFF4EF85220F14856AE404EB681DB349841CBE1

Function 01A6610C Relevance: 1.6, APIs: 1, Instructions: 97
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 01A68137

Memory Dump Source

Source File: 00000008.00000002.2477798700.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1a60000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 71071ecb3e302b79812da997ec25fc6315239afa98203dcd108df7b136419284
Instruction ID: da2e9784eaa91b7bf776a8a23390d4d3acb66bd809607b1f35b62fa1b829427b
Opcode Fuzzy Hash: 71071ecb3e302b79812da997ec25fc6315239afa98203dcd108df7b136419284
Instruction Fuzzy Hash: 964154B0D003498FDB20CFA9C88479EBBF9EB08714F148629E814AB384D7B89841CF95

Function 01A68046 Relevance: 1.6, APIs: 1, Instructions: 96
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 01A68137

Memory Dump Source

Source File: 00000008.00000002.2477798700.0000000001A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1a60000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f284a3c3135fedfc187798629dd014d65a83c40ebf8c2d46fb38abc6127783bf
Instruction ID: 6aece7ef5ea2bdf86a1d959e652ce7644ab169505ea12aeb0b74ea55fb9bfca9
Opcode Fuzzy Hash: f284a3c3135fedfc187798629dd014d65a83c40ebf8c2d46fb38abc6127783bf
Instruction Fuzzy Hash: B84156B0D003498FDB24CFA9C88179EBBF9FB48710F148629E814AB384D7789841CF91

Function 0697CBA0 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0697CB6E,?,?,?,?,?), ref: 0697CC2F

Memory Dump Source

Source File: 00000008.00000002.2483190240.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6970000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e4258cc89fd4f18f733e49ab7ab4359ad8df44599581d3bffe5b76f85bae4f98
Instruction ID: f5a542d73700b34aa4007b64bafc5ed8d5e77e237b1bb8d44f264774d192bdc6
Opcode Fuzzy Hash: e4258cc89fd4f18f733e49ab7ab4359ad8df44599581d3bffe5b76f85bae4f98
Instruction Fuzzy Hash: 6B21F3B5900249AFDB10CFAAD984ADEBBF9EB48310F14845AE914A7310D378A950CFA5

Function 0697C52C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0697CB6E,?,?,?,?,?), ref: 0697CC2F

Memory Dump Source

Source File: 00000008.00000002.2483190240.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6970000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cd56653cac6060b59ff2598e7abad7ffbb39ca19c5f42778e9c67c3857924546
Instruction ID: 7594050d8ec708e7a36432feb755bb007b13a962c7314fa3cd39dc7aa756e127
Opcode Fuzzy Hash: cd56653cac6060b59ff2598e7abad7ffbb39ca19c5f42778e9c67c3857924546
Instruction Fuzzy Hash: BE21D4B5D00349AFDB10CF9AD584ADEBBF4EB48310F14845AE914A7350D379A950CFA5

Function 06978840 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 069788A7

Memory Dump Source

Source File: 00000008.00000002.2483190240.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6970000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2c29b1d89cd2b1f74bd616eaa2c7d7dd019553e43727c12e4943f5d1d7965b9f
Instruction ID: 58c701e4c15d1185bc856a0849d54ecce7ff49c6c630a12a3bd0a9c11f81cf01
Opcode Fuzzy Hash: 2c29b1d89cd2b1f74bd616eaa2c7d7dd019553e43727c12e4943f5d1d7965b9f
Instruction Fuzzy Hash: B61123B5C0065A9FDB14CF9AD944BDEFBF4EF48220F14816AD828A7340D378A944CFA5

Function 0169D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2476486494.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_169d000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ab5d9c13e471fbb7239a2724e842413aa92bbd9e1b27ed6d7b86cccc36a9f9
Instruction ID: 80803c775ae24c63a4a6e1787c2dca2365eb45cbec05ff9eb4f5ecde5dc77a9f
Opcode Fuzzy Hash: 94ab5d9c13e471fbb7239a2724e842413aa92bbd9e1b27ed6d7b86cccc36a9f9
Instruction Fuzzy Hash: CF21D075604340DFDF15DF68D984B26BBA9EB88354F20C579D80A4B396C33AD847CA62

Function 0169D006 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2476486494.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_169d000_PO] G_24370-24396_SI2_S25_8658.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c691b094ab1c4ebfb058df3a09d4f3872abea083e87d53f90e8874d14d8e0824
Instruction ID: 6cb27c3626b62849c348851b58831bbdec48d6710864d525da94eff39f66c4d1
Opcode Fuzzy Hash: c691b094ab1c4ebfb058df3a09d4f3872abea083e87d53f90e8874d14d8e0824
Instruction Fuzzy Hash: F4219F755083809FDB02CF64D994B15BFB5FB46314F24C5EAD8498F2A7C33A9846CB62

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO] G_24370-24396_SI2_S25_8658.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3uf0lb2g.usv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5k2ngf05.xz2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bruopfhl.co2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dbt3um3i.nf4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gukgzo5h.elo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2haumev.525.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sjpy1ipl.oq0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vleerk1f.2ou.psm1

C:\Users\user\AppData\Local\Temp\tmpE291.tmp

C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe

C:\Users\user\AppData\Roaming\VxQjXFYhdkY.exe:Zone.Identifier

Static File Info

Windows Analysis Report
PO] G_24370-24396_SI2_S25_8658.exe

Function 018BCF90 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 018BCFA0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 07CA7FBD Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Function 07CA7FC0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 018BAD08 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 018B58EC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre