Edit tour

Windows Analysis Report
lC7L7oBBMC.exe

Overview

General Information

Sample name:	lC7L7oBBMC.exe renamed because original name is a hash value
Original sample name:	0787749d9897612314975e2943139157efcff4dbf604323d3d950c76b7555719.exe
Analysis ID:	1569297
MD5:	4c363afc82b0757d2723ff1287ab85de
SHA1:	eae78234d3125edb5e161641b1c61dfab9456a46
SHA256:	0787749d9897612314975e2943139157efcff4dbf604323d3d950c76b7555719
Tags:	exeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

lC7L7oBBMC.exe (PID: 7120 cmdline: "C:\Users\user\Desktop\lC7L7oBBMC.exe" MD5: 4C363AFC82B0757D2723FF1287AB85DE)

powershell.exe (PID: 3216 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6372 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7016 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lC7L7oBBMC.exe (PID: 5104 cmdline: "C:\Users\user\Desktop\lC7L7oBBMC.exe" MD5: 4C363AFC82B0757D2723FF1287AB85DE)

powershell.exe (PID: 7188 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7232 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wlBldyvi.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7496 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7264 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpE08F.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lC7L7oBBMC.exe (PID: 7488 cmdline: "C:\Users\user\Desktop\lC7L7oBBMC.exe" MD5: 4C363AFC82B0757D2723FF1287AB85DE)

IxumRsOtTdrVAu.exe (PID: 7296 cmdline: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe MD5: 4C363AFC82B0757D2723FF1287AB85DE)

schtasks.exe (PID: 1792 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF62A.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

IxumRsOtTdrVAu.exe (PID: 6688 cmdline: "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe" MD5: 4C363AFC82B0757D2723FF1287AB85DE)

schtasks.exe (PID: 3964 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpFF43.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

IxumRsOtTdrVAu.exe (PID: 816 cmdline: "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe" MD5: 4C363AFC82B0757D2723FF1287AB85DE)

IxumRsOtTdrVAu.exe (PID: 4412 cmdline: "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe" MD5: 4C363AFC82B0757D2723FF1287AB85DE)

IxumRsOtTdrVAu.exe (PID: 5096 cmdline: "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe" MD5: 4C363AFC82B0757D2723FF1287AB85DE)

wlBldyvi.exe (PID: 7700 cmdline: C:\Users\user\AppData\Roaming\wlBldyvi.exe MD5: 4C363AFC82B0757D2723FF1287AB85DE)

schtasks.exe (PID: 7244 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF58E.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wlBldyvi.exe (PID: 2620 cmdline: "C:\Users\user\AppData\Roaming\wlBldyvi.exe" MD5: 4C363AFC82B0757D2723FF1287AB85DE)

schtasks.exe (PID: 6520 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpFF91.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wlBldyvi.exe (PID: 2708 cmdline: "C:\Users\user\AppData\Roaming\wlBldyvi.exe" MD5: 4C363AFC82B0757D2723FF1287AB85DE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "web@iaa-airferight.com", "Password": "webmaster"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000025.00000002.2491122015.000000000316C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.2491663736.0000000002A7C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000027.00000002.2481915050.0000000000436000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000027.00000002.2481915050.0000000000436000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000025.00000002.2491122015.0000000003141000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000025.00000002.2491122015.0000000003141000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000027.00000002.2490785586.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.2491663736.0000000002A51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.2491663736.0000000002A51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000027.00000002.2490785586.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000027.00000002.2490785586.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: lC7L7oBBMC.exe PID: 7120	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: lC7L7oBBMC.exe PID: 5104	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: lC7L7oBBMC.exe PID: 5104	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: lC7L7oBBMC.exe PID: 5104	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: IxumRsOtTdrVAu.exe PID: 7296	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: lC7L7oBBMC.exe PID: 7488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: lC7L7oBBMC.exe PID: 7488	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: wlBldyvi.exe PID: 7700	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: wlBldyvi.exe PID: 2620	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: IxumRsOtTdrVAu.exe PID: 6688	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: wlBldyvi.exe PID: 2708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: wlBldyvi.exe PID: 2708	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: IxumRsOtTdrVAu.exe PID: 5096	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: IxumRsOtTdrVAu.exe PID: 5096	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.lC7L7oBBMC.exe.45436d0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.lC7L7oBBMC.exe.45436d0.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.lC7L7oBBMC.exe.45436d0.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.lC7L7oBBMC.exe.4508cb0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.lC7L7oBBMC.exe.4508cb0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.lC7L7oBBMC.exe.4508cb0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.lC7L7oBBMC.exe.45436d0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.lC7L7oBBMC.exe.45436d0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.lC7L7oBBMC.exe.45436d0.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.lC7L7oBBMC.exe.45436d0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e00f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e09f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.lC7L7oBBMC.exe.4508cb0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.lC7L7oBBMC.exe.4508cb0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.lC7L7oBBMC.exe.4508cb0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.lC7L7oBBMC.exe.4508cb0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa872f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa87a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e00b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa882b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e09d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa88bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e107:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8927:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e179:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8999:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e20f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a2f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 9 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\lC7L7oBBMC.exe", ParentImage: C:\Users\user\Desktop\lC7L7oBBMC.exe, ParentProcessId: 7120, ParentProcessName: lC7L7oBBMC.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe", ProcessId: 3216, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF58E.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF58E.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\wlBldyvi.exe, ParentImage: C:\Users\user\AppData\Roaming\wlBldyvi.exe, ParentProcessId: 7700, ParentProcessName: wlBldyvi.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF58E.tmp", ProcessId: 7244, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Users\user\Desktop\lC7L7oBBMC.exe, Initiated: true, ProcessId: 7488, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\lC7L7oBBMC.exe", ParentImage: C:\Users\user\Desktop\lC7L7oBBMC.exe, ParentProcessId: 7120, ParentProcessName: lC7L7oBBMC.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp", ProcessId: 7016, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\lC7L7oBBMC.exe", ParentImage: C:\Users\user\Desktop\lC7L7oBBMC.exe, ParentProcessId: 7120, ParentProcessName: lC7L7oBBMC.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe", ProcessId: 3216, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\lC7L7oBBMC.exe", ParentImage: C:\Users\user\Desktop\lC7L7oBBMC.exe, ParentProcessId: 7120, ParentProcessName: lC7L7oBBMC.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp", ProcessId: 7016, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 9.2.lC7L7oBBMC.exe.4508cb0.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "web@iaa-airferight.com", "Password": "webmaster"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	ReversingLabs: Detection: 71%

Multi AV Scanner detection for submitted file

Source: lC7L7oBBMC.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: lC7L7oBBMC.exe

Joe Sandbox ML: detected

Source: lC7L7oBBMC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49713 version: TLS 1.2

Source: lC7L7oBBMC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Wxw.pdbSHA256.- source: lC7L7oBBMC.exe, wlBldyvi.exe.9.dr, IxumRsOtTdrVAu.exe.0.dr
Source:	Binary string: Wxw.pdb source: lC7L7oBBMC.exe, wlBldyvi.exe.9.dr, IxumRsOtTdrVAu.exe.0.dr

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.45436d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.4508cb0.3.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View	IP Address: 46.175.148.58 46.175.148.58
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.7:49705 -> 46.175.148.58:25

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.iaa-airferight.com

Source: lC7L7oBBMC.exe, 00000013.00000002.2491663736.0000000002A7C000.00000004.00000800.00020000.00000000.sdmp, wlBldyvi.exe, 00000025.00000002.2491122015.000000000316C000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000027.00000002.2490785586.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: lC7L7oBBMC.exe, 00000000.00000002.1271041828.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, lC7L7oBBMC.exe, 00000009.00000002.1296219521.000000000349B000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000011.00000002.1358182217.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, lC7L7oBBMC.exe, 00000013.00000002.2491663736.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, wlBldyvi.exe, 00000015.00000002.1350292766.0000000003190000.00000004.00000800.00020000.00000000.sdmp, wlBldyvi.exe, 0000001E.00000002.1380641575.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 0000001F.00000002.1377942726.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, wlBldyvi.exe, 00000025.00000002.2491122015.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000027.00000002.2490785586.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lC7L7oBBMC.exe, 00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000027.00000002.2481915050.0000000000436000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: lC7L7oBBMC.exe, 00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp, lC7L7oBBMC.exe, 00000013.00000002.2491663736.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, lC7L7oBBMC.exe, 00000013.00000002.2481907734.0000000000434000.00000040.00000400.00020000.00000000.sdmp, wlBldyvi.exe, 00000025.00000002.2491122015.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000027.00000002.2490785586.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: lC7L7oBBMC.exe, 00000013.00000002.2491663736.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, wlBldyvi.exe, 00000025.00000002.2491122015.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000027.00000002.2490785586.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: lC7L7oBBMC.exe, 00000013.00000002.2491663736.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, wlBldyvi.exe, 00000025.00000002.2491122015.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000027.00000002.2490785586.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49713 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.2.lC7L7oBBMC.exe.45436d0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.lC7L7oBBMC.exe.4508cb0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.lC7L7oBBMC.exe.45436d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.lC7L7oBBMC.exe.4508cb0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.lC7L7oBBMC.exe.3ca48c0.3.raw.unpack, Lab06_Bai03.cs

Large array initialization: : array initializer size 573336

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 0_2_00EDDC74	0_2_00EDDC74
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 0_2_07451748	0_2_07451748
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 0_2_0745D907	0_2_0745D907
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 0_2_07456471	0_2_07456471
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 0_2_07456480	0_2_07456480
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 0_2_07456048	0_2_07456048
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 0_2_074580A8	0_2_074580A8
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 0_2_074580B8	0_2_074580B8
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 0_2_07457C70	0_2_07457C70
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 0_2_07455C10	0_2_07455C10
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 0_2_07457C80	0_2_07457C80
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 9_2_032CDFCC	9_2_032CDFCC
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 9_2_07DC8558	9_2_07DC8558
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 9_2_07DC1500	9_2_07DC1500
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 9_2_07DC14EF	9_2_07DC14EF
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 9_2_07DC10C8	9_2_07DC10C8
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 9_2_07DC2D00	9_2_07DC2D00
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 9_2_07DC0C90	9_2_07DC0C90
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 9_2_07DC0858	9_2_07DC0858
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_0144DC74	17_2_0144DC74
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_030F6A60	17_2_030F6A60
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_030F0007	17_2_030F0007
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_030F0040	17_2_030F0040
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_030F6A50	17_2_030F6A50
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_05C2CBE8	17_2_05C2CBE8
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_05C26340	17_2_05C26340
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_05C26350	17_2_05C26350
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_05C27F88	17_2_05C27F88
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_05C27F78	17_2_05C27F78
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_05C25F18	17_2_05C25F18
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_05C27B40	17_2_05C27B40
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_05C27B50	17_2_05C27B50
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_05C25ACF	17_2_05C25ACF
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_05C25AE0	17_2_05C25AE0
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_00F1A94F	19_2_00F1A94F
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_00F14A98	19_2_00F14A98
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_00F13E80	19_2_00F13E80
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_00F141C8	19_2_00F141C8
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_06697D68	19_2_06697D68
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_066965E0	19_2_066965E0
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_06695588	19_2_06695588
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_0669B20F	19_2_0669B20F
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_06693040	19_2_06693040
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_06697688	19_2_06697688
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_06695CD3	19_2_06695CD3
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_06692349	19_2_06692349
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_0669E388	19_2_0669E388
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_06690040	19_2_06690040
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_06690006	19_2_06690006
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_066902CB	19_2_066902CB
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 21_2_0186DC74	21_2_0186DC74
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 21_2_073F1748	21_2_073F1748
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 21_2_073FCBF8	21_2_073FCBF8
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 21_2_073F6350	21_2_073F6350
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 21_2_073F6340	21_2_073F6340
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 21_2_073F5F18	21_2_073F5F18
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 21_2_073F7F78	21_2_073F7F78
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 21_2_073F7F88	21_2_073F7F88
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 21_2_073F7B50	21_2_073F7B50
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 21_2_073F7B40	21_2_073F7B40
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 21_2_073F5AE0	21_2_073F5AE0
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_011DDFCC	30_2_011DDFCC
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_05451184	30_2_05451184
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_05450040	30_2_05450040
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_05451FFD	30_2_05451FFD
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_075677E1	30_2_075677E1
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_07561500	30_2_07561500
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_075614EF	30_2_075614EF
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_075610C8	30_2_075610C8
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_07562D00	30_2_07562D00
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_07560C90	30_2_07560C90
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_07560858	30_2_07560858
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 31_2_054EDFCC	31_2_054EDFCC
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 31_2_05610040	31_2_05610040
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 31_2_05610025	31_2_05610025
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 31_2_077478F8	31_2_077478F8
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 31_2_07741500	31_2_07741500
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 31_2_077414EF	31_2_077414EF
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 31_2_077410C8	31_2_077410C8
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 31_2_07742D00	31_2_07742D00
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 31_2_07740C90	31_2_07740C90
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 31_2_07740858	31_2_07740858
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_015CA198	37_2_015CA198
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_015CE6B0	37_2_015CE6B0
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_015CA960	37_2_015CA960
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_015C4A98	37_2_015C4A98
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_015C3E80	37_2_015C3E80
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_015C41C8	37_2_015C41C8
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_06D965E0	37_2_06D965E0
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_06D95588	37_2_06D95588
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_06D97D68	37_2_06D97D68
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_06D9B20F	37_2_06D9B20F
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_06D92358	37_2_06D92358
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_06D97688	37_2_06D97688
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_06D95CE8	37_2_06D95CE8
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_06D9E388	37_2_06D9E388
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_06D9032C	37_2_06D9032C
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_06D90007	37_2_06D90007
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_014AE6A1	39_2_014AE6A1
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_014A4A98	39_2_014A4A98
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_014A3E80	39_2_014A3E80
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_014A41C8	39_2_014A41C8
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_014AA960	39_2_014AA960
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_06C865E0	39_2_06C865E0
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_06C85588	39_2_06C85588
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_06C87D68	39_2_06C87D68
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_06C8B20F	39_2_06C8B20F
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_06C83040	39_2_06C83040
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_06C87688	39_2_06C87688
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_06C85CD3	39_2_06C85CD3
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_06C8E388	39_2_06C8E388
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_06C8234A	39_2_06C8234A
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_06C80040	39_2_06C80040
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_06C80006	39_2_06C80006

Source: lC7L7oBBMC.exe, 00000000.00000002.1299858863.0000000007A40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs lC7L7oBBMC.exe
Source: lC7L7oBBMC.exe, 00000000.00000002.1260225423.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs lC7L7oBBMC.exe
Source: lC7L7oBBMC.exe, 00000000.00000000.1240656812.0000000000780000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameChromeSetup (1).exe< vs lC7L7oBBMC.exe
Source: lC7L7oBBMC.exe, 00000009.00000002.1311958816.000000000AE90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs lC7L7oBBMC.exe
Source: lC7L7oBBMC.exe, 00000009.00000002.1311958816.000000000AE90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs lC7L7oBBMC.exe
Source: lC7L7oBBMC.exe, 00000009.00000002.1308492523.0000000007E40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs lC7L7oBBMC.exe
Source: lC7L7oBBMC.exe, 00000009.00000002.1296219521.000000000349B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs lC7L7oBBMC.exe
Source: lC7L7oBBMC.exe, 00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs lC7L7oBBMC.exe
Source: lC7L7oBBMC.exe, 00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs lC7L7oBBMC.exe
Source: lC7L7oBBMC.exe, 00000013.00000002.2483448126.0000000000AF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs lC7L7oBBMC.exe
Source: lC7L7oBBMC.exe	Binary or memory string: OriginalFilenameChromeSetup (1).exe< vs lC7L7oBBMC.exe

Source: lC7L7oBBMC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 9.2.lC7L7oBBMC.exe.45436d0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.lC7L7oBBMC.exe.4508cb0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.lC7L7oBBMC.exe.45436d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.lC7L7oBBMC.exe.4508cb0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: lC7L7oBBMC.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: IxumRsOtTdrVAu.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, kqvva3nmCUQi6s2CqL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, KXterRI5WV5h4shtQl.cs	Security API names: _0020.SetAccessControl
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, KXterRI5WV5h4shtQl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, KXterRI5WV5h4shtQl.cs	Security API names: _0020.AddAccessRule
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, kqvva3nmCUQi6s2CqL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, KXterRI5WV5h4shtQl.cs	Security API names: _0020.SetAccessControl
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, KXterRI5WV5h4shtQl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, KXterRI5WV5h4shtQl.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@50/30@2/2

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe

File created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3744:120:WilError_03
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe

File created: C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp

Jump to behavior

Source: lC7L7oBBMC.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: lC7L7oBBMC.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: lC7L7oBBMC.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe

File read: C:\Users\user\Desktop\lC7L7oBBMC.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\lC7L7oBBMC.exe "C:\Users\user\Desktop\lC7L7oBBMC.exe"
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Users\user\Desktop\lC7L7oBBMC.exe "C:\Users\user\Desktop\lC7L7oBBMC.exe"
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wlBldyvi.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpE08F.tmp"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Users\user\Desktop\lC7L7oBBMC.exe "C:\Users\user\Desktop\lC7L7oBBMC.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wlBldyvi.exe C:\Users\user\AppData\Roaming\wlBldyvi.exe
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF58E.tmp"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF62A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Process created: C:\Users\user\AppData\Roaming\wlBldyvi.exe "C:\Users\user\AppData\Roaming\wlBldyvi.exe"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpFF43.tmp"
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpFF91.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Process created: C:\Users\user\AppData\Roaming\wlBldyvi.exe "C:\Users\user\AppData\Roaming\wlBldyvi.exe"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Users\user\Desktop\lC7L7oBBMC.exe "C:\Users\user\Desktop\lC7L7oBBMC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wlBldyvi.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpE08F.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Users\user\Desktop\lC7L7oBBMC.exe "C:\Users\user\Desktop\lC7L7oBBMC.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF62A.tmp"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF58E.tmp"
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Process created: C:\Users\user\AppData\Roaming\wlBldyvi.exe "C:\Users\user\AppData\Roaming\wlBldyvi.exe"
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpFF91.tmp"
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Process created: C:\Users\user\AppData\Roaming\wlBldyvi.exe "C:\Users\user\AppData\Roaming\wlBldyvi.exe"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpFF43.tmp"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: amsi.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: rasman.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: rtutils.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: schannel.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Section loaded: mskeyprotect.dll

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Source: lC7L7oBBMC.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: lC7L7oBBMC.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: lC7L7oBBMC.exe

Static file information: File size 1452032 > 1048576

Source: lC7L7oBBMC.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x12c200

Source: lC7L7oBBMC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: lC7L7oBBMC.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Wxw.pdbSHA256.- source: lC7L7oBBMC.exe, wlBldyvi.exe.9.dr, IxumRsOtTdrVAu.exe.0.dr
Source:	Binary string: Wxw.pdb source: lC7L7oBBMC.exe, wlBldyvi.exe.9.dr, IxumRsOtTdrVAu.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: lC7L7oBBMC.exe, StartForm.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: IxumRsOtTdrVAu.exe.0.dr, StartForm.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, KXterRI5WV5h4shtQl.cs	.Net Code: g8UCbsRdqG System.Reflection.Assembly.Load(byte[])
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, KXterRI5WV5h4shtQl.cs	.Net Code: g8UCbsRdqG System.Reflection.Assembly.Load(byte[])

Source: lC7L7oBBMC.exe

Static PE information: 0xE1106C7A [Sat Aug 27 02:59:06 2089 UTC]

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 0_2_00EDEA60 pushad ; retf	0_2_00EDEA69
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 9_2_032CDA10 push eax; iretd	9_2_032CDA11
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_05C29E1B push eax; iretd	17_2_05C29E21
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 17_2_05C25AC8 push edi; retn 0005h	17_2_05C25ACA
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_00F10C6D push edi; retf	19_2_00F10C7A
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_00F10C53 push ebx; retf	19_2_00F10C52
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_00F10C45 push ebx; retf	19_2_00F10C52
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Code function: 19_2_0669FFBF push es; ret	19_2_0669FFC0
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 21_2_0186EA60 pushad ; retf	21_2_0186EA69
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_011DDA10 push eax; iretd	30_2_011DDA11
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 30_2_0545C712 push 0005437Ah; iretd	30_2_0545C71D
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 31_2_054EDA10 push eax; iretd	31_2_054EDA11
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 31_2_0561C712 push 0005607Ah; iretd	31_2_0561C71D
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_015C0C45 push ebx; retf	37_2_015C0C52
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Code function: 37_2_015C0C6D push edi; retf	37_2_015C0C7A
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_014A0C45 push ebx; retf	39_2_014A0C52
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_014A0C6D push edi; retf	39_2_014A0C7A
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_014ADCB0 push ebp; retf	39_2_014ADCFD
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Code function: 39_2_06C8FFBF push es; ret	39_2_06C8FFC0

Source: lC7L7oBBMC.exe	Static PE information: section name: .text entropy: 7.992598388880175
Source: IxumRsOtTdrVAu.exe.0.dr	Static PE information: section name: .text entropy: 7.992598388880175

Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, m3rsJZUU9AMmfEKPcJ.cs	High entropy of concatenated method names: 'Fy752bo0fU', 'GRg5ioYhux', 'msj5n3G7E1', 'CHu5UGupEs', 'UL05EZpkdj', 'IQC5R0rlM6', 'i2f5jdGlrM', 'fNT53BycdF', 'lRL5oZMjk5', 'oBo5tA2nuM'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, YWtcI84eE492XxlRU33.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'pZ6tdDqgOH', 'DyLt0L3hH0', 'BmotkSvpJa', 'jRwtQsEbZd', 'INXtAs1vJ0', 'bRXtTCvjHj', 'g8KtrHKWxG'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, UdLZjDYWaUqCPuulSH.cs	High entropy of concatenated method names: 'Dispose', 'XuP4xKinrj', 'bKvKL7OoGx', 'lfiTT8OUNR', 'dpa48Nrkw5', 'JSg4zIsK3y', 'ProcessDialogKey', 'aLaKXN3o5J', 'hf0K4YjPcn', 'VFgKKxOO66'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, KXterRI5WV5h4shtQl.cs	High entropy of concatenated method names: 'u19emtp1XI', 'iAUe6IahYV', 'O6KeYTPbPv', 'xube50bBsJ', 'cZAefak8NZ', 'AIdeakUtQH', 'vIYec4g4LQ', 'ENHeInV8xF', 'XMreFEkhDg', 'NKte9UZEu8'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, iN3o5Jxff0YjPcnTFg.cs	High entropy of concatenated method names: 'OBR3vvh0ug', 'Cym3LBrjGq', 'xFc3BrlwCu', 'ooZ3h2lvEO', 'b1C3dUp6ec', 'uAJ3DNk9gv', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, sWPPJBS5mPXs8ZupjQ.cs	High entropy of concatenated method names: 'gXJNnyVnin', 'rgXNU2la0v', 'fk7NvA6K4I', 'qEgNLNUnhG', 'YPmNhqDrdK', 'ilOND6hkpB', 'vu8NVlgo5D', 'M6SNgLLqYl', 'wluNMEDMmP', 'g4JNHUmHT6'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, xaNrkwZ5DSgIsK3yXL.cs	High entropy of concatenated method names: 'Tse36IjjZI', 'xJk3Y9jYu2', 'J0t35XXplt', 'NRX3fIQNHt', 'foI3achGUV', 'xOB3c4ZfSP', 'NZK3I27ZqB', 'aqL3F9qg9s', 'Fjp39i4wo0', 'Fcm37WfXps'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, shfnXRdPejheSQTySc.cs	High entropy of concatenated method names: 'BU2EMYsBhy', 'E8hEs7CaQV', 'EWEEddf7Ti', 'h1YE0yVoXU', 'MluELaYCSd', 'WdhEBIl79b', 'QLZEhlkQ8c', 'QavEDKRt6A', 'BPEEJSVOfR', 'TsrEVdcmiQ'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, VpxjIyCFimbjc6WSps.cs	High entropy of concatenated method names: 'IkI4cqvva3', 'eCU4IQi6s2', 'WU949AMmfE', 'cPc47JCM1a', 'xL54E6b2wd', 'OXb4R995ic', 'PNVY1kiBc973DZgkKR', 'i4EuEbUdtfX7TeibKo', 'mit44Mybd1', 'RJA4eIgeVh'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, FUa4tSzj9tk1avVVa3.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'su5oNIkIAa', 'yjCoEbA1cf', 'Ld0oRuXlui', 'XY1ojwgyKw', 'zXwo38ZHjf', 'pMTooWimHm', 'xwkotpH6fD'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, LgHaddTxl5N2h3KPP4.cs	High entropy of concatenated method names: 'csZjZo1UBi', 'ho2j84tDTr', 'A3S3XCw7P6', 'B6634kBfZA', 'tmEjHKWxGE', 'jkJjsrr9Yn', 'sxjjSuaSgC', 'twpjdgCRZD', 'b4Xj02yBWx', 'cqnjksXWtl'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, UVEhrc4XMwtAun7HHOa.cs	High entropy of concatenated method names: 'gMWolNg1gB', 'oTno1koDVO', 'xKyobSvEPN', 'Jl7o2pxRHV', 'JGkoqnO8HT', 'B8moiatop2', 'YgIoWEi9fo', 'jMWonwn6wl', 'zAaoU8JehB', 'jr3ouom3US'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, XOO66K8vtoEq7BITLb.cs	High entropy of concatenated method names: 'OZYo4s0RBd', 'mZ4oe1ePWn', 'UP6oCxsw1c', 'MFqo6VCifv', 'vEFoY0TWP2', 'ndgofKZBnF', 'wOnoarwcmO', 'DkM3rNZjw4', 'tKl3Zx337g', 'Fdo3xF35W3'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, VeueFswoE7Ox3M36eX.cs	High entropy of concatenated method names: 'CULcl1rrLy', 'PCvc1RVvF5', 'Pl6cbIb7l6', 'M1wc2jYFRO', 'aVccqxytSv', 'fikci9X4j8', 'JuqcWhtqdE', 'Wp6cnPGvw4', 'l6kcUXhIv2', 'qC8cuQcA5g'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, KsalxLKjuZvxdSSCr6.cs	High entropy of concatenated method names: 'q3kbVq3bG', 'qHV2JOv6D', 'PkpikeLrD', 'AZBWKqCON', 'oymUm0t5T', 'k83uMjYi1', 'pmWdeJasImpMxj6vwR', 'HMSZD9OEAVRFeIddZG', 'WG03OOft6', 'i6xtHXkif'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, dM1akdueVQZXVlL56b.cs	High entropy of concatenated method names: 'O1sfqZqyNA', 'mYZfWjuHef', 'r9a5Bys3rK', 'JsS5hyO1kL', 'o395DIc0lm', 'fi25JvFF1P', 'usI5VxgHMZ', 'h8W5gyGWMJ', 'YbJ5wgALtK', 'ose5MhuiQ8'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, L95SDJVFDabwJWbcqA.cs	High entropy of concatenated method names: 'rYfc6SGVIl', 'SrPc57skU9', 'uADca7lFUM', 'XEna82Rsxo', 'Ls3azKt8g0', 'nOqcXbbAvB', 'g0sc4xYION', 'aiFcKmIi9s', 'lTQcelGf40', 'sQbcCWhvYE'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, AwdHXbv995icFZqwgS.cs	High entropy of concatenated method names: 'zOEamPwCyJ', 'vBgaYZWuYC', 'YXoafi3N8v', 'XLSacUqqZm', 'QDFaI69qqy', 'fvNfAy4xRQ', 'DKdfTJfj9R', 'GX5frgjEBG', 'tkffZOY3It', 'OWJfxX1q01'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, XH6WeqQ56QFHPXBTFP.cs	High entropy of concatenated method names: 'Ex9j9NsRUW', 'vmmj7t4ntB', 'ToString', 'wnOj6IrITH', 'ofmjYXiqME', 'wGvj52Km2Y', 'xWDjf0MXQS', 'pOcjaTXLwP', 'PCRjc5Y0Q4', 'GcmjIWUk1H'
Source: 0.2.lC7L7oBBMC.exe.7a40000.5.raw.unpack, kqvva3nmCUQi6s2CqL.cs	High entropy of concatenated method names: 'FYgYdmoP0N', 'OUwY0tVDYI', 'UZxYklAydW', 'nVXYQ0I6KO', 'wRBYALJ9Dn', 'DDQYTrR4wb', 'qP0YrFwERB', 'Ke2YZGFycV', 'SxTYxvcBe0', 'c0LY8xM2BB'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, m3rsJZUU9AMmfEKPcJ.cs	High entropy of concatenated method names: 'Fy752bo0fU', 'GRg5ioYhux', 'msj5n3G7E1', 'CHu5UGupEs', 'UL05EZpkdj', 'IQC5R0rlM6', 'i2f5jdGlrM', 'fNT53BycdF', 'lRL5oZMjk5', 'oBo5tA2nuM'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, YWtcI84eE492XxlRU33.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'pZ6tdDqgOH', 'DyLt0L3hH0', 'BmotkSvpJa', 'jRwtQsEbZd', 'INXtAs1vJ0', 'bRXtTCvjHj', 'g8KtrHKWxG'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, UdLZjDYWaUqCPuulSH.cs	High entropy of concatenated method names: 'Dispose', 'XuP4xKinrj', 'bKvKL7OoGx', 'lfiTT8OUNR', 'dpa48Nrkw5', 'JSg4zIsK3y', 'ProcessDialogKey', 'aLaKXN3o5J', 'hf0K4YjPcn', 'VFgKKxOO66'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, KXterRI5WV5h4shtQl.cs	High entropy of concatenated method names: 'u19emtp1XI', 'iAUe6IahYV', 'O6KeYTPbPv', 'xube50bBsJ', 'cZAefak8NZ', 'AIdeakUtQH', 'vIYec4g4LQ', 'ENHeInV8xF', 'XMreFEkhDg', 'NKte9UZEu8'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, iN3o5Jxff0YjPcnTFg.cs	High entropy of concatenated method names: 'OBR3vvh0ug', 'Cym3LBrjGq', 'xFc3BrlwCu', 'ooZ3h2lvEO', 'b1C3dUp6ec', 'uAJ3DNk9gv', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, sWPPJBS5mPXs8ZupjQ.cs	High entropy of concatenated method names: 'gXJNnyVnin', 'rgXNU2la0v', 'fk7NvA6K4I', 'qEgNLNUnhG', 'YPmNhqDrdK', 'ilOND6hkpB', 'vu8NVlgo5D', 'M6SNgLLqYl', 'wluNMEDMmP', 'g4JNHUmHT6'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, xaNrkwZ5DSgIsK3yXL.cs	High entropy of concatenated method names: 'Tse36IjjZI', 'xJk3Y9jYu2', 'J0t35XXplt', 'NRX3fIQNHt', 'foI3achGUV', 'xOB3c4ZfSP', 'NZK3I27ZqB', 'aqL3F9qg9s', 'Fjp39i4wo0', 'Fcm37WfXps'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, shfnXRdPejheSQTySc.cs	High entropy of concatenated method names: 'BU2EMYsBhy', 'E8hEs7CaQV', 'EWEEddf7Ti', 'h1YE0yVoXU', 'MluELaYCSd', 'WdhEBIl79b', 'QLZEhlkQ8c', 'QavEDKRt6A', 'BPEEJSVOfR', 'TsrEVdcmiQ'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, VpxjIyCFimbjc6WSps.cs	High entropy of concatenated method names: 'IkI4cqvva3', 'eCU4IQi6s2', 'WU949AMmfE', 'cPc47JCM1a', 'xL54E6b2wd', 'OXb4R995ic', 'PNVY1kiBc973DZgkKR', 'i4EuEbUdtfX7TeibKo', 'mit44Mybd1', 'RJA4eIgeVh'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, FUa4tSzj9tk1avVVa3.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'su5oNIkIAa', 'yjCoEbA1cf', 'Ld0oRuXlui', 'XY1ojwgyKw', 'zXwo38ZHjf', 'pMTooWimHm', 'xwkotpH6fD'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, LgHaddTxl5N2h3KPP4.cs	High entropy of concatenated method names: 'csZjZo1UBi', 'ho2j84tDTr', 'A3S3XCw7P6', 'B6634kBfZA', 'tmEjHKWxGE', 'jkJjsrr9Yn', 'sxjjSuaSgC', 'twpjdgCRZD', 'b4Xj02yBWx', 'cqnjksXWtl'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, UVEhrc4XMwtAun7HHOa.cs	High entropy of concatenated method names: 'gMWolNg1gB', 'oTno1koDVO', 'xKyobSvEPN', 'Jl7o2pxRHV', 'JGkoqnO8HT', 'B8moiatop2', 'YgIoWEi9fo', 'jMWonwn6wl', 'zAaoU8JehB', 'jr3ouom3US'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, XOO66K8vtoEq7BITLb.cs	High entropy of concatenated method names: 'OZYo4s0RBd', 'mZ4oe1ePWn', 'UP6oCxsw1c', 'MFqo6VCifv', 'vEFoY0TWP2', 'ndgofKZBnF', 'wOnoarwcmO', 'DkM3rNZjw4', 'tKl3Zx337g', 'Fdo3xF35W3'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, VeueFswoE7Ox3M36eX.cs	High entropy of concatenated method names: 'CULcl1rrLy', 'PCvc1RVvF5', 'Pl6cbIb7l6', 'M1wc2jYFRO', 'aVccqxytSv', 'fikci9X4j8', 'JuqcWhtqdE', 'Wp6cnPGvw4', 'l6kcUXhIv2', 'qC8cuQcA5g'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, KsalxLKjuZvxdSSCr6.cs	High entropy of concatenated method names: 'q3kbVq3bG', 'qHV2JOv6D', 'PkpikeLrD', 'AZBWKqCON', 'oymUm0t5T', 'k83uMjYi1', 'pmWdeJasImpMxj6vwR', 'HMSZD9OEAVRFeIddZG', 'WG03OOft6', 'i6xtHXkif'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, dM1akdueVQZXVlL56b.cs	High entropy of concatenated method names: 'O1sfqZqyNA', 'mYZfWjuHef', 'r9a5Bys3rK', 'JsS5hyO1kL', 'o395DIc0lm', 'fi25JvFF1P', 'usI5VxgHMZ', 'h8W5gyGWMJ', 'YbJ5wgALtK', 'ose5MhuiQ8'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, L95SDJVFDabwJWbcqA.cs	High entropy of concatenated method names: 'rYfc6SGVIl', 'SrPc57skU9', 'uADca7lFUM', 'XEna82Rsxo', 'Ls3azKt8g0', 'nOqcXbbAvB', 'g0sc4xYION', 'aiFcKmIi9s', 'lTQcelGf40', 'sQbcCWhvYE'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, AwdHXbv995icFZqwgS.cs	High entropy of concatenated method names: 'zOEamPwCyJ', 'vBgaYZWuYC', 'YXoafi3N8v', 'XLSacUqqZm', 'QDFaI69qqy', 'fvNfAy4xRQ', 'DKdfTJfj9R', 'GX5frgjEBG', 'tkffZOY3It', 'OWJfxX1q01'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, XH6WeqQ56QFHPXBTFP.cs	High entropy of concatenated method names: 'Ex9j9NsRUW', 'vmmj7t4ntB', 'ToString', 'wnOj6IrITH', 'ofmjYXiqME', 'wGvj52Km2Y', 'xWDjf0MXQS', 'pOcjaTXLwP', 'PCRjc5Y0Q4', 'GcmjIWUk1H'
Source: 0.2.lC7L7oBBMC.exe.3fdd3d0.2.raw.unpack, kqvva3nmCUQi6s2CqL.cs	High entropy of concatenated method names: 'FYgYdmoP0N', 'OUwY0tVDYI', 'UZxYklAydW', 'nVXYQ0I6KO', 'wRBYALJ9Dn', 'DDQYTrR4wb', 'qP0YrFwERB', 'Ke2YZGFycV', 'SxTYxvcBe0', 'c0LY8xM2BB'

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	File created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe			Jump to dropped file
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	File created: C:\Users\user\AppData\Roaming\wlBldyvi.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: lC7L7oBBMC.exe PID: 7120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lC7L7oBBMC.exe PID: 5104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IxumRsOtTdrVAu.exe PID: 7296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wlBldyvi.exe PID: 7700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wlBldyvi.exe PID: 2620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IxumRsOtTdrVAu.exe PID: 6688, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 2B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 7C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 8C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 8E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 9E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 3220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 3450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 3220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 8290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 9290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 9440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: A440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 1400000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 3240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 3050000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 7E30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 8E30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 8FD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 9FD0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: ED0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 2A00000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory allocated: 2860000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 1840000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 3130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 5130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 7F10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 8F10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 90C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: A0C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 11D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 2F40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 4F40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 7700000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 8700000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 8890000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 9890000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 2FB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 3060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 2FB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 7940000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 8940000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 8AD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 9AD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 15C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 30F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory allocated: 50F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 14A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 2F50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory allocated: 1510000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3531	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 554	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4896	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 370	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3438
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3122
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Window / User API: threadDelayed 7817
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Window / User API: threadDelayed 2028
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Window / User API: threadDelayed 3815
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Window / User API: threadDelayed 6004
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Window / User API: threadDelayed 3602
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Window / User API: threadDelayed 6258

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 2552	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4524	Thread sleep count: 3531 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6680	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2460	Thread sleep count: 554 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6444	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 3180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7304	Thread sleep count: 3438 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7356	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep count: 3122 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7484	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7456	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7784	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep count: 33 > 30
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -30437127721620741s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8152	Thread sleep count: 7817 > 30
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -99547s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -99436s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -99219s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8152	Thread sleep count: 2028 > 30
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -98891s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -98781s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -98672s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -98562s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -98453s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -98344s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -98234s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -98125s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -98014s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -97893s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -97609s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -97484s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -97375s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -97265s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -97156s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -97047s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -96937s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -96828s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -96719s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -96609s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -96499s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -96390s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -96279s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -96172s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -96062s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -95953s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -95844s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -95734s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -95622s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -95515s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -95406s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -95296s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -95160s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -95005s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -94875s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -94766s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -94656s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -94547s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -94437s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -94328s >= -30000s
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe TID: 8116	Thread sleep time: -94219s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7752	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 5604	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 4220	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -34126476536362649s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7204	Thread sleep count: 3815 > 30
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -99860s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7204	Thread sleep count: 6004 > 30
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep count: 32 > 30
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -99688s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -99563s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -99438s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -99218s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -98986s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -98860s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -98750s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -98641s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -98516s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -98405s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -98297s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -98188s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -98063s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -97938s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -97828s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -97719s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -97594s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -97485s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -97360s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -97235s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -97110s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -96985s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -96860s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -96735s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -96610s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -96485s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -96362s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -96235s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -96110s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -95985s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -95860s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -95735s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -95610s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -95485s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -95360s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -95235s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -95110s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -94985s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -94860s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -94735s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -94610s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -94485s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -94360s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -94235s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -94110s >= -30000s
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe TID: 7188	Thread sleep time: -93985s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -33204139332677172s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -99873s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7364	Thread sleep count: 3602 > 30
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7364	Thread sleep count: 6258 > 30
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -99546s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -99436s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -99327s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -99211s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -99093s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -98984s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -98874s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -98765s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -98644s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -98515s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -98406s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -98297s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -98187s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -98078s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -97968s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -97859s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -97750s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -97640s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -97531s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -97421s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -97312s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -97203s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -97093s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -96980s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -96875s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -96765s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -96656s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -96546s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -96437s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -96327s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -96211s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -96109s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -95999s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -95890s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -95781s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -95671s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -95549s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -95422s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -95312s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -95202s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -95093s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -94984s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -94858s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -94750s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -94640s >= -30000s
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe TID: 7372	Thread sleep time: -94516s >= -30000s

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 99875
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 99765
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 99547
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 99436
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 99328
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 99219
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 99109
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 99000
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 98891
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 98781
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 98672
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 98562
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 98453
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 98344
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 98234
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 98125
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 98014
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 97893
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 97609
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 97484
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 97375
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 97265
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 97156
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 97047
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 96937
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 96828
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 96719
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 96609
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 96499
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 96390
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 96279
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 96172
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 96062
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 95953
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 95844
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 95734
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 95622
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 95515
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 95406
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 95296
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 95160
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 95005
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 94875
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 94766
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 94656
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 94547
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 94437
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 94328
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Thread delayed: delay time: 94219
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 99860
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 99688
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 99563
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 99438
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 99218
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 98986
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 98860
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 98750
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 98641
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 98516
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 98405
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 98297
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 98188
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 98063
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 97938
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 97828
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 97719
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 97594
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 97485
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 97360
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 97235
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 97110
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 96985
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 96860
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 96735
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 96610
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 96485
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 96362
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 96235
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 96110
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 95985
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 95860
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 95735
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 95610
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 95485
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 95360
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 95235
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 95110
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 94985
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 94860
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 94735
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 94610
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 94485
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 94360
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 94235
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 94110
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Thread delayed: delay time: 93985
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 99873
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 99765
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 99546
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 99436
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 99327
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 99211
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 99093
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 98984
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 98874
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 98765
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 98644
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 98515
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 98406
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 98297
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 98187
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 98078
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 97968
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 97859
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 97750
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 97640
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 97531
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 97421
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 97312
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 97203
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 97093
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 96980
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 96875
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 96765
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 96656
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 96546
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 96437
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 96327
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 96211
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 96109
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 95999
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 95890
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 95781
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 95671
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 95549
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 95422
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 95312
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 95202
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 95093
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 94984
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 94858
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 94750
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 94640
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Thread delayed: delay time: 94516

Source: IxumRsOtTdrVAu.exe, 00000011.00000002.1396294446.0000000007375000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: IxumRsOtTdrVAu.exe, 00000011.00000002.1396294446.0000000007375000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: IxumRsOtTdrVAu.exe, 0000001F.00000002.1375709751.0000000001504000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\gk
Source: lC7L7oBBMC.exe, 00000013.00000002.2483607723.0000000000C64000.00000004.00000020.00020000.00000000.sdmp, wlBldyvi.exe, 00000025.00000002.2487940592.000000000142A000.00000004.00000020.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000027.00000002.2484191024.000000000121E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe"
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe"
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wlBldyvi.exe"
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wlBldyvi.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory written: C:\Users\user\Desktop\lC7L7oBBMC.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Memory written: C:\Users\user\Desktop\lC7L7oBBMC.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory written: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory written: C:\Users\user\AppData\Roaming\wlBldyvi.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Memory written: C:\Users\user\AppData\Roaming\wlBldyvi.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Memory written: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Users\user\Desktop\lC7L7oBBMC.exe "C:\Users\user\Desktop\lC7L7oBBMC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wlBldyvi.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpE08F.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Process created: C:\Users\user\Desktop\lC7L7oBBMC.exe "C:\Users\user\Desktop\lC7L7oBBMC.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF62A.tmp"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF58E.tmp"
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Process created: C:\Users\user\AppData\Roaming\wlBldyvi.exe "C:\Users\user\AppData\Roaming\wlBldyvi.exe"
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpFF91.tmp"
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Process created: C:\Users\user\AppData\Roaming\wlBldyvi.exe "C:\Users\user\AppData\Roaming\wlBldyvi.exe"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpFF43.tmp"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Process created: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Users\user\Desktop\lC7L7oBBMC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Users\user\Desktop\lC7L7oBBMC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Users\user\Desktop\lC7L7oBBMC.exe VolumeInformation
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Users\user\AppData\Roaming\wlBldyvi.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Users\user\AppData\Roaming\wlBldyvi.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Users\user\AppData\Roaming\wlBldyvi.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.45436d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.4508cb0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.45436d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.4508cb0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000002.2491122015.000000000316C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2491663736.0000000002A7C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2481915050.0000000000436000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2491122015.0000000003141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2490785586.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2491663736.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2490785586.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lC7L7oBBMC.exe PID: 5104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lC7L7oBBMC.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wlBldyvi.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IxumRsOtTdrVAu.exe PID: 5096, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\Desktop\lC7L7oBBMC.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\wlBldyvi.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.45436d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.4508cb0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.45436d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.4508cb0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000027.00000002.2481915050.0000000000436000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2491122015.0000000003141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2491663736.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2490785586.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lC7L7oBBMC.exe PID: 5104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lC7L7oBBMC.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wlBldyvi.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IxumRsOtTdrVAu.exe PID: 5096, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.45436d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.4508cb0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.45436d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.lC7L7oBBMC.exe.4508cb0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000002.2491122015.000000000316C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2491663736.0000000002A7C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2481915050.0000000000436000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2491122015.0000000003141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2490785586.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2491663736.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2490785586.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lC7L7oBBMC.exe PID: 5104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lC7L7oBBMC.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wlBldyvi.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IxumRsOtTdrVAu.exe PID: 5096, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	2 Obfuscated Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	12 Software Packing	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
lC7L7oBBMC.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.Remcos
lC7L7oBBMC.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\wlBldyvi.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.Remcos
C:\Users\user\AppData\Roaming\wlBldyvi.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.Remcos

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.iaa-airferight.com	46.175.148.58	true	false		high
api.ipify.org	104.26.13.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.ipify.org	lC7L7oBBMC.exe, 00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp, lC7L7oBBMC.exe, 00000013.00000002.2491663736.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, lC7L7oBBMC.exe, 00000013.00000002.2481907734.0000000000434000.00000040.00000400.00020000.00000000.sdmp, wlBldyvi.exe, 00000025.00000002.2491122015.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000027.00000002.2490785586.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false	high
https://account.dyn.com/	lC7L7oBBMC.exe, 00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000027.00000002.2481915050.0000000000436000.00000040.00000400.00020000.00000000.sdmp	false	high
https://api.ipify.org/t	lC7L7oBBMC.exe, 00000013.00000002.2491663736.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, wlBldyvi.exe, 00000025.00000002.2491122015.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000027.00000002.2490785586.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	lC7L7oBBMC.exe, 00000000.00000002.1271041828.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, lC7L7oBBMC.exe, 00000009.00000002.1296219521.000000000349B000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000011.00000002.1358182217.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, lC7L7oBBMC.exe, 00000013.00000002.2491663736.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, wlBldyvi.exe, 00000015.00000002.1350292766.0000000003190000.00000004.00000800.00020000.00000000.sdmp, wlBldyvi.exe, 0000001E.00000002.1380641575.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 0000001F.00000002.1377942726.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, wlBldyvi.exe, 00000025.00000002.2491122015.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000027.00000002.2490785586.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mail.iaa-airferight.com	lC7L7oBBMC.exe, 00000013.00000002.2491663736.0000000002A7C000.00000004.00000800.00020000.00000000.sdmp, wlBldyvi.exe, 00000025.00000002.2491122015.000000000316C000.00000004.00000800.00020000.00000000.sdmp, IxumRsOtTdrVAu.exe, 00000027.00000002.2490785586.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	false
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569297
Start date and time:	2024-12-05 17:39:43 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lC7L7oBBMC.exe renamed because original name is a hash value
Original Sample Name:	0787749d9897612314975e2943139157efcff4dbf604323d3d950c76b7555719.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@50/30@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 313 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: lC7L7oBBMC.exe

Simulations

Behavior and APIs

Time	Type	Description
11:40:36	API Interceptor	189x Sleep call for process: lC7L7oBBMC.exe modified
11:40:37	API Interceptor	93x Sleep call for process: powershell.exe modified
11:40:43	API Interceptor	172x Sleep call for process: wlBldyvi.exe modified
11:40:43	API Interceptor	190x Sleep call for process: IxumRsOtTdrVAu.exe modified
17:40:38	Task Scheduler	Run new task: IxumRsOtTdrVAu path: C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe
17:40:41	Task Scheduler	Run new task: wlBldyvi path: C:\Users\user\AppData\Roaming\wlBldyvi.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.175.148.58	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	RFQ ENQ186 OI REQUIRE RATE.exe	Get hash	malicious	AgentTesla	Browse
	v58HgfB8Af.exe	Get hash	malicious	AgentTesla	Browse
	l6F8Xgr0Ov.exe	Get hash	malicious	AgentTesla	Browse
	SPlVyHiGOz.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	2bOizaPPDC.exe	Get hash	malicious	AgentTesla	Browse
	McEdhqMMhs.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	55qIbHIAZi.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	tEEa6j67ss.exe	Get hash	malicious	AgentTesla	Browse
	RXvVlckUyt.exe	Get hash	malicious	AgentTesla	Browse
104.26.13.205	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	46.175.148.58
	RFQ ENQ186 OI REQUIRE RATE.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	v58HgfB8Af.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	l6F8Xgr0Ov.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SPlVyHiGOz.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	2bOizaPPDC.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	McEdhqMMhs.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	55qIbHIAZi.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	tEEa6j67ss.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	RXvVlckUyt.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
api.ipify.org	0wxckB4Iba.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152
	8JuGuaUaZP.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	lUy4SKlE6A.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	xFHqehx1tb.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	https://app.peony.ink/view/902b02a8-11f0-4e28-89b1-5318035c10eb	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.12.205
	7Gt3icFvQW.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	1AxSwjpyGp.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	FPBKcOFjEP.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	MerchantDetailedStatement_37063_04122024.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLAGIDKOM-NETUA	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	46.175.148.58
	RFQ ENQ186 OI REQUIRE RATE.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	v58HgfB8Af.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	l6F8Xgr0Ov.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SPlVyHiGOz.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	2bOizaPPDC.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	McEdhqMMhs.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	55qIbHIAZi.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	tEEa6j67ss.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	RXvVlckUyt.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
CLOUDFLARENETUS	https://tippfloorcovering-my.sharepoint.com/:f:/g/personal/inderjeet_tippfloor_com/EpEIzIGDzrlMs2z8rWgki5MBO5-d64iEaOqqeF3ulFqTiw?e=T39wgl	Get hash	malicious	Unknown	Browse	104.17.25.14
	NBMZzcmkwv.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	0wxckB4Iba.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	6SQADa3zKv.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	172.67.153.63
	Uit9z2gICf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152
	3D7sM44MQp.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	8JuGuaUaZP.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	lUy4SKlE6A.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	http://kitces.emlnk1.com	Get hash	malicious	Unknown	Browse	104.20.0.15

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	0wxckB4Iba.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	104.26.13.205
	8JuGuaUaZP.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	lUy4SKlE6A.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DX7V71Ro7b.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.13.205
	xFHqehx1tb.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.13.205
	9KpgpwwGDy.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	z43INF_20231205_A1B5C3.msi	Get hash	malicious	Unknown	Browse	104.26.13.205
	9V4TlKwcz3.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.26.13.205
	uC70JKtV2B.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.26.13.205

Process:	C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lC7L7oBBMC.exe.log

Download File

Process:	C:\Users\user\Desktop\lC7L7oBBMC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wlBldyvi.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\wlBldyvi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeC/ZPUyus:lGLHyIFKL3IZ2KRH9Oug8s
MD5:	16AD599332DD2FF94DA0787D71688B62
SHA1:	02F738694B02E84FFE3BAB7DE5709001823C6E40
SHA-256:	452876FE504FC0DBEDBD7F8467E94F6E80002DB4572D02C723ABC69F8DF0B367
SHA-512:	A96158FDFFA424A4AC01220EDC789F3236C03AAA6A7C1A3D8BE62074B4923957E6CFEEB6E8852F9064093E0A290B0E56E4B5504D18113A7983F48D5388CEC747
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gz2shuo.dfp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1awe5qq0.ksy.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1fdh1edr.lrp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4l3ik1zg.pay.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_acyk3i0h.un0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cigkw2n1.y1p.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d2gplr0b.ao5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dpqoyc5y.tah.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f2ovf0ty.zsr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gawabjj2.cwq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ktb0hcjs.fq4.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mh5g3rwe.ocw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ospkdnxg.zwf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pfoj5gfd.td5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pohnw1oo.kf4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_unqslkvr.eq4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp

Download File

Process:	C:\Users\user\Desktop\lC7L7oBBMC.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1608
Entropy (8bit):	5.121045418549901
Encrypted:	false
SSDEEP:	24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtoxvn:cgeHgYrFdOFzOzN33ODOiDdKrsuTIv
MD5:	CCF751F0708312C1F09712FF505FB361
SHA1:	DC764494A6FC45E47FFAED341F1612462B33D78F
SHA-256:	A60FA011C74A00086E86B90F8FBAB9008FFCD5B54324C796B74CDE745A66E874
SHA-512:	6DE89E674780F4BCB531EF15E940A8CEFC323E2932703BFC98A8AC10BE049827B303431494DEF0742CC67F9DC3ABD355A50F5598E5C8F42657ED96845DE93305
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Local\Temp\tmpE08F.tmp

Download File

Process:	C:\Users\user\Desktop\lC7L7oBBMC.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1602
Entropy (8bit):	5.1156773331901695
Encrypted:	false
SSDEEP:	24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt7axvn:cgeHgYrFdOFzOzN33ODOiDdKrsuTav
MD5:	5CBAA6557044D92627BFE66627F1953C
SHA1:	BAD1C7FCB0FB7FB3D128B8ECCE2965381803E12A
SHA-256:	D6275AA46B9DF736C1B968B72172FF22F783B3962E1B9B632D9ABBF3815B8CCD
SHA-512:	41931120D79AB006F15D7245262C95545C277769237A21FBC843618DDE8B4A5BA97EFE07E0C5D9FC52FA4FC946E3BCD45AD97348FAC5ECC53D68741EA51969F8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Local\Temp\tmpF58E.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\wlBldyvi.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1608
Entropy (8bit):	5.121045418549901
Encrypted:	false
SSDEEP:	24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtoxvn:cgeHgYrFdOFzOzN33ODOiDdKrsuTIv
MD5:	CCF751F0708312C1F09712FF505FB361
SHA1:	DC764494A6FC45E47FFAED341F1612462B33D78F
SHA-256:	A60FA011C74A00086E86B90F8FBAB9008FFCD5B54324C796B74CDE745A66E874
SHA-512:	6DE89E674780F4BCB531EF15E940A8CEFC323E2932703BFC98A8AC10BE049827B303431494DEF0742CC67F9DC3ABD355A50F5598E5C8F42657ED96845DE93305
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Local\Temp\tmpF62A.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1608
Entropy (8bit):	5.121045418549901
Encrypted:	false
SSDEEP:	24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtoxvn:cgeHgYrFdOFzOzN33ODOiDdKrsuTIv
MD5:	CCF751F0708312C1F09712FF505FB361
SHA1:	DC764494A6FC45E47FFAED341F1612462B33D78F
SHA-256:	A60FA011C74A00086E86B90F8FBAB9008FFCD5B54324C796B74CDE745A66E874
SHA-512:	6DE89E674780F4BCB531EF15E940A8CEFC323E2932703BFC98A8AC10BE049827B303431494DEF0742CC67F9DC3ABD355A50F5598E5C8F42657ED96845DE93305
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Local\Temp\tmpFF43.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1602
Entropy (8bit):	5.1156773331901695
Encrypted:	false
SSDEEP:	24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt7axvn:cgeHgYrFdOFzOzN33ODOiDdKrsuTav
MD5:	5CBAA6557044D92627BFE66627F1953C
SHA1:	BAD1C7FCB0FB7FB3D128B8ECCE2965381803E12A
SHA-256:	D6275AA46B9DF736C1B968B72172FF22F783B3962E1B9B632D9ABBF3815B8CCD
SHA-512:	41931120D79AB006F15D7245262C95545C277769237A21FBC843618DDE8B4A5BA97EFE07E0C5D9FC52FA4FC946E3BCD45AD97348FAC5ECC53D68741EA51969F8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Local\Temp\tmpFF91.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\wlBldyvi.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1602
Entropy (8bit):	5.1156773331901695
Encrypted:	false
SSDEEP:	24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt7axvn:cgeHgYrFdOFzOzN33ODOiDdKrsuTav
MD5:	5CBAA6557044D92627BFE66627F1953C
SHA1:	BAD1C7FCB0FB7FB3D128B8ECCE2965381803E12A
SHA-256:	D6275AA46B9DF736C1B968B72172FF22F783B3962E1B9B632D9ABBF3815B8CCD
SHA-512:	41931120D79AB006F15D7245262C95545C277769237A21FBC843618DDE8B4A5BA97EFE07E0C5D9FC52FA4FC946E3BCD45AD97348FAC5ECC53D68741EA51969F8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe

Download File

Process:	C:\Users\user\Desktop\lC7L7oBBMC.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1452032
Entropy (8bit):	7.903490142167658
Encrypted:	false
SSDEEP:	24576:szSWNKs08nmbdXiQsGgJF2B+xaJ/ncPUoN0eaxn7wymHinDVw2iTYYuX0J:gSPGyXi0gbKCikPPN0fxn7NmHinDVw2e
MD5:	4C363AFC82B0757D2723FF1287AB85DE
SHA1:	EAE78234D3125EDB5E161641B1C61DFAB9456A46
SHA-256:	0787749D9897612314975E2943139157EFCFF4DBF604323D3D950C76B7555719
SHA-512:	C202CB6C3B8BEF7CB556C335595C03E7DA412E00466491E3BBBEC15391BEC8250D944ADA1EB4B4E5D6215D39C2F28996A025A6DE78243570382CF188744D8AC3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...zl................0......d......^.... ........@.. ....................................@.....................................O........a..............0L..........p...p............................................ ............... ..H............text...d.... ...................... ..`.rsrc....a.......b..................@..@.reloc...............&..............@..B................@.......H.......D?... ......%...._...n...........................................0..#........~.........,..s..........~.....+.....}.....(.......(......{....(....\|....(....o.......".(........0..+.........,..{.......+....,...{....o........(.....*..0..>.........s....}.....s....}.....s....}.....s....}.....{....o......{....o......(......{.....o......{....o ....{....o!.....{....o ....{....o!.....{....o ....{....o!.....{.....o".....{......s#...o$.....{....r...po%.....{.... ... ....s&...

C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\lC7L7oBBMC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\wlBldyvi.exe

Download File

Process:	C:\Users\user\Desktop\lC7L7oBBMC.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1452032
Entropy (8bit):	7.903490142167658
Encrypted:	false
SSDEEP:	24576:szSWNKs08nmbdXiQsGgJF2B+xaJ/ncPUoN0eaxn7wymHinDVw2iTYYuX0J:gSPGyXi0gbKCikPPN0fxn7NmHinDVw2e
MD5:	4C363AFC82B0757D2723FF1287AB85DE
SHA1:	EAE78234D3125EDB5E161641B1C61DFAB9456A46
SHA-256:	0787749D9897612314975E2943139157EFCFF4DBF604323D3D950C76B7555719
SHA-512:	C202CB6C3B8BEF7CB556C335595C03E7DA412E00466491E3BBBEC15391BEC8250D944ADA1EB4B4E5D6215D39C2F28996A025A6DE78243570382CF188744D8AC3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...zl................0......d......^.... ........@.. ....................................@.....................................O........a..............0L..........p...p............................................ ............... ..H............text...d.... ...................... ..`.rsrc....a.......b..................@..@.reloc...............&..............@..B................@.......H.......D?... ......%...._...n...........................................0..#........~.........,..s..........~.....+.....}.....(.......(......{....(....\|....(....o.......".(........0..+.........,..{.......+....,...{....o........(.....*..0..>.........s....}.....s....}.....s....}.....s....}.....{....o......{....o......(......{.....o......{....o ....{....o!.....{....o ....{....o!.....{....o ....{....o!.....{.....o".....{......s#...o$.....{....r...po%.....{.... ... ....s&...

C:\Users\user\AppData\Roaming\wlBldyvi.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\lC7L7oBBMC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.903490142167658
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	lC7L7oBBMC.exe
File size:	1'452'032 bytes
MD5:	4c363afc82b0757d2723ff1287ab85de
SHA1:	eae78234d3125edb5e161641b1c61dfab9456a46
SHA256:	0787749d9897612314975e2943139157efcff4dbf604323d3d950c76b7555719
SHA512:	c202cb6c3b8bef7cb556c335595c03e7da412e00466491e3bbbec15391bec8250d944ada1eb4b4e5d6215d39c2f28996a025a6de78243570382cf188744d8ac3
SSDEEP:	24576:szSWNKs08nmbdXiQsGgJF2B+xaJ/ncPUoN0eaxn7wymHinDVw2iTYYuX0J:gSPGyXi0gbKCikPPN0fxn7NmHinDVw2e
TLSH:	776512EA3DACCA20E291ACB8B251D88F3574D903262EFD5A52E00E5E47DC777291C1D7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...zl................0......d......^.... ........@.. ....................................@................................

File Icon


Icon Hash:	145cfcf8f2e8cc52

Static PE Info

General

Entrypoint:	0x52e05e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE1106C7A [Sat Aug 27 02:59:06 2089 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12e00c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x130000	0x36118	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x12ce00	0x4c30
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x168000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x12ce70	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x12c064	0x12c200	05130a0aec3c78017b38bc4ef05662b4	False	0.9919336995002083	data	7.992598388880175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x130000	0x36118	0x36200	1bdbb18f7b4ba2409f60e76d305732c2	False	0.4746725245381062	data	6.613426793550106	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x168000	0xc	0x200	3177096e7a19c2ee344ad888c4329dd8	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x1302b0	0xe0be	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9943859283206452
RT_ICON	0x13e370	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.2501330888441973
RT_ICON	0x14eb98	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.30849274752995587
RT_ICON	0x158040	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.31963955637707947
RT_ICON	0x15d4c8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.3098134152102031
RT_ICON	0x1616f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.3566390041493776
RT_ICON	0x163c98	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.4268292682926829
RT_ICON	0x164d40	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.49631147540983606
RT_ICON	0x1656c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5886524822695035
RT_GROUP_ICON	0x165b30	0x84	data	0.7045454545454546
RT_VERSION	0x165bb4	0x378	data	0.40765765765765766
RT_MANIFEST	0x165f2c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 17:40:42.203234911 CET	49703	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:42.203263998 CET	443	49703	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:42.203362942 CET	49703	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:42.210294962 CET	49703	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:42.210309029 CET	443	49703	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:43.436625004 CET	443	49703	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:43.437046051 CET	49703	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:43.440110922 CET	49703	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:43.440115929 CET	443	49703	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:43.440535069 CET	443	49703	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:43.486531973 CET	49703	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:43.489466906 CET	49703	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:43.535326958 CET	443	49703	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:43.881473064 CET	443	49703	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:43.881544113 CET	443	49703	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:43.881617069 CET	49703	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:43.894164085 CET	49703	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:44.690990925 CET	49705	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:40:45.689654112 CET	49705	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:40:47.689611912 CET	49705	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:40:49.719019890 CET	49712	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:49.719077110 CET	443	49712	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:49.719301939 CET	49712	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:49.724508047 CET	49712	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:49.724526882 CET	443	49712	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:49.951370955 CET	49713	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:49.951407909 CET	443	49713	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:49.951608896 CET	49713	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:49.954796076 CET	49713	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:49.954817057 CET	443	49713	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.009011030 CET	443	49712	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.009123087 CET	49712	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:51.012345076 CET	49712	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:51.012356043 CET	443	49712	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.012614012 CET	443	49712	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.080228090 CET	49712	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:51.175988913 CET	49712	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:51.191914082 CET	443	49713	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.192024946 CET	49713	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:51.193408012 CET	49713	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:51.193417072 CET	443	49713	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.193689108 CET	443	49713	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.223340988 CET	443	49712	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.331625938 CET	49713	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:51.367397070 CET	49713	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:51.411324978 CET	443	49713	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.520603895 CET	443	49712	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.520683050 CET	443	49712	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.520765066 CET	49712	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:51.523677111 CET	49712	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:51.689620018 CET	49705	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:40:51.730295897 CET	443	49713	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.730356932 CET	443	49713	104.26.13.205	192.168.2.7
Dec 5, 2024 17:40:51.730505943 CET	49713	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:51.733551979 CET	49713	443	192.168.2.7	104.26.13.205
Dec 5, 2024 17:40:52.174324989 CET	49719	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:40:52.390620947 CET	49720	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:40:53.205233097 CET	49719	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:40:53.392761946 CET	49720	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:40:55.205218077 CET	49719	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:40:55.408345938 CET	49720	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:40:59.205249071 CET	49719	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:40:59.408361912 CET	49720	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:40:59.689651012 CET	49705	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:41:07.205744982 CET	49719	25	192.168.2.7	46.175.148.58
Dec 5, 2024 17:41:07.408377886 CET	49720	25	192.168.2.7	46.175.148.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 17:40:42.054945946 CET	62163	53	192.168.2.7	1.1.1.1
Dec 5, 2024 17:40:42.192514896 CET	53	62163	1.1.1.1	192.168.2.7
Dec 5, 2024 17:40:44.500349998 CET	54145	53	192.168.2.7	1.1.1.1
Dec 5, 2024 17:40:44.689882040 CET	53	54145	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 5, 2024 17:40:42.054945946 CET	192.168.2.7	1.1.1.1	0x179c	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 5, 2024 17:40:44.500349998 CET	192.168.2.7	1.1.1.1	0x12a7	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 5, 2024 17:40:42.192514896 CET	1.1.1.1	192.168.2.7	0x179c	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 5, 2024 17:40:42.192514896 CET	1.1.1.1	192.168.2.7	0x179c	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 5, 2024 17:40:42.192514896 CET	1.1.1.1	192.168.2.7	0x179c	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 5, 2024 17:40:44.689882040 CET	1.1.1.1	192.168.2.7	0x12a7	No error (0)	mail.iaa-airferight.com	46.175.148.58	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	104.26.13.205	443	7488	C:\Users\user\Desktop\lC7L7oBBMC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:40:43 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-05 16:40:43 UTC	424	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 16:40:43 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ed57ac92ba94333-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1661&min_rtt=1640&rtt_var=630&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2819&recv_bytes=769&delivery_rate=1780487&cwnd=248&unsent_bytes=0&cid=3d03f49fbab519a5&ts=459&x=0"
2024-12-05 16:40:43 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49712	104.26.13.205	443	2708	C:\Users\user\AppData\Roaming\wlBldyvi.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:40:51 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-05 16:40:51 UTC	426	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 16:40:51 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ed57af8ddd1430e-EWR server-timing: cfL4;desc="?proto=TCP&rtt=15385&min_rtt=1665&rtt_var=8892&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1753753&cwnd=179&unsent_bytes=0&cid=d55d94b337a3635c&ts=524&x=0"
2024-12-05 16:40:51 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49713	104.26.13.205	443	5096	C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 16:40:51 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-05 16:40:51 UTC	424	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 16:40:51 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ed57afa09eb42b5-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1730&min_rtt=1712&rtt_var=679&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=769&delivery_rate=1569048&cwnd=214&unsent_bytes=0&cid=0f486aeb2ca5423b&ts=542&x=0"
2024-12-05 16:40:51 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Target ID:	0
Start time:	11:40:35
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\lC7L7oBBMC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lC7L7oBBMC.exe"
Imagebase:	0x650000
File size:	1'452'032 bytes
MD5 hash:	4C363AFC82B0757D2723FF1287AB85DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:40:36
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe"
Imagebase:	0x4f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:40:36
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:40:36
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Imagebase:	0x4f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:40:36
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:40:36
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CF.tmp"
Imagebase:	0x2a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:40:36
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:40:37
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\lC7L7oBBMC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lC7L7oBBMC.exe"
Imagebase:	0xfa0000
File size:	1'452'032 bytes
MD5 hash:	4C363AFC82B0757D2723FF1287AB85DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1299742405.0000000004482000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:40:38
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\lC7L7oBBMC.exe"
Imagebase:	0x4f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:40:38
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:40:38
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wlBldyvi.exe"
Imagebase:	0x4f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:40:38
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:40:38
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpE08F.tmp"
Imagebase:	0x2a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:40:38
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe
Imagebase:	0xc40000
File size:	1'452'032 bytes
MD5 hash:	4C363AFC82B0757D2723FF1287AB85DE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:40:39
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:40:39
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\lC7L7oBBMC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lC7L7oBBMC.exe"
Imagebase:	0x540000
File size:	1'452'032 bytes
MD5 hash:	4C363AFC82B0757D2723FF1287AB85DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.2491663736.0000000002A7C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.2491663736.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.2491663736.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	11:40:39
Start date:	05/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7fb730000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:40:41
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\wlBldyvi.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\wlBldyvi.exe
Imagebase:	0xce0000
File size:	1'452'032 bytes
MD5 hash:	4C363AFC82B0757D2723FF1287AB85DE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:40:44
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF58E.tmp"
Imagebase:	0x2a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:40:44
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxumRsOtTdrVAu" /XML "C:\Users\user\AppData\Local\Temp\tmpF62A.tmp"
Imagebase:	0x2a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:40:44
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:40:44
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:40:44
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\wlBldyvi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\wlBldyvi.exe"
Imagebase:	0xa40000
File size:	1'452'032 bytes
MD5 hash:	4C363AFC82B0757D2723FF1287AB85DE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:40:44
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Imagebase:	0xc20000
File size:	1'452'032 bytes
MD5 hash:	4C363AFC82B0757D2723FF1287AB85DE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:40:46
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpFF43.tmp"
Imagebase:	0x2a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:40:46
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\user\AppData\Local\Temp\tmpFF91.tmp"
Imagebase:	0x2a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:40:46
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:40:47
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:40:47
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Imagebase:	0xe0000
File size:	1'452'032 bytes
MD5 hash:	4C363AFC82B0757D2723FF1287AB85DE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:40:47
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\wlBldyvi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\wlBldyvi.exe"
Imagebase:	0xc40000
File size:	1'452'032 bytes
MD5 hash:	4C363AFC82B0757D2723FF1287AB85DE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000002.2491122015.000000000316C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000025.00000002.2491122015.0000000003141000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000002.2491122015.0000000003141000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	11:40:47
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Imagebase:	0x1b0000
File size:	1'452'032 bytes
MD5 hash:	4C363AFC82B0757D2723FF1287AB85DE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:40:47
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\IxumRsOtTdrVAu.exe"
Imagebase:	0xb30000
File size:	1'452'032 bytes
MD5 hash:	4C363AFC82B0757D2723FF1287AB85DE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000002.2481915050.0000000000436000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000027.00000002.2481915050.0000000000436000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000027.00000002.2490785586.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000002.2490785586.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000027.00000002.2490785586.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	174
Total number of Limit Nodes:	10

Executed Functions

Function 0745D907 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8a688d0e5022ae0b961db12eb21a43aa62b563c2fa099a104450a58b0974ace
Instruction ID: 26d4328122299c506dfc2203766a6510069cd5af1aad87fd5ab74d0313481d5e
Opcode Fuzzy Hash: d8a688d0e5022ae0b961db12eb21a43aa62b563c2fa099a104450a58b0974ace
Instruction Fuzzy Hash: 27E1BDB1B016048FDB29DB75C4A0BAFB7F6AF89300F14446EE4469B392CB35D902CB52

Function 07451748 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76335ddc5f2c55bf8cff2da95aef1c89ce5b3fd421bd58ccf7c6db47fda8418c
Instruction ID: c261ba4c7eb3bd9bc2715715dbe8c6892884302860bbae2ae5ed245295c6ef38
Opcode Fuzzy Hash: 76335ddc5f2c55bf8cff2da95aef1c89ce5b3fd421bd58ccf7c6db47fda8418c
Instruction Fuzzy Hash: 02413DB5D0425CDFEB14CF5AC8407EEBBB6BF8A300F04C5AAD808A6256D7345985CF51

Function 00EDD0A8 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00EDD136
GetCurrentThread.KERNEL32 ref: 00EDD173
GetCurrentProcess.KERNEL32 ref: 00EDD1B0
GetCurrentThreadId.KERNEL32 ref: 00EDD209

Memory Dump Source

Source File: 00000000.00000002.1265824635.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_lC7L7oBBMC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8e9c887c9d5ab57761f3454beed8ff1c7f59edff2606d13bc0b73e3e496609c2
Instruction ID: f1c7deb051629e9fac35d34de5d97b9b72f498805b12d73f0168d72527e27b72
Opcode Fuzzy Hash: 8e9c887c9d5ab57761f3454beed8ff1c7f59edff2606d13bc0b73e3e496609c2
Instruction Fuzzy Hash: CE5166B0D013098FDB14DFA9D949B9EBBF1EF88314F20849AE018A73A0C7759946CB61

Function 00EDD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00EDD136
GetCurrentThread.KERNEL32 ref: 00EDD173
GetCurrentProcess.KERNEL32 ref: 00EDD1B0
GetCurrentThreadId.KERNEL32 ref: 00EDD209

Memory Dump Source

Source File: 00000000.00000002.1265824635.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_lC7L7oBBMC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 65f417e76d268850c51791be762bb5fba12ea5ae54fd680e8e90f39db4d2b4be
Instruction ID: c2621f3d6bab13651a270289ae3814e68a1819852c4848b8f3afae5b72b5ecff
Opcode Fuzzy Hash: 65f417e76d268850c51791be762bb5fba12ea5ae54fd680e8e90f39db4d2b4be
Instruction Fuzzy Hash: F95174B0D013098FDB14DFAAD949B9EBBF1EF88314F208459E018B7360CB74A945CB65

Function 07458DA6 Relevance: 1.8, APIs: 1, Instructions: 274
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 07458FE6

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4337b879b07f75d58ff95a5801d6d5c503e4ffdc1379f3de48af65fc2f224c2f
Instruction ID: 181a807a4f03802edb89856df3c21f7d1143ad4240090677cf1686f8054a0848
Opcode Fuzzy Hash: 4337b879b07f75d58ff95a5801d6d5c503e4ffdc1379f3de48af65fc2f224c2f
Instruction Fuzzy Hash: 0CA16EB1D0071ADFEB24DF68C841BDEBBB6BF48310F14856AE808A7241DB759985CF91

Function 07458DB0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 07458FE6

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9353d35fa37901652998cc9c4982209aec1eba46a28898ebbbed1acfc2e550e3
Instruction ID: 276693f1dcf478d6366988f48fb4923a15d9393758f499efb0896b7186b2c182
Opcode Fuzzy Hash: 9353d35fa37901652998cc9c4982209aec1eba46a28898ebbbed1acfc2e550e3
Instruction Fuzzy Hash: BE914BB1D0061ADFEB24DF68C841BDEBBB6BB48310F14856AE808A7241DB759985CF91

Function 00EDAE30 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00EDB086

Memory Dump Source

Source File: 00000000.00000002.1265824635.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_lC7L7oBBMC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0c3be8565ba93cfea8c5adef70914e262aa3ca47a0fa3a94d98ce8a2a34fdbf4
Instruction ID: be065c5f3516c77dbed6af8448af2b9fa2177655b6d146890afb8ef271a87dcb
Opcode Fuzzy Hash: 0c3be8565ba93cfea8c5adef70914e262aa3ca47a0fa3a94d98ce8a2a34fdbf4
Instruction Fuzzy Hash: 8B813370A00B058FD724DF29D44179ABBF1FB88304F04992ED48AEBB51D775E94ACB91

Function 00ED449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00ED59C9

Memory Dump Source

Source File: 00000000.00000002.1265824635.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_lC7L7oBBMC.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 681c5d93b6d8037d89ee597ed4aced32aedd9030b1cd47051c3d215d966f769e
Instruction ID: 9e6c5c8ff64063883faf1538ef43c1e11c09350db6ed6f42ef36b132be7584bf
Opcode Fuzzy Hash: 681c5d93b6d8037d89ee597ed4aced32aedd9030b1cd47051c3d215d966f769e
Instruction Fuzzy Hash: EA41D271C0072DCBEB24DFAAC844B9DBBB5FF49314F20816AD408AB251DB756946CF90

Function 00ED590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00ED59C9

Memory Dump Source

Source File: 00000000.00000002.1265824635.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_lC7L7oBBMC.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e49e2da71d4bf066fd5d4f7cf5586005f8c1a57a2e99d94c30fc346d64f74ad7
Instruction ID: 27564b9f36f0c9be1f1f8321d8c0bfb70a61aca13504ac7a39e188874d6c81d0
Opcode Fuzzy Hash: e49e2da71d4bf066fd5d4f7cf5586005f8c1a57a2e99d94c30fc346d64f74ad7
Instruction Fuzzy Hash: 7741D1B1C0072DCBEB24DFAAC88478DBBF5BF49314F20815AD419AB251DB755946CF90

Function 00EDD2F8 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00EDD387

Memory Dump Source

Source File: 00000000.00000002.1265824635.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_lC7L7oBBMC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d72b77f432e08f2e280a814faa1da94b14aa88079a0d92c130f9e2933eabb41d
Instruction ID: 7bfe6610dfce8d9940bcc2007eeae3ea33f6526a1c76211df21df397f5f6e9f4
Opcode Fuzzy Hash: d72b77f432e08f2e280a814faa1da94b14aa88079a0d92c130f9e2933eabb41d
Instruction Fuzzy Hash: 6A2137B58003499FDB20CFAAD885ADEFFF5EB49324F14811AE954A7350C379A941CFA1

Function 07458B28 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 07458BB8

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2f72c7c31729c53455d122e8f732c6370b8aa1e1ebed32381d3dcaaca5964228
Instruction ID: e909349a107319cd932a3ace8148b84a30c5ceb638bd736c2a509de9ee958243
Opcode Fuzzy Hash: 2f72c7c31729c53455d122e8f732c6370b8aa1e1ebed32381d3dcaaca5964228
Instruction Fuzzy Hash: C82117B1D003499FDB10DFA9C845BEEBBF5FB48310F50842AE959A7241C7799941CBA4

Function 0745898A Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07458A0E

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 29fea54ffbd50b9022548dcd6ddd96a3ec1c75014466922e8fa2e23237614717
Instruction ID: 699eca43fa7711e0dc822b24c5c5feb4d465a008a9937f3e59506070c43c6e73
Opcode Fuzzy Hash: 29fea54ffbd50b9022548dcd6ddd96a3ec1c75014466922e8fa2e23237614717
Instruction Fuzzy Hash: 132128B1D003098FDB14DFAAC4857EEBBF4EB48224F14852AD859A7280CB789945CB90

Function 07458C18 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 07458C98

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f11d7787e30901e8e387c0574500c29d2648feaa603e069a93d237c5a416f663
Instruction ID: b79fa2b167a2db2443311fc6de7ca6697fec28359e8298c568a9f1c5909a9abf
Opcode Fuzzy Hash: f11d7787e30901e8e387c0574500c29d2648feaa603e069a93d237c5a416f663
Instruction Fuzzy Hash: 8221E6B1D013599FDB10DFAAC841BDEBBF5FF48310F50842AE959A7240CB799941CBA4

Function 07458990 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07458A0E

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 138f8db9e435cac56b15eb29c673e6264395ebacea512a96a2d415b3ac1fdbf8
Instruction ID: 3f0cf9c8262f2a1457562b58bceb1bc3bb8ed36566effbb7f683e8a42ad6e38e
Opcode Fuzzy Hash: 138f8db9e435cac56b15eb29c673e6264395ebacea512a96a2d415b3ac1fdbf8
Instruction Fuzzy Hash: 372107B1D003098FDB10DFAAC485BEEBBF4EB48214F54842AD959A7241CB789945CFA5

Function 00EDD300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00EDD387

Memory Dump Source

Source File: 00000000.00000002.1265824635.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_lC7L7oBBMC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9e55355831f746e4f0445955081761414e57ca06423e5d9c7f3131e261aaa40b
Instruction ID: 61875cb312647b72d796efc09f31e7c5850fe0986b072bc40e4cf0c544343aa7
Opcode Fuzzy Hash: 9e55355831f746e4f0445955081761414e57ca06423e5d9c7f3131e261aaa40b
Instruction Fuzzy Hash: 8921E3B5D002499FDB10CF9AD885ADEBBF4EB48310F14841AE918A3350C374A951CFA1

Function 07458A68 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 07458AD6

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7f571b40d2fa8f96d85b036b146e1dbd5cdba31b23a99e327b7cc7f15b9e03a6
Instruction ID: 12a0723531ad4041aba488f6ecec54759b565ab4c7e9128075d41331d1f97986
Opcode Fuzzy Hash: 7f571b40d2fa8f96d85b036b146e1dbd5cdba31b23a99e327b7cc7f15b9e03a6
Instruction Fuzzy Hash: A3112672C003499FDB20DFAAC845BDFBBF5EB48320F14881AE915A7250CB759941CFA0

Function 07458A6A Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 07458AD6

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fba10086851bc20d89409cee6fc41b22ca22f323e377a82c0798a8e1fb1745f4
Instruction ID: a37af32560d1a44c7d06834d1ae396ff7139f0919a86be093f473c1962b6b93e
Opcode Fuzzy Hash: fba10086851bc20d89409cee6fc41b22ca22f323e377a82c0798a8e1fb1745f4
Instruction Fuzzy Hash: E0112672C002499FDB20DFAAC845BEFBBF5EB48310F14881AE915A7250CB759941CFA0

Function 074588DA Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 07458942

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4cc831e4ff7982b894e8e4798a7afd38567d8cf8d4d7c4a2b6a37725ff6ef4a2
Instruction ID: cb9ef58477fee25dcb680717be4ff38f580c6b951e1f941fceba799be12ba21c
Opcode Fuzzy Hash: 4cc831e4ff7982b894e8e4798a7afd38567d8cf8d4d7c4a2b6a37725ff6ef4a2
Instruction Fuzzy Hash: 55115BB1D003498FDB20DFAAC4457EEFBF5AF48324F20891AD525A7680CB355941CB95

Function 074588E0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 07458942

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9d50dfae8d670cb77ea4fbdb3b2c22963891c93d71495077cbda2c9beeb02a22
Instruction ID: de0874fe8de81756061217810333297c7a6a279e3e876f312017fb4f80b20d20
Opcode Fuzzy Hash: 9d50dfae8d670cb77ea4fbdb3b2c22963891c93d71495077cbda2c9beeb02a22
Instruction Fuzzy Hash: 3C1158B1C003498FDB20DFAAC4457DEFBF4AB48224F10881AD519A7240CB356901CB94

Function 0745CC50 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0745CCB5

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 55c37fb7841460915da59e87a2f6aea04044415c8f75694d6d8f1e63dac4a550
Instruction ID: 35a6e436ebb7eb366d1b843a18efff16655c8cd25215bc8e3d67cb2489a2b5b2
Opcode Fuzzy Hash: 55c37fb7841460915da59e87a2f6aea04044415c8f75694d6d8f1e63dac4a550
Instruction Fuzzy Hash: 4711F5B58003499FDB10DF9AD985BDEFBF8EB48324F10851AD924A3780C375A944CFA5

Function 00EDB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00EDB086

Memory Dump Source

Source File: 00000000.00000002.1265824635.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_lC7L7oBBMC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 51a4cac2229f8ccc0075cc152b7452f4943f604d84fe386e12313653a0335974
Instruction ID: 9427d89de47f9e149b08acb52f4611c13cc3626cbf851592c7d24e8e340e2e65
Opcode Fuzzy Hash: 51a4cac2229f8ccc0075cc152b7452f4943f604d84fe386e12313653a0335974
Instruction Fuzzy Hash: A311C0B6C00349CBDB20DF9AC444A9EFBF4EB88314F15841AD429B7650D375A946CFA1

Function 07457208 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0745CCB5

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 300c76bab120f1950b57d9b372c5b3d8cef3f7663b99163b60e1b11cb8c1b9ea
Instruction ID: 1965cc9e4d9849d2e81cdc4c878fdcd8f5e5da409563f2a47b90b68fa5db1649
Opcode Fuzzy Hash: 300c76bab120f1950b57d9b372c5b3d8cef3f7663b99163b60e1b11cb8c1b9ea
Instruction Fuzzy Hash: A111F5B58003499FDB10DF9AC585BDEBBF8EB48324F10841AE914A7741C375A944CFA5

Function 00E7D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1263743624.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e7d000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16bb864f6f42931774013252ceb80bae6f91c10478998c25ec8d1de844e3557
Instruction ID: fa7b70fc20c00df8f978b7dc4b5383eb3d184ad35a866c4ea415d144355f1fc0
Opcode Fuzzy Hash: c16bb864f6f42931774013252ceb80bae6f91c10478998c25ec8d1de844e3557
Instruction Fuzzy Hash: F4210372608204EFDB14DF10DDC4B16BB75FF98324F20C169E80D5B25AD336E856CAA2

Function 00E8D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1263956216.0000000000E8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e8d000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12d0f3d7979135be79ee78c9b531f58493d248216f1c9b4ad55c573ef8eb1ce
Instruction ID: 2b20a286b5840832f54ae7216b13167b4c5f7573a9eb7fcabd609c48a262b2ea
Opcode Fuzzy Hash: f12d0f3d7979135be79ee78c9b531f58493d248216f1c9b4ad55c573ef8eb1ce
Instruction Fuzzy Hash: 8621D075608304DFDB14EF14D984B16BB66EB84328F20C569D84E5B2D6C336D847CB62

Function 00E8D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1263956216.0000000000E8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e8d000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a96c4fc0f094428fdd06bc9a8f76fc660e2a745c0134f0ec8573fbe4543962
Instruction ID: 62b719363f89f8c244a1210e70b3263dbe15ff36a928359016e6d0960a038db6
Opcode Fuzzy Hash: 48a96c4fc0f094428fdd06bc9a8f76fc660e2a745c0134f0ec8573fbe4543962
Instruction Fuzzy Hash: 3E21D3716482049FDB15EF54D9C4B15BB65FB84318F20C66DD84D5B2A2C336D846CB61

Function 00E8D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1263956216.0000000000E8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e8d000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ddfaef10d4c2f78c50948322bebc4b044be029384e68648e614f560bf73f67
Instruction ID: 2ec6d38d9763b29b315b3e9b0d3402ac53b0b2aa77c91277f3738c1f652f7d0d
Opcode Fuzzy Hash: a8ddfaef10d4c2f78c50948322bebc4b044be029384e68648e614f560bf73f67
Instruction Fuzzy Hash: 2221837550D3808FCB02DF24D990715BF72EB46314F28C5DAD84D8B2A7C33A980ACB62

Function 00E7D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1263743624.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e7d000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 18ba4cd03a546876f1d370fee792aff91b25fd65c374f431e4b22e2702e2d652
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 7C11E676504240DFCB15CF14D9C4B16BF72FF94324F24C6A9D8494B656C33AE856CBA1

Function 00E8D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1263956216.0000000000E8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e8d000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 1c31a1af3725692b372d27ed73ba548b0773d07d4b7d3b5b88fc469d66513d57
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: B311BB75548280DFCB05EF54C9C0B15BBA2FB84328F24C6ADD84D5B2A6C33AD81ACB61

Non-executed Functions

Function 07456480 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04af02c7617002567213961eb10624afa61cdb4b9953c0d13df742619d31e0bd
Instruction ID: 50dae1aaac55cf5105f1e2245afd1c020dde837f9e53184e074a7b0f72509d8e
Opcode Fuzzy Hash: 04af02c7617002567213961eb10624afa61cdb4b9953c0d13df742619d31e0bd
Instruction Fuzzy Hash: 16E1FAB4E002198FDB14DFA9C5909AEFBB2FF49304F64816AD815A7356DB30AD42CF61

Function 07456048 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d131bd38de53ca00e910c29d869a7c84aa5e0cf74190188c064050981d2417
Instruction ID: c755a1de971ec01f59348a55afce68693bdfc464e4c713b5d2b4e45afd584e6e
Opcode Fuzzy Hash: 26d131bd38de53ca00e910c29d869a7c84aa5e0cf74190188c064050981d2417
Instruction Fuzzy Hash: A8E11CB4E042198FDB14DFA9C590AAEFBB2FF89304F24816AD815A7356DB309D41CF61

Function 074580B8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be5e9789861e8aebadcc1a5902a091ffb5f12924212f36be5d37b7c1c10d39cb
Instruction ID: 32d80bca00978bfaddd459cbfe01338d6d51ff296a7534b3eb583c5b2c7e67aa
Opcode Fuzzy Hash: be5e9789861e8aebadcc1a5902a091ffb5f12924212f36be5d37b7c1c10d39cb
Instruction Fuzzy Hash: C5E10CB4E002198FDB14DFA9C590AAEFBF6BF89304F24815AD815AB356DB309D41CF60

Function 07455C10 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1be274b9f37f0e5015522e3e9dfd910d822f8695962fe1a889e7d8573af3192b
Instruction ID: d2dd2e0e8c4c60e544738320d200f2513a0ed62c55d5d79124432f23ad9abd07
Opcode Fuzzy Hash: 1be274b9f37f0e5015522e3e9dfd910d822f8695962fe1a889e7d8573af3192b
Instruction Fuzzy Hash: ECE11CB4E002198FDB14DFA9C590AAEFBB2FF89304F24815AD815AB356DB309D41CF60

Function 07457C80 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83baf6954d1c0153cdb59968b4ccb41c80db86f5c34c1ff7830b36aead81f362
Instruction ID: 7ab35e46005d6fb5f56eaa33040b548515fdd47febc2e0281e6497a154ccac05
Opcode Fuzzy Hash: 83baf6954d1c0153cdb59968b4ccb41c80db86f5c34c1ff7830b36aead81f362
Instruction Fuzzy Hash: B2E1FBB4E042198FDB14DFA9C590AAEFBF2BF49304F24816AD815A7356DB319D41CF60

Function 00EDDC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1265824635.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d181f29c06ae48268da5a019496091fd66d3c1e036111d49e8bfc44ff19e7d
Instruction ID: 1504e2c9c1bf163606f4f6a04360f2d863d63e5da44f0ebef76a721fd15ce9e0
Opcode Fuzzy Hash: 56d181f29c06ae48268da5a019496091fd66d3c1e036111d49e8bfc44ff19e7d
Instruction Fuzzy Hash: BAA13832E006198FCF05DFB4C8445AEB7B2FF84304B25956AE806BB365DB71E956CB80

Function 074580A8 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3a5f974c73f4a2a4b9dd845b65d676219d16a9700977692746a958d961fe48
Instruction ID: 0b5cbb03b53e98f8e77152a4295fa8dd5a063f895a5e45148651d0bf9dcd4740
Opcode Fuzzy Hash: 5a3a5f974c73f4a2a4b9dd845b65d676219d16a9700977692746a958d961fe48
Instruction Fuzzy Hash: 4D511BB5E002198FDB14CFA9C5815EEFBB6FF89304F24816AD818A7356DB319941CFA1

Function 07456471 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13102aede882d58c68d23c026668121cedebf608283f1b92a755929af9d9967c
Instruction ID: 25fe4b86929db30dd0bdf25ca6224210f201d824079b831e56d99fa20910e1c8
Opcode Fuzzy Hash: 13102aede882d58c68d23c026668121cedebf608283f1b92a755929af9d9967c
Instruction Fuzzy Hash: 13512CB4E002198FDB14DFA9C5915AEFBF2BF89304F24816AD819A7356DB309942CF61

Function 07457C70 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299525759.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b5ee25af1778ee6e5b41d1c37f43e7859f7721f670e8effe29d5b9f1258eef
Instruction ID: 285cc260b144a6df2cf9afea9346b4e7986321ddb13c9cf15ab4ac8460b57e56
Opcode Fuzzy Hash: b3b5ee25af1778ee6e5b41d1c37f43e7859f7721f670e8effe29d5b9f1258eef
Instruction Fuzzy Hash: BB512EB5E002198FDB14CFA9C5815AEFBF2BF89304F24816AD818A7356D7319D41CFA0

Analysis Process: lC7L7oBBMC.exePID: 5104, Parent PID: 7120COMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	237
Total number of Limit Nodes:	7

Executed Functions

Function 07DC39ED Relevance: 1.8, APIs: 1, Instructions: 251
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07DC3C2E

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 431a36140f13e7ecfe1aac203a83e184b19cd9d04b278d351b87ba7ad1018511
Instruction ID: 6bf02cea5bb3ddf1b353bb0335f6cab53ca398d5496808f7aeca125b098cb382
Opcode Fuzzy Hash: 431a36140f13e7ecfe1aac203a83e184b19cd9d04b278d351b87ba7ad1018511
Instruction Fuzzy Hash: 9FA15CB1D0075ACFEB24DF68C9417EDFBB2BB48310F148269E809A7250DB759985CF92

Function 07DC39F8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07DC3C2E

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b8a834a3b1554507060e5454cbd257397945d79a8a82c879be8a13021ddd89e1
Instruction ID: 54f5eb3b13bd2ca7f0a01e8efaa5f3464208cbc655bfa66c0d43792891d59c6f
Opcode Fuzzy Hash: b8a834a3b1554507060e5454cbd257397945d79a8a82c879be8a13021ddd89e1
Instruction Fuzzy Hash: E6914BB1D0075A8FDB24CF69C941BEDFBB2BB48310F148269E809A7250DB759985CF92

Function 032CB1D0 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 032CB426

Memory Dump Source

Source File: 00000009.00000002.1295418095.00000000032C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_32c0000_lC7L7oBBMC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2ad307d5bab4a32789888b94eb273903228a3b455c69c511fa6e45e5855b5103
Instruction ID: 9a38856e2101239a33b54241f89c87a36c6ba88f4cdf15dae90f3f3eeeb1fd66
Opcode Fuzzy Hash: 2ad307d5bab4a32789888b94eb273903228a3b455c69c511fa6e45e5855b5103
Instruction Fuzzy Hash: E0714870A20B468FD724DF6AD44175ABBF5FF88200F048A2DD44ADBA50DB74E885CBD1

Function 032C5E64 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 032C5F21

Memory Dump Source

Source File: 00000009.00000002.1295418095.00000000032C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_32c0000_lC7L7oBBMC.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 58215cc5e9e134a337b784776788105b675ad2fd17a5aefd6e9418b3b466e232
Instruction ID: 523ac5306b3b43cda5361988df4be9f5580c90b61e61d093dff8b0de520e499b
Opcode Fuzzy Hash: 58215cc5e9e134a337b784776788105b675ad2fd17a5aefd6e9418b3b466e232
Instruction Fuzzy Hash: 2441E2B1C10769CFDB28CFAAC844B8DFBB1BF49304F24816AD408AB255D7756946CF90

Function 032C4A2C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 032C5F21

Memory Dump Source

Source File: 00000009.00000002.1295418095.00000000032C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_32c0000_lC7L7oBBMC.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ca9dc52c6dbb2ba90cb3a98b6e0146ca97bf5253e5bfaae786977c7a9a9610a5
Instruction ID: 493f7add2d40ed4ac056a269e855cf935c8856fb23b854709ad1c3aa01e674c2
Opcode Fuzzy Hash: ca9dc52c6dbb2ba90cb3a98b6e0146ca97bf5253e5bfaae786977c7a9a9610a5
Instruction Fuzzy Hash: E341F2B1C1071DCBDB28DFAAC844B8DBBF5BF49304F20816AD508AB255DB756986CF90

Function 07DC3769 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07DC3800

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 69c3c600db13f40dffeb010b812ad3d04a35d5bb076e04aa0ff56a09a41b933f
Instruction ID: b4d824537524a93c7de2966cccd26c569223351ee62d0f37f15882e9eb0ee047
Opcode Fuzzy Hash: 69c3c600db13f40dffeb010b812ad3d04a35d5bb076e04aa0ff56a09a41b933f
Instruction Fuzzy Hash: C52155B1D0034A9FDB10DFA9C881BEEBBF1FF48310F14842AE959A7240C7789941CB60

Function 07DC3770 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07DC3800

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 881ac97239c2b8e5d7d2a37c3873af976b8dcce3497f6eb99121081b0304e159
Instruction ID: b3364d93108e4feafbd2a683194d384d3ef053d5daf4192c92236751f59655bc
Opcode Fuzzy Hash: 881ac97239c2b8e5d7d2a37c3873af976b8dcce3497f6eb99121081b0304e159
Instruction Fuzzy Hash: AF2126B5D003499FDB10DFAAC881BDEBBF5FF48310F50842AE959A7250C7789940CBA5

Function 07DC35D0 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07DC3656

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fd8e0e4a030eb744e9452f7b68bbd1e521245cd38743c415d63b1660e448eedc
Instruction ID: 446ed33c2646d8dee75e334e428b1e63980380d213501681c83347a9424f3fe5
Opcode Fuzzy Hash: fd8e0e4a030eb744e9452f7b68bbd1e521245cd38743c415d63b1660e448eedc
Instruction Fuzzy Hash: 452154B1D003098FDB20DFAAC481BAEBBF4AB48210F54842ED419A7740CB789945CFA0

Function 032CD238 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,032CD66E,?,?,?,?,?), ref: 032CD72F

Memory Dump Source

Source File: 00000009.00000002.1295418095.00000000032C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_32c0000_lC7L7oBBMC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 018004e81e8ef2c08dd84bbbefc04758ffd514b0d4b13fa749d53d7a5fd73920
Instruction ID: 48a48e7ac554f36f484f22d2074de89c17643cc69eb351ed87280539a2c4c276
Opcode Fuzzy Hash: 018004e81e8ef2c08dd84bbbefc04758ffd514b0d4b13fa749d53d7a5fd73920
Instruction Fuzzy Hash: D321E6B5D103499FDB10DF9AD884ADEFBF4EB48310F14812AE918A3350D374A945CFA4

Function 032CD6A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,032CD66E,?,?,?,?,?), ref: 032CD72F

Memory Dump Source

Source File: 00000009.00000002.1295418095.00000000032C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_32c0000_lC7L7oBBMC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 92d29117dd6492f319c6645e3e03a6245001b1662265da9b14c2e9f1ea36fa07
Instruction ID: 46b0d8ed1f70c5d4e41a124ee460c9ebe49fb2e831b84d3e8df94a0d51389351
Opcode Fuzzy Hash: 92d29117dd6492f319c6645e3e03a6245001b1662265da9b14c2e9f1ea36fa07
Instruction Fuzzy Hash: D121E5B5D10349AFDB10CF9AD885ADEFBF5EB48310F14802AE918A3350D379A945CF61

Function 07DC3858 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07DC38E0

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f495c6145c4d3a06851c06329367cd5c3c6746e0426c205ae2437124eb326db4
Instruction ID: 24f269c84de70373ba78d327ae060f7b13b136a2060f6b7be55ff095f72ae929
Opcode Fuzzy Hash: f495c6145c4d3a06851c06329367cd5c3c6746e0426c205ae2437124eb326db4
Instruction Fuzzy Hash: D72125B5D0035A9FDB10DFAAC881BEEFBF1BF48310F54852AE519A7250C7399941CB60

Function 07DC35D8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07DC3656

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5a99095f797104011c9fe04774dbd8427f1cddb2aab892aeb0f3049666c3d5a7
Instruction ID: 5cb995be9588a0c159471080a95b447dda646fa70d8affafdc843c1739812eb3
Opcode Fuzzy Hash: 5a99095f797104011c9fe04774dbd8427f1cddb2aab892aeb0f3049666c3d5a7
Instruction Fuzzy Hash: 4E2134B1D003098FDB14DFAAC485BAEFBF4AB48220F54842ED519A7340CB78A945CFA5

Function 07DC3860 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07DC38E0

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2b26784418211c460d5c3a559aff847f8ee37d899df729d452bb2d802f883a93
Instruction ID: 79627e456e4e7ff874b39b037d576b8d74e6efbf37ace92b1533e0f0dba97d69
Opcode Fuzzy Hash: 2b26784418211c460d5c3a559aff847f8ee37d899df729d452bb2d802f883a93
Instruction Fuzzy Hash: 5521F4B1C003499FDB10DFAAC841AAEBBB5BF48310F50852AE919A7250C7399901CBA5

Function 07DC36B0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07DC371E

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0165cef34e8583a6deef4949899a08da587585d19d78331494483ef1004a8865
Instruction ID: e38fafcfa7fd8e9c16b45f7978711b4a576bb5e4d9397c9306a67bede59d38ad
Opcode Fuzzy Hash: 0165cef34e8583a6deef4949899a08da587585d19d78331494483ef1004a8865
Instruction Fuzzy Hash: 321126B5C003499FDB24DFAAC845BDEFBF5EB48320F148419E555A7250CB75A940CFA1

Function 07DC36A8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07DC371E

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bd1bf0901b756d388425dbd0d75f0a0dfcdc31cbf1e0543453b8f1a316b36bf2
Instruction ID: c1e991f8a6b23bcca8af30e90c59a360f29383f140518192fd1d9873f5d0b2a8
Opcode Fuzzy Hash: bd1bf0901b756d388425dbd0d75f0a0dfcdc31cbf1e0543453b8f1a316b36bf2
Instruction Fuzzy Hash: 331147B5D002498FDB24DFAAC845BEEFBF5EB48310F14841AE555A7250C7359940CFA0

Function 07DC3520 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07DC358A

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 56be35d07be4f2ed87dde2ff681462741f5f927d30fb37bbcc156f6e02e0a95d
Instruction ID: bb34e2d709911a232a1cd742f1bc9dd2f8408678de412b6fe843161438342f45
Opcode Fuzzy Hash: 56be35d07be4f2ed87dde2ff681462741f5f927d30fb37bbcc156f6e02e0a95d
Instruction Fuzzy Hash: B81188B1D003498FDB20DFAAC4457EEFBF5AB48214F24841ED519A7640CB39A941CF95

Function 07DC3528 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07DC358A

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9ef070250c7f8f8135b8732339197a1b61a9c5719028070f14e387cfc4e060d4
Instruction ID: 3331b5ca494a5f345c311b65d3d5f1123fa7e68cd9210e9beafa6d0eb14eadfc
Opcode Fuzzy Hash: 9ef070250c7f8f8135b8732339197a1b61a9c5719028070f14e387cfc4e060d4
Instruction Fuzzy Hash: 9C1155B1C003498FDB20DFAAC4457AEFBF4AB88220F24841ED519A7240CA39A900CFA5

Function 032CB3C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 032CB426

Memory Dump Source

Source File: 00000009.00000002.1295418095.00000000032C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_32c0000_lC7L7oBBMC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d59b382a99ebb0d381830f356353e140dd2cee9d17c4c98ffbb7194042f6a1dc
Instruction ID: 20ac20ac122f8f0243b52254f6160bf551f40506187ac3063aa881c924747d15
Opcode Fuzzy Hash: d59b382a99ebb0d381830f356353e140dd2cee9d17c4c98ffbb7194042f6a1dc
Instruction Fuzzy Hash: E7110FB5C103498FCB20DF9AD445ADEFBF4AB88220F14852AD429A7210C379A545CFA1

Function 07DC24B0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07DC74A5

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7713007b1f2a75a7c2626009980af0cf56e4012f41e30ddf6b53d4f74f33c1da
Instruction ID: f2d405e2ce288be2b016838d087bc5f0c19a64f0e376a340aed339b4fd5996ae
Opcode Fuzzy Hash: 7713007b1f2a75a7c2626009980af0cf56e4012f41e30ddf6b53d4f74f33c1da
Instruction Fuzzy Hash: 291106B58047499FDB20DF9AC445BDEFFF8EB48320F108419E514A7210D375A944CFA1

Function 07DC7441 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07DC74A5

Memory Dump Source

Source File: 00000009.00000002.1308295303.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7dc0000_lC7L7oBBMC.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e550342779ebbcb0ef256cef3bc8d662dc539008db2c020bfc637d7ef1e9ea5b
Instruction ID: 55716921e5e01369745f60919454843d783394e2953eb5ffc3cfe1717b9d30f2
Opcode Fuzzy Hash: e550342779ebbcb0ef256cef3bc8d662dc539008db2c020bfc637d7ef1e9ea5b
Instruction Fuzzy Hash: 8911F5B58006499FDB10DF9AD445BDEFBF4EB48320F14841AD518A7651C379A944CFA1

Function 018CD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1293144274.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_18cd000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad4d165cd74fc47cd89e448c41834a5fea4f064e1bf9b0925f627a0a1cbb55d6
Instruction ID: 000f66da318ef97f30f060d80b49641803d0f72c9f8f47422cdb9f449198c570
Opcode Fuzzy Hash: ad4d165cd74fc47cd89e448c41834a5fea4f064e1bf9b0925f627a0a1cbb55d6
Instruction Fuzzy Hash: E8213372504204DFDB15EF54D9C0B26BF61FB98728F20C27DE9098B246C336D506CAE2

Function 018CD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1293144274.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_18cd000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7399403902e8c30f62d0bf48d9489506c78d8281df251253c3cb4a6026b5c26
Instruction ID: 5f653a196432fc1d5d969e0a71e7d17a9b03ec745101278893ac12384e781fed
Opcode Fuzzy Hash: b7399403902e8c30f62d0bf48d9489506c78d8281df251253c3cb4a6026b5c26
Instruction Fuzzy Hash: 582121B1604204DFDB05EF54D9C0B66FB65FB88724F20C27DEA098B246C336E546CAE2

Function 018DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1293875900.00000000018DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_18dd000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8d793c8fc54f4c6415e3f8de4d2215ba74a034ca60529508cc53f053d60db7
Instruction ID: 5418a1cb4ce5c67610063c0eaefebf41881e9744fa23439f657ae6f5353ddee3
Opcode Fuzzy Hash: 3e8d793c8fc54f4c6415e3f8de4d2215ba74a034ca60529508cc53f053d60db7
Instruction Fuzzy Hash: E3212271604304DFDB15DF64D9C4B16BB65EBC8314F20C66DD80A8B386C33AD907CA62

Function 018DD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1293875900.00000000018DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_18dd000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2fccf7d0db4df5497c9ec91ea0ef285e181e4a2feb260221f22e8d511b1731
Instruction ID: 134a836e4498c3d4f100bbcddb5ca46bb7735c06ec43deddf31fdc5767a0dec9
Opcode Fuzzy Hash: 5f2fccf7d0db4df5497c9ec91ea0ef285e181e4a2feb260221f22e8d511b1731
Instruction Fuzzy Hash: F4210771644304EFDB15DF94D9C0B25BB65FB84324F20C66DD8498F392C336E546CA61

Function 018DD005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1293875900.00000000018DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_18dd000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c1b143c45f827510c133d13275a1853a75d77dbdbbebd62c0ee47bcd92377e
Instruction ID: 299f938554fff36fee35b9ac7e6a12de719b21e64d038c4eb10d14f66c040da3
Opcode Fuzzy Hash: 96c1b143c45f827510c133d13275a1853a75d77dbdbbebd62c0ee47bcd92377e
Instruction Fuzzy Hash: 0F2192755093808FCB16CF24D990715BF71EB85314F28C6EAD8498B697C33A990ACB62

Function 018CD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1293144274.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_18cd000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: d2f357e8aeeb36b1380c3625bc1d917be6983f9b16a6badea2608197cad628cf
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: C811CAB6504280DFCB06DF44D9C0B56BF62FB84324F24C2ADD9094A656C33AE55ACBA2

Function 018CD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1293144274.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_18cd000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 5d8cf0822ca0e064ef7cc686e2740cdf62eff317ff34b56665f5d555e4cdd003
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 50110F76500280CFCB02DF04D9C0B16BF72FB94324F24C2ADE8094B256C336D516CBA1

Function 018DD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1293875900.00000000018DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_18dd000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 434d586887f829c0b96d9480a2fc48c825784f8142e59b41f431f3c7224c7332
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 0011BB75504280DFCB06CF54C5C0B15BBB2FB84324F24C6ADD8498B696C33AE40ACB61

Analysis Process: IxumRsOtTdrVAu.exePID: 7296, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	221
Total number of Limit Nodes:	11

Executed Functions

Function 0144D0A8 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0144D136
GetCurrentThread.KERNEL32 ref: 0144D173
GetCurrentProcess.KERNEL32 ref: 0144D1B0
GetCurrentThreadId.KERNEL32 ref: 0144D209

Memory Dump Source

Source File: 00000011.00000002.1346577346.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1440000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cd47b25545f5362d41a02baad7b4ee3492871b51db6a48b6040398b078572510
Instruction ID: 101a0960229bb0035ecc6887c0672395ed60ab5e1ebdc9107f93d59bb02f23bc
Opcode Fuzzy Hash: cd47b25545f5362d41a02baad7b4ee3492871b51db6a48b6040398b078572510
Instruction Fuzzy Hash: D35178B0D003498FEB15DFAAD548B9EBBF1EF88310F24849AE419A7360DB349845CF65

Function 0144D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0144D136
GetCurrentThread.KERNEL32 ref: 0144D173
GetCurrentProcess.KERNEL32 ref: 0144D1B0
GetCurrentThreadId.KERNEL32 ref: 0144D209

Memory Dump Source

Source File: 00000011.00000002.1346577346.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1440000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 524316b3e6cd30a495f95e928ad9a2ba3b7e63680fcbc94a6f1f623267715877
Instruction ID: c751b7bbbe76e6ac98548ef8bea2f1dfc90e887eb743861d8df37d43ad2622e4
Opcode Fuzzy Hash: 524316b3e6cd30a495f95e928ad9a2ba3b7e63680fcbc94a6f1f623267715877
Instruction Fuzzy Hash: C05156B0D003098FEB14DFAAD548BAEBBF1EF88310F20845AE419A7360DB349845CF65

Function 05C28C74 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05C28EB6

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: bd3f4cb2ef09b777f7ed07a593c96508cc32f9774149c33c475c83cdba566931
Instruction ID: c458f3f91768d08a86b5ae4959838dee871133c51282f9b3dddc484a95cd7c2e
Opcode Fuzzy Hash: bd3f4cb2ef09b777f7ed07a593c96508cc32f9774149c33c475c83cdba566931
Instruction Fuzzy Hash: C0914E71D0472A9FEF24CFA9C841BEDBBB2BF44310F148569E805A7280DB749A85CF91

Function 05C28C80 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05C28EB6

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1f73b4e109c09ba30001dad81deccfb5ed31d1e35bc88d52a85b5f0623175ae1
Instruction ID: b29288c91974b24287afbc42083e86355d952a9a8167636e249bac200390b5dc
Opcode Fuzzy Hash: 1f73b4e109c09ba30001dad81deccfb5ed31d1e35bc88d52a85b5f0623175ae1
Instruction Fuzzy Hash: B2914F71D047299FEF24DF69C841BEDBBB2BF44310F148569E809A7280DB749A85CF91

Function 0144AE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0144B086

Memory Dump Source

Source File: 00000011.00000002.1346577346.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1440000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1a4caf8b694e059ffa64462e3607343913b9849474febe1c035ecd1e8365136b
Instruction ID: 61ce0b292268fd640f3aa30b932ca4c0a174bd4504e8909df61bc2ee7c57d488
Opcode Fuzzy Hash: 1a4caf8b694e059ffa64462e3607343913b9849474febe1c035ecd1e8365136b
Instruction Fuzzy Hash: D4813770A00B058FE724DF2AD55475ABBF1FF88214F20892ED49AD7B60D735E846CB91

Function 030F1CE5 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 030F1E02

Memory Dump Source

Source File: 00000011.00000002.1357403069.00000000030F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_30f0000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 564aa9ed6b1997c39f41d17cd38ea7fbbf3123816b4c5f603ffd009823985400
Instruction ID: 456046fe3801c1bc173491b18e7463071e133a8d407f0a1953d56e775c89eb4f
Opcode Fuzzy Hash: 564aa9ed6b1997c39f41d17cd38ea7fbbf3123816b4c5f603ffd009823985400
Instruction Fuzzy Hash: 2D51BCB1D00349DFDB14CF9AC884ADEFBB6BF48310F64812AE818AB250D7719945CF90

Function 030F1CF0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 030F1E02

Memory Dump Source

Source File: 00000011.00000002.1357403069.00000000030F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_30f0000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 642c34406380404b6c6807e3bc59584d9778003044b023254b512fc2d27d7bda
Instruction ID: d153ca15179d78ce10b8442bd3b697c5e3dd8ea3d871be6fb1ef9da8538a2a00
Opcode Fuzzy Hash: 642c34406380404b6c6807e3bc59584d9778003044b023254b512fc2d27d7bda
Instruction Fuzzy Hash: DC41ACB1D00309DFDB14CF9AC884ADEFBB6BF48310F64812AE918AB250D7759845CF90

Function 030F0BFC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 030F4381

Memory Dump Source

Source File: 00000011.00000002.1357403069.00000000030F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_30f0000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: bd9c155c78b89d75f93f4c8ea13f4a487f20d543030703abea9cfafac6fd77df
Instruction ID: a2eb1cdb1a8f95c14c6256ec65ed962c5f343283c1cfd005459f2ba5da4d7ef9
Opcode Fuzzy Hash: bd9c155c78b89d75f93f4c8ea13f4a487f20d543030703abea9cfafac6fd77df
Instruction Fuzzy Hash: 9E4118B49003098FDB14CF96C488AABFBF5FB88314F648459D619AB321D774A841CBA4

Function 0144449C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014459C9

Memory Dump Source

Source File: 00000011.00000002.1346577346.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1440000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 141ad3bf54d612605fabde86d625843790823d67a28ff827118708f9f34b06a3
Instruction ID: 3f25b42419e9caf19c582f95d1111abb9ca19e0176a01a86f512289e43e4f9ec
Opcode Fuzzy Hash: 141ad3bf54d612605fabde86d625843790823d67a28ff827118708f9f34b06a3
Instruction Fuzzy Hash: 3641E371C0071DCBEB24DFAAC84478EBBF5BF49314F20816AD509AB251DB756946CF90

Function 0144590C Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014459C9

Memory Dump Source

Source File: 00000011.00000002.1346577346.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1440000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5f1508721ded24c05b5d9fdfb1fab60f4c28e85b0e683816ac29857b08760d43
Instruction ID: d558febe02251cbe184c988dd372b07b132b3a473221b00219866842acfd0102
Opcode Fuzzy Hash: 5f1508721ded24c05b5d9fdfb1fab60f4c28e85b0e683816ac29857b08760d43
Instruction Fuzzy Hash: D541F2B1C00719CFEB24DFAAC88478EBBF5BF48314F20806AD409AB251DB755946CF90

Function 05C289F0 Relevance: 1.6, APIs: 1, Instructions: 70injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05C28A88

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 161c97f75c2d1906cc3170bd52777a193b64c6d55daada78693162a3d957a9c3
Instruction ID: a2ded7cab43d02c9076c7829352a302330474078c4fde61895cdb232600a29a3
Opcode Fuzzy Hash: 161c97f75c2d1906cc3170bd52777a193b64c6d55daada78693162a3d957a9c3
Instruction Fuzzy Hash: FE212571D003199FDB10CFA9C881BDEBBF1FB48310F508829E919A7241CB789945CBA0

Function 05C289F8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05C28A88

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d9331499560db00e3abac79d993313af00d71377f8d14d580a7c54d26f10367e
Instruction ID: f2841a5e4d738d4ebf31826cceed1cd50b82e09e269c4639a1c2cdbbb9f3ed45
Opcode Fuzzy Hash: d9331499560db00e3abac79d993313af00d71377f8d14d580a7c54d26f10367e
Instruction Fuzzy Hash: DA211571D00319DFDB10DFAAC881BDEBBF5FB48310F50882AE919A7241CB789951CBA4

Function 0144D2F8 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0144D387

Memory Dump Source

Source File: 00000011.00000002.1346577346.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1440000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7807c9b743a80306a0aea858d096021746f1bc278a9622b2411ac3f2ae4d6530
Instruction ID: 0a9e21da4dff202365a49d2b7e121c66460a133ecb83501dab28c94f96492925
Opcode Fuzzy Hash: 7807c9b743a80306a0aea858d096021746f1bc278a9622b2411ac3f2ae4d6530
Instruction Fuzzy Hash: 9F21F4B5D002489FDB10CFAAD985ADEFBF5EB48310F14802AE918A3350C378A941CFA0

Function 05C28858 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05C288DE

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9528b57bf9157e2b7b872ba1232ed80b3ed466b961d113412e0ef84b69dd2af9
Instruction ID: 82b97bf542eb9d0b5dcaa1efdec5eb72490750cfe98e53584e2ef729b5d13c19
Opcode Fuzzy Hash: 9528b57bf9157e2b7b872ba1232ed80b3ed466b961d113412e0ef84b69dd2af9
Instruction Fuzzy Hash: 34212571D003098FDB10DFAAC4857AEBBF4BB48324F54842AE819A7240CB789945CFA4

Function 05C28AE0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05C28B68

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0960cee284fa7e49686fa8463be75c2f101e5a76e35421b0d7f2d14138773df3
Instruction ID: c0b5677c13a4b838911f6f06662e4f053e9ae656ba198b3275fdb531931c1b9b
Opcode Fuzzy Hash: 0960cee284fa7e49686fa8463be75c2f101e5a76e35421b0d7f2d14138773df3
Instruction Fuzzy Hash: 7121F6B1C003599FDB10DFAAC841BDEFBB5FF48310F508429E919A7240C7759541CBA4

Function 05C28860 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05C288DE

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4312662046a7fc4bf7d0f0aeaf23b760b439169e269fa37e9168f2fbe6f8334c
Instruction ID: 0be06140f9addedb0d41401409b06fc3adcd9773aa9a4fbc134b772a24550c60
Opcode Fuzzy Hash: 4312662046a7fc4bf7d0f0aeaf23b760b439169e269fa37e9168f2fbe6f8334c
Instruction Fuzzy Hash: B1211571D003098FDB10DFAAC485BAEBBF4FF48324F54842AD959A7640DB789945CFA4

Function 05C28AE8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05C28B68

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0f8647e869ac5147a7e5b153f71ff843dd31f845223d6186754c13c136bde12f
Instruction ID: b055e257fae42b48411e9e4e01a55682da365eaa954bfbcc33e66b346776bcdc
Opcode Fuzzy Hash: 0f8647e869ac5147a7e5b153f71ff843dd31f845223d6186754c13c136bde12f
Instruction Fuzzy Hash: 5F21E5B1C003599FDB10DFAAC841BDEBBF5FF48310F50842AE919A7240C7799941CBA4

Function 0144D300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0144D387

Memory Dump Source

Source File: 00000011.00000002.1346577346.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1440000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 39b35f1d2bfe0dfb3716c8e4b063717701612d4905d4837177cfb47c6cb01a38
Instruction ID: 9bdf7b5ee9bcb60c023f1634125fa73381369a1ee819a74a699eb9e6210f4350
Opcode Fuzzy Hash: 39b35f1d2bfe0dfb3716c8e4b063717701612d4905d4837177cfb47c6cb01a38
Instruction Fuzzy Hash: 9A21E4B5D003089FDB10CF9AD884ADEFBF4EB48320F14801AE918A3350C374A941CFA0

Function 05C28930 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05C289A6

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a7f42406fcb00d68dcbb97b5415f07850ffa8be147f9a3678c11e3599500550a
Instruction ID: e44b8b0ba202e9d22da6dc6ae2d76e893abe4335496699253c6190dec1f42109
Opcode Fuzzy Hash: a7f42406fcb00d68dcbb97b5415f07850ffa8be147f9a3678c11e3599500550a
Instruction Fuzzy Hash: DB114471C003098FDB20DFAAC845BDEBFF5EB88320F108819E929A7250CB359941CFA1

Function 05C28938 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05C289A6

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a2d6ef48e3a55a723035dd96f743058b3b9db33da04f5fa7c646c3905d3c8e5d
Instruction ID: b7b1b5cef6bcdfbddac50ddf869e6b2ce8846b9c1afb59416a5777baeacff014
Opcode Fuzzy Hash: a2d6ef48e3a55a723035dd96f743058b3b9db33da04f5fa7c646c3905d3c8e5d
Instruction Fuzzy Hash: 7A112671C003499FDB20DFAAC845BDEBBF5EB88320F148819E915A7250CB759941CFA1

Function 05C287A8 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 05C28812

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5d3a80179d1f0f5050cd1ef149bc638cd7e4f01fdb5d7663df9f7f8aa739c7a4
Instruction ID: c8e617966593ab76a06a390022192970a45cc02414f7a9740ded3498096d0943
Opcode Fuzzy Hash: 5d3a80179d1f0f5050cd1ef149bc638cd7e4f01fdb5d7663df9f7f8aa739c7a4
Instruction Fuzzy Hash: 45115B71C003488FDB24DFAAC4457EEFBF5EB88320F20892AD429A7280CB355541CF90

Function 05C287B0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 05C28812

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 07dce974f43d148b8dce26ca7f9c8b59ee96b0616d7fb1c3243baac5f9f258b1
Instruction ID: 7642b48fe27e0f9c4bdfc6bf775a6bc33005cdf1ea4ebefde00ef75203ee15d2
Opcode Fuzzy Hash: 07dce974f43d148b8dce26ca7f9c8b59ee96b0616d7fb1c3243baac5f9f258b1
Instruction Fuzzy Hash: CD113AB1D003498FDB20DFAAC44579EFBF5EB48320F148429D519A7640CB756941CFA4

Function 0144B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0144B086

Memory Dump Source

Source File: 00000011.00000002.1346577346.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1440000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4237f847defbb196f2c74ba25fec9002198471149fa5c5c8b582ab8bf532e6b2
Instruction ID: 75675ee3b81167a5442ce2fed589d4159944bae718c49ac2e111f10144a2330a
Opcode Fuzzy Hash: 4237f847defbb196f2c74ba25fec9002198471149fa5c5c8b582ab8bf532e6b2
Instruction Fuzzy Hash: D911D2B5C007498FDB20DF9AD444A9EFBF4EB48220F10842AD569A7250C375A546CFA1

Function 05C270D4 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 05C2BF9D

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d9862d5bccf5f254a4ee07c59c29a848274a0cbc34f94de0abdc7c46b60aed8a
Instruction ID: aebca27bf00adbe801f4d772a926ada45a1ccef4f436309bd661e91ab8c79bed
Opcode Fuzzy Hash: d9862d5bccf5f254a4ee07c59c29a848274a0cbc34f94de0abdc7c46b60aed8a
Instruction Fuzzy Hash: 4C1106B9804349DFDB10DF9AD945BDEFBF8EB48324F108419E514A7240C375A944CFA5

Function 05C2BF38 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 05C2BF9D

Memory Dump Source

Source File: 00000011.00000002.1395377242.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c20000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 5d3df459bb165232096a815f7a1fbc60fdc13368c9017cd7aba16811b7394aba
Instruction ID: 1db6b444953060abb6d463fc6e630bc7d0672ad6f752568bc7775962c27bdd82
Opcode Fuzzy Hash: 5d3df459bb165232096a815f7a1fbc60fdc13368c9017cd7aba16811b7394aba
Instruction Fuzzy Hash: 1011F5B98043499FDB10DF9AD845BDEFFF4EB48320F10881AE919A7240C375A945CFA1

Analysis Process: lC7L7oBBMC.exePID: 7488, Parent PID: 5104COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	25
Total number of Limit Nodes:	6

Executed Functions

Function 06693040 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06693722
$q, xrefs: 0669373F
$q, xrefs: 06693716
$q, xrefs: 0669374B
$q, xrefs: 0669376F
$q, xrefs: 06693763

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 90f56a2c8a058258c213d62f5310da1bfef4f09370256ab2e1bc21cadd1198cf
Instruction ID: cc505a80e453cfda549aef4dd187ed94b7f61bfcaf46725fb8be8067223e5919
Opcode Fuzzy Hash: 90f56a2c8a058258c213d62f5310da1bfef4f09370256ab2e1bc21cadd1198cf
Instruction Fuzzy Hash: 07321E35E10719CBDB14EF75D85069DF7B6FF89300F2086AAD409AB354EB70A986CB90

Function 06697D68 Relevance: 3.0, Strings: 2, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06698303
$q, xrefs: 0669830F

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 477e65eae196ad268ca6cb81b9c3e4087ab31f5d0dd76f7c0cc13f027ae74cb0
Instruction ID: 0b21c068d572cdc38d3a80c4ae838013260b322af4717145934152fe60ff746c
Opcode Fuzzy Hash: 477e65eae196ad268ca6cb81b9c3e4087ab31f5d0dd76f7c0cc13f027ae74cb0
Instruction Fuzzy Hash: CD028A30B002158FDB54DBB9D890AAEBBE6FF85310F148929D805DB395DB35ED46CBA0

Function 06692349 Relevance: 1.0, Instructions: 1010COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f8f79bcba1f9570689ec720d87f26bcb6d98bb89b54e35f81343bd9ce8bec0
Instruction ID: 9590d2d25b8d0a120322585ccf26351a559462b3b1ee86c5529fef721af8832f
Opcode Fuzzy Hash: e8f8f79bcba1f9570689ec720d87f26bcb6d98bb89b54e35f81343bd9ce8bec0
Instruction Fuzzy Hash: 9B927830E102049FDB64CB68C598B6DBBFAEF45314F5484A9D809EB355DB31ED86CBA0

Function 066965E0 Relevance: .8, Instructions: 816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a05005a2e9568124ccec7847b503e04b3e6aa098ee7a86086721c50455e289
Instruction ID: 321f5b0574db33a4f065a48c94a20a7d08d5e66d74ace8395347d8fb620f544e
Opcode Fuzzy Hash: f5a05005a2e9568124ccec7847b503e04b3e6aa098ee7a86086721c50455e289
Instruction Fuzzy Hash: 27629C34A002048FEF54DB68D594BADBBF6EF88314F148469E806DB354DB75ED46CBA0

Function 06695588 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603e8a0c284efe1485a521ffcc2c2fae2ce05cd4cb7c3b21d560ed3bec0ab6ca
Instruction ID: b0dc64c360b00c377c0792c96bba0c80d2616a4d11873531ef1c20aefdee478c
Opcode Fuzzy Hash: 603e8a0c284efe1485a521ffcc2c2fae2ce05cd4cb7c3b21d560ed3bec0ab6ca
Instruction Fuzzy Hash: FB22E331F002149FDF65DB68C5807AEBBBAEF85320F248469D856EB355CA35DD42CBA0

Function 0669B20F Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ca75308a21ca768af65ca5d6fd48c5771b0670d4f014e57f5bc8c33d2221d4
Instruction ID: 6bbc48b3869a77b574576ab10ebb76d4fe1f5debb7317cf910fad30c18ed454f
Opcode Fuzzy Hash: d0ca75308a21ca768af65ca5d6fd48c5771b0670d4f014e57f5bc8c33d2221d4
Instruction Fuzzy Hash: E0225330E102099FEF64DB69E4847AFB7F6EB85310F248526E815DB395DA34EC42CB61

Function 0669ACB8 Relevance: 12.9, Strings: 10, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 0669ADE5
$q, xrefs: 0669AE2C
XM, xrefs: 0669B112
$q, xrefs: 0669AE38
$q, xrefs: 0669ADD9
$q, xrefs: 0669AE5B
$q, xrefs: 0669AE67
XM, xrefs: 0669B031
$q, xrefs: 0669AE84
$q, xrefs: 0669AE90

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: XM$XM$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-4055301323
Opcode ID: 84467906c2c080dd37d4857f7fa00a866b869623e88ee579a5b512b4d9f629c9
Instruction ID: 55987e1a55da3c7c146afb931ce18a2d46558fcb36f571f01572afb7e2bdd43e
Opcode Fuzzy Hash: 84467906c2c080dd37d4857f7fa00a866b869623e88ee579a5b512b4d9f629c9
Instruction Fuzzy Hash: DFE15E30E003498FDF65DBA8D8406AEB7F6FF85311F208529E805AB355DB75AC46CBA1

Function 0669B630 Relevance: 8.0, Strings: 6, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 0669BBA3
$q, xrefs: 0669BB63
$q, xrefs: 0669BB97
$q, xrefs: 0669BBCB
$q, xrefs: 0669BBD7
$q, xrefs: 0669BB6F

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: ed92ff044fe3ea39078c41366f5860d5c483ef742934c651dc74965a3005d029
Instruction ID: d6309a4370f77bea6caa145c7611aaf806b79d5eddedadba27b041fa7bb1c284
Opcode Fuzzy Hash: ed92ff044fe3ea39078c41366f5860d5c483ef742934c651dc74965a3005d029
Instruction Fuzzy Hash: 92027E30E102098FDF64DB69E4847AEB7F6EB85310F24856AE805DB355DB70EC46CBA1

Function 06699138 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 0669917F
$q, xrefs: 066991BA
$q, xrefs: 0669918B
$q, xrefs: 066991C6

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 70f83e7258136eeb679d13be185ee4b9e91f05dafbb6a4f93f287a22c77bc89c
Instruction ID: 877c424953394364e36c00144a8c2ec220aad20dc466986ce65f36509e81099f
Opcode Fuzzy Hash: 70f83e7258136eeb679d13be185ee4b9e91f05dafbb6a4f93f287a22c77bc89c
Instruction Fuzzy Hash: CF912130F102199FDB54DB69D850B6E7BEAFF89300F148569D819EB348EE70DD428BA1

Function 0669CF28 Relevance: 4.5, Strings: 3, Instructions: 798
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 0669D333
$q, xrefs: 0669D31F
$q, xrefs: 0669D327

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: cd840b25136ff942dcf5e0c2fcc6a881a40b6af5d29e29d7e1fced998c8adda4
Instruction ID: 9540f276ac25b9f18f4dcb54274ebf5bfbc9073dbeffe8467326bd932a778932
Opcode Fuzzy Hash: cd840b25136ff942dcf5e0c2fcc6a881a40b6af5d29e29d7e1fced998c8adda4
Instruction Fuzzy Hash: DC626B34A007158FDB65EF68D590A5EB7A2FF84304B208A28D4059F369DB71FD4BCB91

Function 06694B50 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Oq, xrefs: 06694D07
fq, xrefs: 0669525D
XPq, xrefs: 06694C7D

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: fq$XPq$\Oq
API String ID: 0-132346853
Opcode ID: 0e549a0178a8b97b91e4b81183e09098c2dcd05dc42eaa7c471930afbc8af3c2
Instruction ID: 1aab4060d17a46870024dcfa00c007422425b2dbad934c370a4184c091bf4a06
Opcode Fuzzy Hash: 0e549a0178a8b97b91e4b81183e09098c2dcd05dc42eaa7c471930afbc8af3c2
Instruction Fuzzy Hash: 33615F34F002189FEF549BA9C8157AEBAF6FF88300F208529D506EB395DF758D458BA0

Function 00F1EB38 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{/3a, xrefs: 00F1EC3F

Memory Dump Source

Source File: 00000013.00000002.2488776167.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_f10000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: {/3a
API String ID: 0-1622527394
Opcode ID: 669a4b2ec84e30c85c50630afb9dbc3967dfbbce7b5a19280a0e456691eb2645
Instruction ID: aa7ab6d175d7cc485efc19c08ee56af13a2f1d7beed73ea3a09b96344a4b06a5
Opcode Fuzzy Hash: 669a4b2ec84e30c85c50630afb9dbc3967dfbbce7b5a19280a0e456691eb2645
Instruction Fuzzy Hash: 97513332D043899FDB14DF79D8047DABBF6AF85320F04856AD845A7282DB789885CBE1

Function 00F1EC20 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00F1EC87

Strings

{/3a, xrefs: 00F1EC3F

Memory Dump Source

Source File: 00000013.00000002.2488776167.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_f10000_lC7L7oBBMC.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: {/3a
API String ID: 1890195054-1622527394
Opcode ID: 2be079b95d6c37cf2df309b34dfecc58b1bc39d42e6b54d1e1c7ecf319ac09d9
Instruction ID: d33fb3844c2546341a26329ac7dfd88e0c6a62620dd5614b05816e0a5ec4ff07
Opcode Fuzzy Hash: 2be079b95d6c37cf2df309b34dfecc58b1bc39d42e6b54d1e1c7ecf319ac09d9
Instruction Fuzzy Hash: D111F3B1C0065A9BDB10DF9AC945BDEFBF4AF48320F15812AE818A7240D778A945CFE5

Function 06699127 Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

$q, xrefs: 0669917F
$q, xrefs: 066991BA

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 79a8db366fbc3982b6cef6cfcebdef63900848ac9203acefa69221f209365843
Instruction ID: 81765b486fa5104164d4667d6e52e990e2609d2e451a5770c20fc5af2e5f7311
Opcode Fuzzy Hash: 79a8db366fbc3982b6cef6cfcebdef63900848ac9203acefa69221f209365843
Instruction Fuzzy Hash: A6512F30B102049FDB54DBB9D851B6E7BEAFB89300F148569D819DB398EA70DD42CBA1

Function 06694B40 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

XPq, xrefs: 06694C7D

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: XPq
API String ID: 0-1601936878
Opcode ID: 7b335067b46d5f811caa9b7d010ed74e64ff0ec32f54060ccd9d38e7aa41a1da
Instruction ID: 2af62fba4850ee9f1ab4f04eda4939c5b5d4bc188581cc247eb82447751519db
Opcode Fuzzy Hash: 7b335067b46d5f811caa9b7d010ed74e64ff0ec32f54060ccd9d38e7aa41a1da
Instruction Fuzzy Hash: 31418231B002189FEB459BB9C815B9EBBF7FF88300F248529E505AB395DB758C06CB90

Function 0669DA9D Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

PHq, xrefs: 0669DBF9

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: ffe5de81cc2eac30016ce891be4e95da36eb0d2841921297e43f9d08afbaea07
Instruction ID: 848d75b9ae7c113a56ce73b4e9d9696b9c9a2fe4348e8806ea01b4f5929c365a
Opcode Fuzzy Hash: ffe5de81cc2eac30016ce891be4e95da36eb0d2841921297e43f9d08afbaea07
Instruction Fuzzy Hash: 2E418F70E007099FDF65DFA5C4906AEBBB6BF85300F244539D806EB344DB70A946CBA1

Function 066921D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHq, xrefs: 0669230B

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 42332424b69cafd818ae133b1fce5e4ba86dbff26e935185231b12d09bfc55ea
Instruction ID: c0e9c97dacf23409326fb5c05bd5b42a0d62fd09104e82b71c00f6ec345124cf
Opcode Fuzzy Hash: 42332424b69cafd818ae133b1fce5e4ba86dbff26e935185231b12d09bfc55ea
Instruction Fuzzy Hash: 0631E130B202049FDF58AB75D46476E3BEAAB89300F244539D806DB385DE35DD06CBA5

Function 06693859 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

{/3a, xrefs: 06693882

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: {/3a
API String ID: 0-1622527394
Opcode ID: f0c8d237e4c3bcfd816eb238cc0b7223a437b921a1c49a40f9726abe38ccd00d
Instruction ID: b2a617633196253772e40297d8f0b0c8c9142727225da8408c0e7a0731a1f56c
Opcode Fuzzy Hash: f0c8d237e4c3bcfd816eb238cc0b7223a437b921a1c49a40f9726abe38ccd00d
Instruction Fuzzy Hash: CB2127B5C00219AFCB10DF9AD985ADEFFB8FB48310F10812AE918A7340C3756544CFA5

Function 06693860 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

{/3a, xrefs: 06693882

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: {/3a
API String ID: 0-1622527394
Opcode ID: f93c3c95109ec89b40844e0a2b289c49849897d345178afb2a89863d9b64820f
Instruction ID: c1247ef7891eb6b76a6f1570d95c776a290cbee6df7317fae014c27064b9dc0a
Opcode Fuzzy Hash: f93c3c95109ec89b40844e0a2b289c49849897d345178afb2a89863d9b64820f
Instruction Fuzzy Hash: B911CFB5D01259AFCB10DF9AD985ADEFBB8FB48310F10812AE918A7340C375A944CFA5

Function 066982DE Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$q, xrefs: 06698303

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: $q
API String ID: 0-1301096350
Opcode ID: 7fc043e8ab4d466cc2fa4817b3fb8a746e83efd515cae692f0a7e7422f4f3dd1
Instruction ID: 8562bdce47f711f921f83e3daa84be2e0f5a00a7e74bc9c931c4937a98447065
Opcode Fuzzy Hash: 7fc043e8ab4d466cc2fa4817b3fb8a746e83efd515cae692f0a7e7422f4f3dd1
Instruction Fuzzy Hash: 7BF03036A14205DBDF6459F6E940268736CEB42254B14496EDD00C7254D776DE12CAB1

Function 0669C170 Relevance: .6, Instructions: 650COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34665af960024985957832c3d776b784523ab21245e55562498edbe96018273a
Instruction ID: 857697c43218eb334e559aaa8dcc2c443a515580422fea118979a461ea670e04
Opcode Fuzzy Hash: 34665af960024985957832c3d776b784523ab21245e55562498edbe96018273a
Instruction Fuzzy Hash: 7D327234B002059FDF64DB68D890BAEBBB6FB89310F108529D805EB355DB35ED46CBA1

Function 066961E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84900eed77ac7bf1bac67ba11c717836281400af3c8cbc93a85a062c9576c76b
Instruction ID: 2e8c0e9f535e483a1806581cd76b82d85e146f3f1a30df5671633a4a18772ef9
Opcode Fuzzy Hash: 84900eed77ac7bf1bac67ba11c717836281400af3c8cbc93a85a062c9576c76b
Instruction Fuzzy Hash: CF617271F002214BEF549B7DC88065EBADBAFC4614B194439D80AEB364DEB5ED4287D2

Function 06694280 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14256f546f6172c11b58ac4cc2784fdd631ae1f40c2e1732bab0d66ff7cdd8f
Instruction ID: dbd94687a853491ead8d0459d73dcc8b7b37167afb2ae0679bf840f63f0bdd65
Opcode Fuzzy Hash: a14256f546f6172c11b58ac4cc2784fdd631ae1f40c2e1732bab0d66ff7cdd8f
Instruction Fuzzy Hash: 2D812D30B102098FDF54DBB9D4507AEBBE7AF89300F148529D909EB349EE75DC468BA1

Function 066945A0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85cad1e7ba335caa135c3148bbcbf121aa412a5a2a3cee3038ec40a1da01dbf6
Instruction ID: d7266172773b7efe437e91ebe4bc2f7bea7a4ae06d3a319a8f6979ff873c2675
Opcode Fuzzy Hash: 85cad1e7ba335caa135c3148bbcbf121aa412a5a2a3cee3038ec40a1da01dbf6
Instruction Fuzzy Hash: 60912034E102198FDF60DF64C890B9DBBB1FF85310F208695D549BB355DB70A986CB91

Function 066945B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c564f94fca69d01ede2cc2555635fbde8dc4e302b8617bbcbde2e418271d8d75
Instruction ID: cb208fe97dc4a959f81304c91681627066dc9c0a9e8a7a1d401b2cfa7c113714
Opcode Fuzzy Hash: c564f94fca69d01ede2cc2555635fbde8dc4e302b8617bbcbde2e418271d8d75
Instruction Fuzzy Hash: 41914E34E102198BDF64DF68C880B9DB7B1FF89310F208699D549BB355DB70AA86CF90

Function 0669EEF0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7501da745d399a57d22e8e2b369333c59648a510d96f23e3147bcb180bc32bb8
Instruction ID: 5e6144fd4f4b89284996babe4749edc278cb20b77b965ebcccdfb0e104891a97
Opcode Fuzzy Hash: 7501da745d399a57d22e8e2b369333c59648a510d96f23e3147bcb180bc32bb8
Instruction Fuzzy Hash: 13814D70A002089FDF54DBA8D980A9EBBFAFF88314F158529E405EB355DB35ED46CB50

Function 0669EF00 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8189b712a2c4a554d5cd2c543b9ab008183fde2de499f18f4d8dbcc929fa57
Instruction ID: 88fa9381e69e8327ad17f1ca31f27e9be3de4c2e5a8fe24b6277e3e241708072
Opcode Fuzzy Hash: 4a8189b712a2c4a554d5cd2c543b9ab008183fde2de499f18f4d8dbcc929fa57
Instruction Fuzzy Hash: 1A713C70E002089FDB54EBA8D990A9EBBFAFF88314F158429E405EB355DB35ED46CB50

Function 0669FC58 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3eb64a7bf32b347ab5f3e94aa8ad19ced17943478dfcb55ead5826790cfb18
Instruction ID: e329c93baa21b480994a27a862163413bb71b386a67d2a3dd2852863267f2d94
Opcode Fuzzy Hash: bf3eb64a7bf32b347ab5f3e94aa8ad19ced17943478dfcb55ead5826790cfb18
Instruction Fuzzy Hash: C451F531E00204DFDF54ABB8E4546AEBBB6FB84315F118839E906D7351DB35895AC7A0

Function 0669FA0A Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4a9805615837194fada53acf546ae4cf501ea9a111d3b7bfc300f55f0bfd2b
Instruction ID: c1fa1456f5fb5b490f3488121371e364268f605474f32bc1a7851b40b45c6099
Opcode Fuzzy Hash: de4a9805615837194fada53acf546ae4cf501ea9a111d3b7bfc300f55f0bfd2b
Instruction Fuzzy Hash: 94519730F102148FEF646A68D89476F769FE78D310F21442AE80AC73A5CB78DC4397A1

Function 0669FA18 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa97c300290bccc8f291f5c9f42365b6473e05fa24c4a79cec0df0cb0959c42
Instruction ID: 29100e1133bf9c1056ca302ae5fd101df8d974875ae51c32119b7264c0b57042
Opcode Fuzzy Hash: bfa97c300290bccc8f291f5c9f42365b6473e05fa24c4a79cec0df0cb0959c42
Instruction Fuzzy Hash: 8551B430F102149BFF646A68D894B2F365FD78D350F21442AE80BC73A9CA78DC4397A2

Function 066953F8 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcb019079264a0a84fb4649600ce50746336c2c8678e8c01066f96405672868e
Instruction ID: a687ced1ad5b971445fed432df8d946c3a3e7fa39cf11c55c3fc852d2b76d0da
Opcode Fuzzy Hash: fcb019079264a0a84fb4649600ce50746336c2c8678e8c01066f96405672868e
Instruction Fuzzy Hash: 0441A031E006098FDF71CFA9C880AAFFBB6FB44310F10492AE556D7611D730E9568BA1

Function 0669D950 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4413f439cc000ee3e57102289c5c3f75cb3fd2e7f302a776566c9a86bf697a6e
Instruction ID: 08d7912cfb606b8c7ef4605dccb051ddf342df55d298a57c357f6ec4d77a176e
Opcode Fuzzy Hash: 4413f439cc000ee3e57102289c5c3f75cb3fd2e7f302a776566c9a86bf697a6e
Instruction Fuzzy Hash: 4B317030E1075A8FDF25DF68D890A9EBBB6EF85304F144929D805EB344EB71F9468B90

Function 06692081 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5857ccb24abdb950e48c52b59ee89e750be331e64d4d0c0934662b3c9635ae
Instruction ID: 6007944ae07cf3ca9277365a665829b6a3b3f12971ca3cedde2b10638da89def
Opcode Fuzzy Hash: 2a5857ccb24abdb950e48c52b59ee89e750be331e64d4d0c0934662b3c9635ae
Instruction Fuzzy Hash: F6318F30E102059FDB59CF64D8646AEB7BAFF89300F108429E906EB344DB31EE46CB50

Function 06692090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213b67899349489ef2c33940e8cde5d4166f36fd48cbaa722f1d144dae9a1f01
Instruction ID: 2b2ff0be4154aa5a9b307112e5cbcbf259c083c6b9f0f8865d41a8abbd3c6c1f
Opcode Fuzzy Hash: 213b67899349489ef2c33940e8cde5d4166f36fd48cbaa722f1d144dae9a1f01
Instruction Fuzzy Hash: C7316034E106059BDF59CF64D86469FB7BAFF89300F108529EA06E7344DB71AD86CB50

Function 06693A80 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37fddadd1aa9db73a0a31a53d06a132118fd05f2ab349836771748e4cca8e64
Instruction ID: 92c285eef6a93505bb1af64e9e48aa1c528060555de63fa5fa7b12b826f40ce7
Opcode Fuzzy Hash: f37fddadd1aa9db73a0a31a53d06a132118fd05f2ab349836771748e4cca8e64
Instruction Fuzzy Hash: B1215A75E002189FDF45DFA9D880AEEBBF9EB48310F148126EA05E7355E731D8428BA0

Function 06693A90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6398369a2ed8ea378579f0b994923f44b26b5077b398b1ec2f846f29d11317
Instruction ID: 413efffc4de4466ae230802be92567a3e595e5f9152c5b96aa9b091390464f93
Opcode Fuzzy Hash: 0a6398369a2ed8ea378579f0b994923f44b26b5077b398b1ec2f846f29d11317
Instruction Fuzzy Hash: C2216975E002189FDF54DF6AD880AAEBBF5EB48310F108029EA05E7354E771D842CBA0

Function 00E3D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2488073249.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e3d000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e30e64aaac6c0a7258ebc2a700ee26e1191fb2376bf64fd179bb509cb22d42
Instruction ID: c1796751b463ac591901570c413d4a394e350378d1dcd47b17fb7020a9700406
Opcode Fuzzy Hash: 43e30e64aaac6c0a7258ebc2a700ee26e1191fb2376bf64fd179bb509cb22d42
Instruction Fuzzy Hash: 9B210371608304DFDB18DF10ED88B26BFA6EB84718F20C569D8091A282C336D847CE62

Function 00E3D005 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2488073249.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e3d000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f3f0d3e3a8b6d10ae779bc3cb82b0f45f039f1e76739ea2f500fd37d307320
Instruction ID: 972f2a51093a75d07e1d470f4ab428bf08bd2a4a68f147a657f103b545d6beda
Opcode Fuzzy Hash: c2f3f0d3e3a8b6d10ae779bc3cb82b0f45f039f1e76739ea2f500fd37d307320
Instruction Fuzzy Hash: 81215C7150D3C09FCB07CB24D994711BF71AF46214F29C5EBD8898F2A7C23A980ACB62

Function 06693BA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56233022221fcf5f2dc3a3ea5a74fb635e22310c2b63a7928b2a4a37d704daf7
Instruction ID: 3b5275e50a93d1a50235332c85723099d78092cdf485d8b224032a984f0fd729
Opcode Fuzzy Hash: 56233022221fcf5f2dc3a3ea5a74fb635e22310c2b63a7928b2a4a37d704daf7
Instruction Fuzzy Hash: F9116131B045288FDF989A69D8546AF77AFEBC8310F008579D916E7344EE65DC0287E1

Function 066941E2 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b25f7a1d826d2b8b94b035679e241c43f76eaeff1f2bc3da4e699557506864e1
Instruction ID: 21b20179644176ae9e913a0ec9e3993c53af3cff37f62298c94b129f08cacfe8
Opcode Fuzzy Hash: b25f7a1d826d2b8b94b035679e241c43f76eaeff1f2bc3da4e699557506864e1
Instruction Fuzzy Hash: B501F130B042101FDB6592BDD810B6BA7DFEBCA320F10847AE50ACB355DD65CC4343A1

Function 0669A2F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c18949e47d15dd3062a7d6ca53dfdea092146ebfdc4f0a191ffbe4465528ea
Instruction ID: 150ff6c3a812f93bba65443b708bf4a4bef0c0f5c2b41241f9a9e89b423a0718
Opcode Fuzzy Hash: c4c18949e47d15dd3062a7d6ca53dfdea092146ebfdc4f0a191ffbe4465528ea
Instruction Fuzzy Hash: 9201B535B145105FCBA196BCD861BAF77E9EB8B320B108869E40ECB385DA15DC0387D1

Function 06693B8F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85bd9601774c1fa3c1731c20a4ef9683d209f7f038621e342ab80d8220817752
Instruction ID: 67895ee2c30606abce18de2d4306a72128b16db808236addb1f0e15357b80d7f
Opcode Fuzzy Hash: 85bd9601774c1fa3c1731c20a4ef9683d209f7f038621e342ab80d8220817752
Instruction Fuzzy Hash: 2E01D632B045145BDF9595ADDC106EF7BAF9BC9320F04407AE915E7344EF50880687E1

Function 0669F171 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac01970dd0dfd36b18a652be62c9809d66e8bcc70092299fd26ad3b0668779a3
Instruction ID: 48ba6ac1b08d592abed524eaf403b9a9958df9aca1b303e37aea42eb47655494
Opcode Fuzzy Hash: ac01970dd0dfd36b18a652be62c9809d66e8bcc70092299fd26ad3b0668779a3
Instruction Fuzzy Hash: A101DE31B001114FCFA5963DD891B2EBBE6EB8A310F15896AE80ACB342DA20DC0347E1

Function 066941F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c0981a2807a2b1c3e2f2435c032848b7f75b1b643bb09349e07a19120ec22c4
Instruction ID: 63c10be58cfe287c428d1fecc487f52beb194b27c631978e203a703a8e783de5
Opcode Fuzzy Hash: 7c0981a2807a2b1c3e2f2435c032848b7f75b1b643bb09349e07a19120ec22c4
Instruction Fuzzy Hash: D2016931B101200BEFA895AEE454B2BA6DFEBC9720F20883AE50AC7354ED65DC4347A5

Function 0669F180 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 402ca5e9c6ee69040f13aba4d9c162697f65c8b4f72e1e1a9da58485f2548ca5
Instruction ID: a4a62e9695f820d3831437cba351a0e0dfe3312f54c792d639b28f9d7b59ab17
Opcode Fuzzy Hash: 402ca5e9c6ee69040f13aba4d9c162697f65c8b4f72e1e1a9da58485f2548ca5
Instruction Fuzzy Hash: EE018C75B105210BDFA8957DE854B2F66DAEBCA720F218829E90EC7344EE25DC0347E1

Function 0669A300 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8087a7c724b6c99e2b54cdfbd94e4368eb56e500e013bfb394c17de829ac6a9e
Instruction ID: c1ecbf7520292938f02620b9096f56133b0f3d94f2343472e5c444385ba18d4e
Opcode Fuzzy Hash: 8087a7c724b6c99e2b54cdfbd94e4368eb56e500e013bfb394c17de829ac6a9e
Instruction Fuzzy Hash: 80018134B101104FDBA49ABDE450B2F73D9EB8A320F108829E90EC7344E925DC028790

Function 06696461 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007d1d13133178242a1f88b0707c3b6a392dad5618b9044b68eda080a6072d91
Instruction ID: 71f40abf27c43ce3e558f006b7dd8cc9cd3023e18138bdebe90f9e5bcdf25d34
Opcode Fuzzy Hash: 007d1d13133178242a1f88b0707c3b6a392dad5618b9044b68eda080a6072d91
Instruction Fuzzy Hash: A3E09B71D553087BEF50CEF4C915696775ED702624F20C465DC04CB341E272DD1186B1

Non-executed Functions

Function 06697688 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$q, xrefs: 06697B85
$q, xrefs: 06697B79
$q, xrefs: 06697C3A
$q, xrefs: 06697C24
$q, xrefs: 066977F9
$q, xrefs: 066977BC
$q, xrefs: 066977C8
$q, xrefs: 06697C18
$q, xrefs: 066977ED
$q, xrefs: 06697C2E

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-1298971921
Opcode ID: 05b247cfac913e8eaf647d8db8b6096d9a97dfffb1667bdbf99b49f02c2f120e
Instruction ID: 46cf1f70c190af7ec574d14b0c868d1ce2a8d07ca81935676d08b2e2682accbd
Opcode Fuzzy Hash: 05b247cfac913e8eaf647d8db8b6096d9a97dfffb1667bdbf99b49f02c2f120e
Instruction Fuzzy Hash: F5122C30E10219CFDB68DB65D854A9DBBB6FF88301F208569D80AAB355DB30DD86CF90

Function 0669A920 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$q, xrefs: 0669AAA8
$q, xrefs: 0669AA71
$q, xrefs: 0669AA7D
$q, xrefs: 0669AA9C
$q, xrefs: 0669AADE
$q, xrefs: 0669AA16
$q, xrefs: 0669AA22
$q, xrefs: 0669AAD2

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: 1ea332c91e3a8b62334a7a6cff4ede07d44d1092cd7874ce2992513f09e8b779
Instruction ID: caf07d196b4e743e62d6fb77e8b81938150017d28c021888bd70a213e3df8dcc
Opcode Fuzzy Hash: 1ea332c91e3a8b62334a7a6cff4ede07d44d1092cd7874ce2992513f09e8b779
Instruction Fuzzy Hash: 40915D30E00209DFEF64EBA5D955BAE77FAEF44304F108529E802AB354DB749D46CBA0

Function 06697088 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$q, xrefs: 0669759C
$q, xrefs: 066973D0
$q, xrefs: 06697524
$q, xrefs: 0669736A
$q, xrefs: 06697590
$q, xrefs: 066973C4

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 08fe7379f91dba4abdcb01363115bb84cc5ab1c2d439d7e4ae4e276846747ee9
Instruction ID: 0c4b4a5e0d2227f332865f41f1418442cf8a32c7a1389f50338050df1bf7e790
Opcode Fuzzy Hash: 08fe7379f91dba4abdcb01363115bb84cc5ab1c2d439d7e4ae4e276846747ee9
Instruction Fuzzy Hash: 7FF13030A10208CFDB55EBA5D455A6E7BB6FF84301F248529D8059B369DF75EC83CBA0

Function 066983C0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$q, xrefs: 0669868B
$q, xrefs: 0669867F
$q, xrefs: 06698626
$q, xrefs: 0669861A

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 734d25b611b720587c9039ab2859435c8f00379e3274deb83767b45c4267a2d2
Instruction ID: 68487629f50dc10ec0a0d3291d7fbeeb09e8bfee5bd176631558ad265827c183
Opcode Fuzzy Hash: 734d25b611b720587c9039ab2859435c8f00379e3274deb83767b45c4267a2d2
Instruction Fuzzy Hash: 0FB14C30A10218CFDB64EBA5D8446AEB7B6FF85300F24896DD806DB355DB75EC82CB90

Function 066987D8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$q, xrefs: 06698857
LRq, xrefs: 066988CB
$q, xrefs: 06698863
LRq, xrefs: 0669891A

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: LRq$LRq$$q$$q
API String ID: 0-2204215535
Opcode ID: 420c81e21f911fbc595e64bdd1f10f1e780026b1602e36edf3272d77c9b7a121
Instruction ID: 851e65c43043a8d0646bc948befd5bee202d0f7ef57f00c8441f9e1b8851397e
Opcode Fuzzy Hash: 420c81e21f911fbc595e64bdd1f10f1e780026b1602e36edf3272d77c9b7a121
Instruction Fuzzy Hash: B5518330B002019FDB58EB79D941B6E77EAFF85304B14896DE806DB355DA31EC46CBA1

Function 0669ACA8 Relevance: 5.2, Strings: 4, Instructions: 164COMMON

Download Yara Rule

Strings

$q, xrefs: 0669AE2C
$q, xrefs: 0669ADD9
$q, xrefs: 0669AE5B
$q, xrefs: 0669AE84

Memory Dump Source

Source File: 00000013.00000002.2527887682.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6690000_lC7L7oBBMC.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 88edb332c391a39c65490eab70fcc052949aba7939ba485cfdc4602f8111ca38
Instruction ID: b6d995a81827017e2f5b5b7e9d60cc7c8de31965a5531418b9c47ae15bc418ad
Opcode Fuzzy Hash: 88edb332c391a39c65490eab70fcc052949aba7939ba485cfdc4602f8111ca38
Instruction Fuzzy Hash: 2651C134E102449FDF65EBA4D8806AEB7FAEF88311F24452AEC059B355DB35DC46CBA0

Analysis Process: wlBldyvi.exePID: 7700, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	218
Total number of Limit Nodes:	9

Executed Functions

Function 073F8C7D Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073F8EB6

Memory Dump Source

Source File: 00000015.00000002.1382401064.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_73f0000_wlBldyvi.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f02095491575a833d9c2c2fcbc8b182e94fa9f5dcf127cd1cea312932d01cb21
Instruction ID: a75da53d0b4c1f68b7c483997d0399901bc6ccbc1e6a29f7ac76c6c52efc73e2
Opcode Fuzzy Hash: f02095491575a833d9c2c2fcbc8b182e94fa9f5dcf127cd1cea312932d01cb21
Instruction Fuzzy Hash: D7914AB1D0131ADFEF24CF68C840BEDBBB2BF59350F14856AE908A6240DB749985CF91

Function 073F8C80 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073F8EB6

Memory Dump Source

Source File: 00000015.00000002.1382401064.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_73f0000_wlBldyvi.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 630367b0569d5ae89f00e81bb4f13b0d8f7e929a044e395453c24647600e2c64
Instruction ID: e2864a4ddc89abcd0ed6d66188f7c163f0cd7af7d0e26593f303ade0d7581afa
Opcode Fuzzy Hash: 630367b0569d5ae89f00e81bb4f13b0d8f7e929a044e395453c24647600e2c64
Instruction Fuzzy Hash: AB9139B1D0171ACFEF24CFA8C840BDDBBB2BF49350F14856AE918A6240DB749985CF91

Function 0186AE30 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0186B086

Memory Dump Source

Source File: 00000015.00000002.1347375098.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1860000_wlBldyvi.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ecbe3d9645cfb5489d5b68a19d2f0a35a827dd3e4762c85bb4f07d83e1286183
Instruction ID: 4a9c970295b45b5cb9e8107c299b55b9e71061ac9990b23e898a1e079d696fe6
Opcode Fuzzy Hash: ecbe3d9645cfb5489d5b68a19d2f0a35a827dd3e4762c85bb4f07d83e1286183
Instruction Fuzzy Hash: E9816AB0A00B058FDB28DF69D44075ABBF5FF88304F00892DD04AEBA50D775E946CB91

Function 0186449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 018659C9

Memory Dump Source

Source File: 00000015.00000002.1347375098.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1860000_wlBldyvi.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 54bba506f72ea44d8ef8f3da5bb466feafd126d04dcc845e11520585c51d36ee
Instruction ID: f4f270318b0f102427d9a8453c2a1b42cda29f78d66d12341b5b1eb09e29da2c
Opcode Fuzzy Hash: 54bba506f72ea44d8ef8f3da5bb466feafd126d04dcc845e11520585c51d36ee
Instruction Fuzzy Hash: 3A41E471C0071DCBDB24DFA9C884B8DBBF5BF49314F60816AD408AB251DB756A46CF90

Function 0186590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 018659C9

Memory Dump Source

Source File: 00000015.00000002.1347375098.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1860000_wlBldyvi.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a769c1348fe6b4d2e8bdb5cb5d0a6d55add9634d068ea2452e23f269f7a8adf1
Instruction ID: 4d67d4bea34148eff2dea304e4b2e4bf5c191ced9021bf1e1c547a021bae02f9
Opcode Fuzzy Hash: a769c1348fe6b4d2e8bdb5cb5d0a6d55add9634d068ea2452e23f269f7a8adf1
Instruction Fuzzy Hash: 8141E271C0072DCBEB24DFA9C884B8DBBF5BF49314F20816AD408AB250DB756A46CF90

Function 073F89F8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 073F8A88

Memory Dump Source

Source File: 00000015.00000002.1382401064.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_73f0000_wlBldyvi.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 996d87698fe43ff67a7f1df3af9a1d5285abf52dd9979e8d5dc67fb551d97a73
Instruction ID: 47a02a79f6cf4a6b1abaef73df756cca7ad604d668b9d009c8647717ad17101a
Opcode Fuzzy Hash: 996d87698fe43ff67a7f1df3af9a1d5285abf52dd9979e8d5dc67fb551d97a73
Instruction Fuzzy Hash: 052113B59013099FDB14DFAAC885BDEBBF5FF48310F50882AE918A7240D7789945CBA4

Function 0186D2F8 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0186D2C6,?,?,?,?,?), ref: 0186D387

Memory Dump Source

Source File: 00000015.00000002.1347375098.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1860000_wlBldyvi.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bdb702458034eaac63510d12e3dd6020b77383594f91f120d371ba61bfdb8425
Instruction ID: 35ad296391e95bd440ec66fff1fa39d6ae0c7d73a526a5ad81c8530fa6375397
Opcode Fuzzy Hash: bdb702458034eaac63510d12e3dd6020b77383594f91f120d371ba61bfdb8425
Instruction Fuzzy Hash: A12123B5D003499FDB21CFA9D984ADEBBF5AB09320F14855AE968A7250D338A941CF60

Function 073F8858 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 073F88DE

Memory Dump Source

Source File: 00000015.00000002.1382401064.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_73f0000_wlBldyvi.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 055f889aad9d1a17356d679e3068a063f2233b0b54a36338bba832643f68f544
Instruction ID: 2659bc07652caf684d779990abf3c1dacd3d2b7d9d6735cc42606d0be454f29b
Opcode Fuzzy Hash: 055f889aad9d1a17356d679e3068a063f2233b0b54a36338bba832643f68f544
Instruction Fuzzy Hash: 09215C71D003098FDB14DFAAC4857EEBBF1AF48320F10852AD529A7280CB789945CF94

Function 0186C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0186D2C6,?,?,?,?,?), ref: 0186D387

Memory Dump Source

Source File: 00000015.00000002.1347375098.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1860000_wlBldyvi.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b452550e606896b960e7872bb93ec5a2d08f22a32dc50846159b1c0216b53116
Instruction ID: ae3457736623e991c657076cc33ffb155960aeec41bdc457d9a40f6c4ab916ad
Opcode Fuzzy Hash: b452550e606896b960e7872bb93ec5a2d08f22a32dc50846159b1c0216b53116
Instruction Fuzzy Hash: 5821E6B5D00348EFDB10CF9AD984ADEBBF9EB48310F14841AE958A7350D374A954CFA4

Function 073F8AE8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073F8B68

Memory Dump Source

Source File: 00000015.00000002.1382401064.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_73f0000_wlBldyvi.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d0f53133a12a1e3f85b4f1e7532548c78832b249013644382597d7e357e29f89
Instruction ID: 22b72ec22eb821ce3aa3335f41f4fe958e608ec425bc7564c54000ae99b03923
Opcode Fuzzy Hash: d0f53133a12a1e3f85b4f1e7532548c78832b249013644382597d7e357e29f89
Instruction Fuzzy Hash: C32114B1C003499FDB10DFAAC881BEEBBF5FF48310F50842AE919A7240C7399941CBA4

Function 073F8860 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 073F88DE

Memory Dump Source

Source File: 00000015.00000002.1382401064.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_73f0000_wlBldyvi.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3dd0589c064b2a370ea3afe8b666232692b18c0c5d0b5dee4474539ea819b0d3
Instruction ID: 0c207efffc7729319b07183cfc6cdde4b6f38e27368daed33173ab2a2d599197
Opcode Fuzzy Hash: 3dd0589c064b2a370ea3afe8b666232692b18c0c5d0b5dee4474539ea819b0d3
Instruction Fuzzy Hash: 142138B1D003098FDB14DFAAC4857EEBBF4EF48310F54842AD559A7240DB789945CFA4

Function 073F8938 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073F89A6

Memory Dump Source

Source File: 00000015.00000002.1382401064.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_73f0000_wlBldyvi.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ac605768f8df31e307916a6779ba38744d29064f6d404fb2b4a83829e55c6136
Instruction ID: 5728f36e9f28cb3d08f2a0b8826ef79d42610d3424e2371d4a080e600bcb4739
Opcode Fuzzy Hash: ac605768f8df31e307916a6779ba38744d29064f6d404fb2b4a83829e55c6136
Instruction Fuzzy Hash: 001144718003099FDB20DFAAC844BDEBBF5AB88320F108819E919A7250CB35A940CFA1

Function 073F87A8 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 073F8812

Memory Dump Source

Source File: 00000015.00000002.1382401064.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_73f0000_wlBldyvi.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9fec1465e994ee3f62b979372833be8540d0327c073b93e0022a5d5a100575a5
Instruction ID: 01bbd837d7d700ee43f72be1f28d757c5f5599804df130d3339e6912df8ba23e
Opcode Fuzzy Hash: 9fec1465e994ee3f62b979372833be8540d0327c073b93e0022a5d5a100575a5
Instruction Fuzzy Hash: FF114CB1D003498FDB24DFAAC8457EEBBF5EF88320F248919D569A7240CB355545CF94

Function 073F893A Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073F89A6

Memory Dump Source

Source File: 00000015.00000002.1382401064.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_73f0000_wlBldyvi.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 19f4c33114179e27cfca0d590bef90d2bf43744afbeb6ca1ec92b8e1941355cd
Instruction ID: f61c96e00e9ce1a09d8d9076474008b45eb0b283107eff974a738ad81203ce40
Opcode Fuzzy Hash: 19f4c33114179e27cfca0d590bef90d2bf43744afbeb6ca1ec92b8e1941355cd
Instruction Fuzzy Hash: 62112675D003499FDB24DFAAC844BEEBBF5AF88310F148819E959A7250C7359941CFA1

Function 073F87B0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 073F8812

Memory Dump Source

Source File: 00000015.00000002.1382401064.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_73f0000_wlBldyvi.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1c6aecd4b2ab1d7763bce45b537ae3d58e9a9d2a02a04fd729e985864be15e8c
Instruction ID: 291efd18a7e2de35f8ae38cfe836334bfe9915e72f35ceebc82ee911cfad08ab
Opcode Fuzzy Hash: 1c6aecd4b2ab1d7763bce45b537ae3d58e9a9d2a02a04fd729e985864be15e8c
Instruction Fuzzy Hash: A61128B1D003498FDB24DFAAC4457DEFBF5EB48320F148419D519A7240CB79A945CFA4

Function 073FBF38 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 073FBF9D

Memory Dump Source

Source File: 00000015.00000002.1382401064.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_73f0000_wlBldyvi.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6f480fa54ae596cf9b0b0109b529622cb628192d31c08c36cf8ea8fd65a5d73b
Instruction ID: 80c2b40bcbd095094baa748d62657a6ecab02c6ceb0ba50ec5ba34f096bc5632
Opcode Fuzzy Hash: 6f480fa54ae596cf9b0b0109b529622cb628192d31c08c36cf8ea8fd65a5d73b
Instruction Fuzzy Hash: 1911D6B5800359DFDB10DF9AD945BDEFBF8EB48320F10841AE958A7240D375A984CFA1

Function 073F70D4 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 073FBF9D

Memory Dump Source

Source File: 00000015.00000002.1382401064.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_73f0000_wlBldyvi.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a4af4b77c9b42a7963084f511a1acf1941da86b9443746584e7b43b3f02ccb65
Instruction ID: e6407d3dfda6405b94e0ef22dc929cdfe5653ed662a33f143261dcbd025a6893
Opcode Fuzzy Hash: a4af4b77c9b42a7963084f511a1acf1941da86b9443746584e7b43b3f02ccb65
Instruction Fuzzy Hash: 3211F2B5804349DFDB20DF9AD885BDEFBF8EB48320F10841AE919A7240C375A944CFA1

Function 0186B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0186B086

Memory Dump Source

Source File: 00000015.00000002.1347375098.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1860000_wlBldyvi.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 35dec446862f7f04ddffd0e4802738e003b485e3d1891e7344715a1a1a72b833
Instruction ID: a015a6cb73c7930d297186a2dd9876eac243504ed6f0f3b38dfd9fc78e07806a
Opcode Fuzzy Hash: 35dec446862f7f04ddffd0e4802738e003b485e3d1891e7344715a1a1a72b833
Instruction Fuzzy Hash: 531102B5D003498FDB20DF9AC444A9EFBF8AB48314F10841AD528A7210D379A645CFA1

Function 0160D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1346700854.000000000160D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_160d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bead1278633639af3d71db82a9049d2e9d41eb5bebb4675bb90b08df81cab66d
Instruction ID: 188af1168aee8a080e6186d438df0db8e2c8dedde6a1904f65baa29ee633d09f
Opcode Fuzzy Hash: bead1278633639af3d71db82a9049d2e9d41eb5bebb4675bb90b08df81cab66d
Instruction Fuzzy Hash: 6F21C471504340DFDB1ADF94DDC4B27BB65FB88324F24C669EA050A286C336D417CBA1

Function 0160D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1346700854.000000000160D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_160d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e8564e022874ae9ccb42de16c94fbfad200ec9fdbfe3b8d8952b7c4d1b742b
Instruction ID: 7c6f5ceb9344f38cb84260f128cce7c61e43fa90611da9deaf6c018e2f775c1f
Opcode Fuzzy Hash: 93e8564e022874ae9ccb42de16c94fbfad200ec9fdbfe3b8d8952b7c4d1b742b
Instruction Fuzzy Hash: 7A21F471504204DFDB1ADF94D9C0B5BBB65FB94324F20C269E9090B396C336E456CAA2

Function 0161D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1346934232.000000000161D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0161D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_161d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3eabf21e5353c42b7950e6b684ebc836f20867b76c4ce6192d93a3d21d4023
Instruction ID: 12fefe44ddbdd3e2dd36b2cad49da9aac9a6dc0ed0e60b86ef9e10c0c7634c7f
Opcode Fuzzy Hash: cf3eabf21e5353c42b7950e6b684ebc836f20867b76c4ce6192d93a3d21d4023
Instruction Fuzzy Hash: 23212571604200EFDB05DF94D9C8B55BBA1FB84324F28C66DDA094B35AC336D407CA61

Function 0161D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1346934232.000000000161D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0161D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_161d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd7a39921acad71a27da74b14f22fed9e1fd287980efecbe0ef775f94bfdf892
Instruction ID: bcf1660afd318829ec6716543eddebca6f9a74ecbe593ad6c2548200277a45ee
Opcode Fuzzy Hash: bd7a39921acad71a27da74b14f22fed9e1fd287980efecbe0ef775f94bfdf892
Instruction Fuzzy Hash: 64212275604300DFDB15DF54DDC8B16BB61EB84315F28C5ADD80A0B38AC33AD847CA62

Function 0161D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1346934232.000000000161D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0161D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_161d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ffe435ad62ae9cb861b432095fd38155d7f825aadd9d7836bdb057ccd59a7c5
Instruction ID: 8bf9a04ec12e8f1a5d2ea5ce556bb9d81c84b3206f2201ef24b7193c789c0d41
Opcode Fuzzy Hash: 8ffe435ad62ae9cb861b432095fd38155d7f825aadd9d7836bdb057ccd59a7c5
Instruction Fuzzy Hash: 5A21AE755093808FCB03CF64D994B15BF71EB46214F28C5EAD8498F6A7C33A980ACB62

Function 0160D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1346700854.000000000160D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_160d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa0a9b6888ab601070468a7c49be392b44274aed9e91ce62da6c30ec0883e0c
Instruction ID: fa05805adb889d8eb47908e87029cc2f509deaffaecc702f306184edc233c8d6
Opcode Fuzzy Hash: 6fa0a9b6888ab601070468a7c49be392b44274aed9e91ce62da6c30ec0883e0c
Instruction Fuzzy Hash: 9E21AF76504240DFDB0ACF94D9C4B56BF72FB84324F24C6A9DD490B696C33AD426CBA1

Function 0160D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1346700854.000000000160D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_160d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 92df6f73ed0695e0f324e75200224b8d84902cba7d810680ce7c77cf2cd23c33
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: EB11DF76504240DFCB06CF84D9C0B56BF72FB84324F24C2A9D8090B297C33AE456CBA1

Function 0161D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1346934232.000000000161D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0161D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_161d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 437c6b9390fd744d1b5d8b2ae16ecc977cd872cefb196a20bc12e7c7ed9f914e
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 8311BB75504280DFCB06CF58C9C4B55BBA2FB84324F28C6ADD9494B7AAC33AD40ACB61

Function 0160D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1346700854.000000000160D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_160d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d5ddb8740317e17041f3c5bc05c86ca289cb97debdaba8a2917bdb0d16d880
Instruction ID: ca27d6d224026b4c668a21983e784a9be156b87db3819e77f7db94c4244f9438
Opcode Fuzzy Hash: 86d5ddb8740317e17041f3c5bc05c86ca289cb97debdaba8a2917bdb0d16d880
Instruction Fuzzy Hash: CC01F7310083809EE7264AD5CC84B77FF98DF41221F18C65AED180A3C6C3789845CAB2

Function 0160D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1346700854.000000000160D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_160d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb68d78513618e35e521c13da1492c9614127145612832a29d0e985d3a31e44d
Instruction ID: 34d5f51098b55fea9a882e484142038c493f1e898273a408aa2b120b2f0d0267
Opcode Fuzzy Hash: bb68d78513618e35e521c13da1492c9614127145612832a29d0e985d3a31e44d
Instruction Fuzzy Hash: D4F0C231008380AEE7258A4ACC84B63FFA8EF41734F18C55AED180A3C7C379A844CAB1

Analysis Process: wlBldyvi.exePID: 2620, Parent PID: 7700COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	258
Total number of Limit Nodes:	11

Executed Functions

Function 011DD460 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 011DD4DE
GetCurrentThread.KERNEL32 ref: 011DD51B
GetCurrentProcess.KERNEL32 ref: 011DD558
GetCurrentThreadId.KERNEL32 ref: 011DD5B1

Memory Dump Source

Source File: 0000001E.00000002.1373276047.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_11d0000_wlBldyvi.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 703ce539ca980113fa07cda5914d9ef7b6ed22454b388173ac163b5c30401b9b
Instruction ID: b9996bfb070b31fc8a4c460130219dca4147111b705d3003359b867159a09ff3
Opcode Fuzzy Hash: 703ce539ca980113fa07cda5914d9ef7b6ed22454b388173ac163b5c30401b9b
Instruction Fuzzy Hash: 395154B0D003098FDB29DFAAD548B9EBBF1AF48314F20C469E419A7390DB34A945CB65

Function 075639ED Relevance: 1.8, APIs: 1, Instructions: 254
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07563C2E

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2999705a86f83e85b372f88fc4b489a6e1e4e3de48d59ed509c56dfce125162e
Instruction ID: 202548465ee21055d24d17bc8c9119352b6875e37c5761ee7f9b74bddba745b6
Opcode Fuzzy Hash: 2999705a86f83e85b372f88fc4b489a6e1e4e3de48d59ed509c56dfce125162e
Instruction Fuzzy Hash: 7FA16DB1D0031ADFEB24CF68C845BEDBBB2BF44314F04816AE809A7290DB759985CF91

Function 075639F8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07563C2E

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0cb68e2475d9dddf92c2f1955a3efe3e757eb9e0863f7bea8be90a8747e9bc84
Instruction ID: 29bc2c62464e02b3d2383bd7608a47100436a8f04ca9fdfccd96d53705996e06
Opcode Fuzzy Hash: 0cb68e2475d9dddf92c2f1955a3efe3e757eb9e0863f7bea8be90a8747e9bc84
Instruction Fuzzy Hash: 6E916EB1D0031ACFEB24CF69C845BEDBBB2BF44314F14816AE809A7290DB759985CF91

Function 05451CED Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05451E02

Memory Dump Source

Source File: 0000001E.00000002.1398513851.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_5450000_wlBldyvi.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9927303276ba3a7f3a3f677ae1957bf9b0ad8526c56051e37a1eaa853c38a543
Instruction ID: a19e3062aad964116e2758d3ff635813707d03fee06921a37cfb96e6566dcde3
Opcode Fuzzy Hash: 9927303276ba3a7f3a3f677ae1957bf9b0ad8526c56051e37a1eaa853c38a543
Instruction Fuzzy Hash: 1451C1B1D00359DFDB14CF9AC884ADEBFB2BF48310F64812AE819AB211D7759845CF90

Function 05451CF0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05451E02

Memory Dump Source

Source File: 0000001E.00000002.1398513851.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_5450000_wlBldyvi.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 00ee040d5b4534f5c64dd5a23d1725af0c4c64505cd00a88669ab49de55b0681
Instruction ID: c986459edb2e2ce829356c9815a83e84b1aec9ff2650bdb0d09bd4d2546f2330
Opcode Fuzzy Hash: 00ee040d5b4534f5c64dd5a23d1725af0c4c64505cd00a88669ab49de55b0681
Instruction Fuzzy Hash: AB41B0B1D00359DFDB14CF9AC884ADEBBB5FF48310F64812AE819AB211D775A845CF94

Function 05451284 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05454381

Memory Dump Source

Source File: 0000001E.00000002.1398513851.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_5450000_wlBldyvi.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 50a0865b1a0c244fd3b1adff1fd447a1e9ace1cd61cca23db23a3808608efe85
Instruction ID: 61aa477772a6eee059ebfd627473d2f1ac308e1207b804db7c64718be30818b2
Opcode Fuzzy Hash: 50a0865b1a0c244fd3b1adff1fd447a1e9ace1cd61cca23db23a3808608efe85
Instruction Fuzzy Hash: 88412AB4A003458FCB14CF95C448AABBBF5FF88324F25C459D519AB361D774A841CFA0

Function 011D4A2C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011D5F21

Memory Dump Source

Source File: 0000001E.00000002.1373276047.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_11d0000_wlBldyvi.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b38e6962a3506f8a2a263deedc0b8ca0cf161c1b7eb94f365119857a1c9a0f6b
Instruction ID: 0271720bc85282d485c65c7349d6b9db8811fe51798b2e8681f6c2eec8ffa027
Opcode Fuzzy Hash: b38e6962a3506f8a2a263deedc0b8ca0cf161c1b7eb94f365119857a1c9a0f6b
Instruction Fuzzy Hash: 0E41D2B1C00719CBEB28DFA9C84478EBBB6BF48304F20816AD508AB251DB756946CF91

Function 011D5E6D Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011D5F21

Memory Dump Source

Source File: 0000001E.00000002.1373276047.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_11d0000_wlBldyvi.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 82c205a68a1c4b800ad017e30d3dcdbb8f50fdbf56617b14c48f31920d88c9bf
Instruction ID: 0f3785d7578f57621649ff0210cf38b4d00a2ba712c1d784cfa27d7515643e3d
Opcode Fuzzy Hash: 82c205a68a1c4b800ad017e30d3dcdbb8f50fdbf56617b14c48f31920d88c9bf
Instruction Fuzzy Hash: 7541E2B1C00719CFEB28DFA9C844BDEBBB6BF48304F20816AD508AB255DB755946CF51

Function 07563769 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07563800

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9378bc1a97d3382b9a839c0b327bf6daa9057a769230a96f482262fb42b5748e
Instruction ID: 1393874cd53c8619b66a49999b462f3a0e20dad2f8e3fd9f819d03bbec8ab526
Opcode Fuzzy Hash: 9378bc1a97d3382b9a839c0b327bf6daa9057a769230a96f482262fb42b5748e
Instruction Fuzzy Hash: CF217AB5D003499FDB10CFA9C885BDEBBF1FF48310F50842AE959A3240C7789945CBA0

Function 07563770 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07563800

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8a95dcc88855b1385a14fafca266be8ff9302bc1cd0774e3493aab0eabb86e32
Instruction ID: 0f3103ff8cfe721e5f0081e628124f2cf079a4751830916d7554544e414ede4e
Opcode Fuzzy Hash: 8a95dcc88855b1385a14fafca266be8ff9302bc1cd0774e3493aab0eabb86e32
Instruction Fuzzy Hash: 752166B5D003199FDB10CFAAC885BDEBBF5FF48310F50842AE919A7240C7789940CBA4

Function 075635D0 Relevance: 1.6, APIs: 1, Instructions: 69
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07563656

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e6e275d19e10e773a6743c0200811bfccb6e41e31b4aa777c391b7fad8eabf8d
Instruction ID: 31fd32b4b00f1e00dfc0f06fc34ba88a21ca6e95d55114a271d8d73e0115933b
Opcode Fuzzy Hash: e6e275d19e10e773a6743c0200811bfccb6e41e31b4aa777c391b7fad8eabf8d
Instruction Fuzzy Hash: 602157B1D003499FDB20DFAAC485BEEBBF4EB48220F54842AD419A7740CB789945CFA5

Function 07563858 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 075638E0

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 01a784e0e6bef9e8c31be62eb9f997a060c62328383195a1044ef4918eb27148
Instruction ID: 9f1a7777f3d09977cf46952ee99eb1727a25974af9172f4a8b65897d6580f44f
Opcode Fuzzy Hash: 01a784e0e6bef9e8c31be62eb9f997a060c62328383195a1044ef4918eb27148
Instruction Fuzzy Hash: 92214AB5C003599FDB10DFAAC841BEEBBF1FF48310F50842AE959A7240D7399905CBA5

Function 075635D8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07563656

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: bf579864139688e79a6605b408ab33843919937ca12237e0c0685f2f712902cf
Instruction ID: 1c141cd813c6adf2ada90d9ba734f0626a338a9791da889bd30b95b24387023b
Opcode Fuzzy Hash: bf579864139688e79a6605b408ab33843919937ca12237e0c0685f2f712902cf
Instruction Fuzzy Hash: 6E2134B1D003499FDB20DFAAC485BEEBBF4AB48220F54842AD519A7240DB789945CFA4

Function 07563860 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 075638E0

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: bbb8d61d7f4cc9ddce5d11d2309886bcb2b062c35ced484430e36237219b2377
Instruction ID: ddd0a04b0c41b3c55a7fe8d9d0a78a10d8ba9c771fc772cf935e133b06b158ae
Opcode Fuzzy Hash: bbb8d61d7f4cc9ddce5d11d2309886bcb2b062c35ced484430e36237219b2377
Instruction Fuzzy Hash: 522128B1C003599FDB10DFAAC845BDEBBF5FF48310F50842AE919A7240D7399901CBA4

Function 011DD6A8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011DD72F

Memory Dump Source

Source File: 0000001E.00000002.1373276047.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_11d0000_wlBldyvi.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ff53eb47481cfb3c0c0f966622eb137f96d948ca23f10f61aae8975e77872d3b
Instruction ID: 2dafc0fc38557c4c0d4d18c265ed5a0f5d65baf538fe3d5ec5fd7ed635f57c0c
Opcode Fuzzy Hash: ff53eb47481cfb3c0c0f966622eb137f96d948ca23f10f61aae8975e77872d3b
Instruction Fuzzy Hash: F321E4B5D002489FDB10CF9AD984ADEBBF4EB48310F14801AE914A3350D375A940CF64

Function 075636A8 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0756371E

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 83927b798f1a04abb0e8fb2c0fc21c8601c16dceca7e4dabf14fca4026645870
Instruction ID: 7a6f8695e4499980003df707f5c433d28b0efe384d1310fd0640f8e36310898c
Opcode Fuzzy Hash: 83927b798f1a04abb0e8fb2c0fc21c8601c16dceca7e4dabf14fca4026645870
Instruction Fuzzy Hash: 771106B5D002499FDB24DFAAC845BDEBBF5EB48320F148419E519A7250C7759940CBA4

Function 075636B0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0756371E

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b9e21c4fa1c5aae425472034d88ff80a2907117a71816cdc5497dc1c80e5f13d
Instruction ID: d7c17e932977aaf3606bafc6a1619e5f2464e4a0306f57c71e22fe35b2286824
Opcode Fuzzy Hash: b9e21c4fa1c5aae425472034d88ff80a2907117a71816cdc5497dc1c80e5f13d
Instruction Fuzzy Hash: E21126B5D003499FDB20DFAAC845BDEBBF5EB48320F148419E515A7250CB769940CFA4

Function 07563520 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0756358A

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 04d730729393f7cf604da8f73525fe0b3101d8f94eddbb3ba7866f57f613ab0d
Instruction ID: 15e206438e638c55bdaf8e25ad7fa22abe3ee9eba43c8ce3bc7f6fc552609a4c
Opcode Fuzzy Hash: 04d730729393f7cf604da8f73525fe0b3101d8f94eddbb3ba7866f57f613ab0d
Instruction Fuzzy Hash: 681146B1D003598FDB20DFAAC445BEEFBF4AB48224F54841AD519A7240CB79A945CF94

Function 07563528 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0756358A

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 70af15728acc232de4f4fd557ace3ead51be1d211bb882ecf520844aa64bbcf1
Instruction ID: 064e4ffae3c1c2444284b294ecf2ba45aaec540f61dea4c2a5d2eda5cf195b8f
Opcode Fuzzy Hash: 70af15728acc232de4f4fd557ace3ead51be1d211bb882ecf520844aa64bbcf1
Instruction Fuzzy Hash: 1F1136B1D003598FDB20DFAAC4457DEFBF5EB88320F64841AD519A7240DB79A941CFA4

Function 011DB3C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 011DB426

Memory Dump Source

Source File: 0000001E.00000002.1373276047.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_11d0000_wlBldyvi.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a6ac7c5ccf292f512b11a2982cf34ef3dcbb62a658a29123ce66827313c13e5b
Instruction ID: 245806d861c0cd3581e178af9850019b37ddbd273bc086ca11939c53ae1feb73
Opcode Fuzzy Hash: a6ac7c5ccf292f512b11a2982cf34ef3dcbb62a658a29123ce66827313c13e5b
Instruction Fuzzy Hash: 1D110FB5C003498FDB24DF9AC544A9EFBF4AB89220F15842AD52AB7200D379A545CFA5

Function 075624B0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0756673D

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0913532091b907f8718b2b43a41123b7a5c60dfffd9e1699e6addcf67b8318f3
Instruction ID: fd8c45a7c9ae5456a4bb303c70989c1d1e1dfec58201ceeeaae4f8e8be596dc8
Opcode Fuzzy Hash: 0913532091b907f8718b2b43a41123b7a5c60dfffd9e1699e6addcf67b8318f3
Instruction Fuzzy Hash: 441103B5800349DFDB20DF9AD889BDEBBF8FB48320F10841AE519A7200D375A944CFA5

Function 075666D9 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0756673D

Memory Dump Source

Source File: 0000001E.00000002.1401771861.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7560000_wlBldyvi.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7a5c33a4e1e63654a7c75abbf646e3be5d3531cf2f60772550572b8253763be1
Instruction ID: f4916014e18294511756638f327964063dd843b59ec7ae6f4872e0116dd069af
Opcode Fuzzy Hash: 7a5c33a4e1e63654a7c75abbf646e3be5d3531cf2f60772550572b8253763be1
Instruction Fuzzy Hash: 3C1103B5C00259DFDB20DF9AD885BDEBBF4FB48320F24841AE518A3250D379A944CFA1

Function 0117D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1366176870.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_117d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79314b2e95e7e4dd2bf5bf59313838b37f7f5c45afe9d3e7cf2904e7f186f9ba
Instruction ID: 40c538663e1156160a5944fb6a2546fcff1acceadec8c42ffc3b30842eb03789
Opcode Fuzzy Hash: 79314b2e95e7e4dd2bf5bf59313838b37f7f5c45afe9d3e7cf2904e7f186f9ba
Instruction Fuzzy Hash: B021C1716042089FDF19DF94E980B15BB75FF84324F24C5ADE9494B352C336D447CA62

Function 0117D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1366176870.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_117d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ef2fdd7280aad932fbc4f73702ea77e485cb0b667b9babee6a1bee56bdb490
Instruction ID: 38fc36be03eee5eb5a03bf9da34f7d140ae5ef70ec93dfc397cfb3f947eef1cd
Opcode Fuzzy Hash: e8ef2fdd7280aad932fbc4f73702ea77e485cb0b667b9babee6a1bee56bdb490
Instruction Fuzzy Hash: 3721CF756042089FDF1ADF54E984B16BB75EB88314F24C5ADD84A4B386C336D847CA62

Function 0117D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1366176870.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_117d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e6b329490fdd23ab6a973cf2686f35c120659b6bb79425574d3bd85bd584b1
Instruction ID: b14ba0dedb7034315d0b3fc47a1f318cc67d5dbef1104aa88526bd7196339989
Opcode Fuzzy Hash: 65e6b329490fdd23ab6a973cf2686f35c120659b6bb79425574d3bd85bd584b1
Instruction Fuzzy Hash: 8F21AE755093848FCB17CF64D990B15BF71EF46214F28C5EAD8498F2A7C33A980ACB62

Function 0117D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1366176870.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_117d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: a7d27333c7a3220381dbcc63390631ff9f3f6dce552efd2bcb9a04fc98e7e5a3
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: B611A975504284DFCB0ACF54D5C0B15BBB2FB84224F28C6A9D8494B396C33AD40ACB62

Analysis Process: IxumRsOtTdrVAu.exePID: 6688, Parent PID: 7296COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	259
Total number of Limit Nodes:	13

Executed Functions

Function 077439ED Relevance: 1.8, APIs: 1, Instructions: 256
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07743C2E

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f7291a66d606d3806936ec0283169c665f9fad12007688615309e8f95cb5e45b
Instruction ID: 00b36d20ee0ebb31660b861ff8f1d382e0dc0100d62b60898a4ce4aff9fd0545
Opcode Fuzzy Hash: f7291a66d606d3806936ec0283169c665f9fad12007688615309e8f95cb5e45b
Instruction Fuzzy Hash: 56A15AB1D0031ACFEB24CF69C841BEDBBB2BB48354F148569E809B7280DB759985CF91

Function 077439F8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07743C2E

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 03bf8f51d21a0afb8e5f8b3596338cf3faa6bd6fff31557a98cb45aae3ef7abd
Instruction ID: 7a0884315a6d1fa728d4231fc4bbfaffaf810675c9a46568a24be95af910d47a
Opcode Fuzzy Hash: 03bf8f51d21a0afb8e5f8b3596338cf3faa6bd6fff31557a98cb45aae3ef7abd
Instruction Fuzzy Hash: A39158B1D0031ACFEB24CF69C841BEDBBB2BB48354F148569E809B7280DB759985CF91

Function 054EB1D0 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 054EB426

Memory Dump Source

Source File: 0000001F.00000002.1396551823.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_54e0000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 91163ad1a1110120554f1dbcc93068fc89e953787d65a2eb031f04d93b02ed50
Instruction ID: bbb4ad702dca4ddf73911994771bebdc4f5e423f52239a0af79cd10b548566c0
Opcode Fuzzy Hash: 91163ad1a1110120554f1dbcc93068fc89e953787d65a2eb031f04d93b02ed50
Instruction Fuzzy Hash: 8F712570A00B058FD724DF6AD4457AABBF2FF88201F10896ED44ADBB50DB74E849CB91

Function 05611284 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05614381

Memory Dump Source

Source File: 0000001F.00000002.1400738759.0000000005610000.00000040.00000800.00020000.00000000.sdmp, Offset: 05610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_5610000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 47bf9d330be23ab0f15f14f8803674cbe2d871af1d5777e5af38d68a600882a4
Instruction ID: 6530f7681b1c00ab66f04a75f7936bcc6aad4682e2981e83a06c9dd31402feee
Opcode Fuzzy Hash: 47bf9d330be23ab0f15f14f8803674cbe2d871af1d5777e5af38d68a600882a4
Instruction Fuzzy Hash: CB415BB4900305CFCB14CF96C448BAABBF6FF88315F298459D419AB321CB34A841CFA4

Function 054E5E64 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 054E5F21

Memory Dump Source

Source File: 0000001F.00000002.1396551823.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_54e0000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f5c9bb02f5720869ae2960b51e76393ca9bd694de5754a826a5a7a4918928a7d
Instruction ID: 5f27d404ee699a2790a703a47fbd1c9b42fcb57196db7d59949ed74e9a40dbc4
Opcode Fuzzy Hash: f5c9bb02f5720869ae2960b51e76393ca9bd694de5754a826a5a7a4918928a7d
Instruction Fuzzy Hash: 3E41BFB1C00719CFDB24DFA9C8447DEBBB6BF49304F20816AD418AB255DB75594ACF50

Function 054E4A2C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 054E5F21

Memory Dump Source

Source File: 0000001F.00000002.1396551823.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_54e0000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4b18d473c8bb75625b65f443864ed50af988b81838942c831008d056232e028f
Instruction ID: 3f7754273c4bfdb61591ce9f87de147554e2f88505758b07ebb7081f0788181d
Opcode Fuzzy Hash: 4b18d473c8bb75625b65f443864ed50af988b81838942c831008d056232e028f
Instruction Fuzzy Hash: 6B41DFB1C00719CBDB24DFA9C844BDEBBF6BF49308F20806AD408AB255DB756946CF90

Function 07743769 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07743800

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 719fff465f2669e3e4e63f2c4731372ef24b680b8cdfaa2578142826f50e160e
Instruction ID: 4923f012f17da19300d55a47953d6b647f5d2b61a7bcd35f1e6cc79c9b31938c
Opcode Fuzzy Hash: 719fff465f2669e3e4e63f2c4731372ef24b680b8cdfaa2578142826f50e160e
Instruction Fuzzy Hash: 702168B5C003099FDB10CFA9C881BDEBBF5FF48310F108829E958A7240C7789941CBA0

Function 077435D0 Relevance: 1.6, APIs: 1, Instructions: 70
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07743656

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ad48d7cffb1320b80d0fce00b763cbaeafc2092100bd545739bc4506fa9bf704
Instruction ID: b4bd4ec43158032bbcd82885c40e0d9a59c13312baae9c04fccc9ba6f75cbe80
Opcode Fuzzy Hash: ad48d7cffb1320b80d0fce00b763cbaeafc2092100bd545739bc4506fa9bf704
Instruction Fuzzy Hash: 452159B1D003099FDB10DFAAC485BEEBBF4EF48224F50842AD419A7380CB789945CFA5

Function 07743770 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07743800

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0d2979d798af0dacc7108a63918e7ebfb22a1bf6f66fde1daf60a5ff098d647e
Instruction ID: 79179326cdcaa1382cffb767882709c04ed28b522c0687fee48e30520d40e24c
Opcode Fuzzy Hash: 0d2979d798af0dacc7108a63918e7ebfb22a1bf6f66fde1daf60a5ff098d647e
Instruction Fuzzy Hash: F62125B5D003199FDB10DFAAC885BDEBBF5FF48310F50882AE959A7240C7789944CBA4

Function 07743858 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 077438E0

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c344dfe16df5dea761d76ffcb427b2c346e0eae43ac5d5642e00d57bd10b5199
Instruction ID: 43700f78cf83edbab2ccf6c0fe694b4f9f37f43b72ab9cc1d23637e4039d2724
Opcode Fuzzy Hash: c344dfe16df5dea761d76ffcb427b2c346e0eae43ac5d5642e00d57bd10b5199
Instruction Fuzzy Hash: B42115B5C003499FDB10DFAAC881AEEBBF5FF48220F508529E559A7240C7799901CBA0

Function 054ED6A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,054ED66E,?,?,?,?,?), ref: 054ED72F

Memory Dump Source

Source File: 0000001F.00000002.1396551823.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_54e0000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1cd8fc8c53f040b99fbc1537e8af3faa07b1b84b527218a9d46b4c4b2657a850
Instruction ID: ecbafccef37bceba5258f9fc88ae6f3986ba66230a99050b7a8391f7b38a3669
Opcode Fuzzy Hash: 1cd8fc8c53f040b99fbc1537e8af3faa07b1b84b527218a9d46b4c4b2657a850
Instruction Fuzzy Hash: 6321E3B5D00309AFDB10CF9AD885ADEBBF5FB48320F14841AE918A3350D379A945CFA1

Function 054ED238 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,054ED66E,?,?,?,?,?), ref: 054ED72F

Memory Dump Source

Source File: 0000001F.00000002.1396551823.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_54e0000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: acca2de0e54dcff0298a8454789879730467e9e96dd54287d3466d2f14962603
Instruction ID: 9672309a46bef638c02bdc73659d072386ba13cacdc60467f303f22c8df7d558
Opcode Fuzzy Hash: acca2de0e54dcff0298a8454789879730467e9e96dd54287d3466d2f14962603
Instruction Fuzzy Hash: F921E6B5D003089FDB10CFAAD484ADEBBF5FB48310F14841AE954A7350D374A955CFA4

Function 077435D8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07743656

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fb905b9f7963ac04f542545cdfe6a4c626bdc79dac4b66bcc994f28b46addb16
Instruction ID: f46864d4e95654893643c9c4f34af474bc30ab5890b7597d5d9fa4663c3e1688
Opcode Fuzzy Hash: fb905b9f7963ac04f542545cdfe6a4c626bdc79dac4b66bcc994f28b46addb16
Instruction Fuzzy Hash: 6C2138B1D003099FDB10DFAAC485BAEBBF4EF48314F54842AD419A7340CB789945CFA5

Function 07743860 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 077438E0

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8428a1bf0f1f1c59cc06d8e40b6607951629db8c880f74dc5deb1ac152d3ffff
Instruction ID: 1004dfaa7e6838dc9c77445946039e0dc2f5d3491e60329255a07903e7795104
Opcode Fuzzy Hash: 8428a1bf0f1f1c59cc06d8e40b6607951629db8c880f74dc5deb1ac152d3ffff
Instruction Fuzzy Hash: 792105B1C003599FDB10DFAAC841BDEBBF5FF48310F508429E919A7240C7799901CBA4

Function 077436A8 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0774371E

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 140289b2539e5e2bd2eb643bd6fdc643197fbc6b60fd3b38848fb3d25fa347a5
Instruction ID: 3f6ac27d9c0a4f64c291d184ac92b96ad0b0fbdd5369dab523d4932ba29a6883
Opcode Fuzzy Hash: 140289b2539e5e2bd2eb643bd6fdc643197fbc6b60fd3b38848fb3d25fa347a5
Instruction Fuzzy Hash: EC1136B5C003499FDB20DFAAC844BAEBBF5EB88320F148819E559A7250C7759900CFA0

Function 07743520 Relevance: 1.6, APIs: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0774358A

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0af8c581e6664e8a8483aebb08939000125d686743fdb035e4713ff5580afbaa
Instruction ID: b0cad304661a94f9079af32d36f7f09faf83d656cf5b970c67cf3ce6c86cae0b
Opcode Fuzzy Hash: 0af8c581e6664e8a8483aebb08939000125d686743fdb035e4713ff5580afbaa
Instruction Fuzzy Hash: 751179B5D003498FDB20DFAAC4457DEFFF4EB88224F148419D419A7640CB79A944CFA4

Function 077436B0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0774371E

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 130541054f6fb263d3fc527b3cc41c12eb398668e2cc6410fbb6680d45540499
Instruction ID: 60c1aebf09824cf5aa10e92612834dedc17ae61749be1d562ca1cd32aecb5300
Opcode Fuzzy Hash: 130541054f6fb263d3fc527b3cc41c12eb398668e2cc6410fbb6680d45540499
Instruction Fuzzy Hash: 431126B5C003499FDB20DFAAC845BDEBBF5EB88320F148819E559A7250CB759940CFA0

Function 07743528 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0774358A

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: bdce13125bc056e4647085fa35e14fbb6778fbcdbc37b4548656a61309b95c32
Instruction ID: dc71b0d4f722eba0d6ccc625f4ffd75d7ba796b4dbba15617d9e2a7399870fb9
Opcode Fuzzy Hash: bdce13125bc056e4647085fa35e14fbb6778fbcdbc37b4548656a61309b95c32
Instruction Fuzzy Hash: 661136B1D003498FDB24DFAAC44579EFBF5EB88324F248829D519A7240CB79A945CFA4

Function 07746440 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07746C45

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 505f8742f707900b30e5452bb58abd5e48bf75be50e9dad2c6a870ef33bc31c0
Instruction ID: 559bff89c5a8e75abf226850320816f404dc6bdb5538f822cefd6898034a1fd8
Opcode Fuzzy Hash: 505f8742f707900b30e5452bb58abd5e48bf75be50e9dad2c6a870ef33bc31c0
Instruction Fuzzy Hash: C81103B5800349DFDB20DF9AC885BDEBBF8FB49324F10881AE519A7240D375A944CFA1

Function 07746BE0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07746C45

Memory Dump Source

Source File: 0000001F.00000002.1403234025.0000000007740000.00000040.00000800.00020000.00000000.sdmp, Offset: 07740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7740000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8cf2a49dbf6fce79847350f6dd97bca2c551e502269118bcd9bf99544d9b30e9
Instruction ID: 791fad2a6080fe26c01a84a3980476138cef51d37fce01d4136e8805b47c738a
Opcode Fuzzy Hash: 8cf2a49dbf6fce79847350f6dd97bca2c551e502269118bcd9bf99544d9b30e9
Instruction Fuzzy Hash: E81103B5800359DFDB20CF99D885BEEBFF8EB48324F10891AE518A3250C375A944CFA0

Function 054EB3C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 054EB426

Memory Dump Source

Source File: 0000001F.00000002.1396551823.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_54e0000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d024cbc031677815acfd01a29d4afee37c9565cee7239c07941cac88a0c009dd
Instruction ID: c8b2712a036f0ddbaaf1e4b8c0b32ed5c2f77c6588f8b8cf0f95777bec5efc8b
Opcode Fuzzy Hash: d024cbc031677815acfd01a29d4afee37c9565cee7239c07941cac88a0c009dd
Instruction Fuzzy Hash: B1110FB5C003498FCB20DF9AC444BDEFBF4EB88220F10842AD429A7200C379A545CFA1

Function 0155D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1376437513.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_155d000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432455068f7355d0b2fd3a1e45c8d5cc3af4cb7d6978f602c40e0dddf14b052c
Instruction ID: cf921719ef9fcbec5b0f71a862567fe7554f6f7d3e1849f11ae9609e8e5bd25e
Opcode Fuzzy Hash: 432455068f7355d0b2fd3a1e45c8d5cc3af4cb7d6978f602c40e0dddf14b052c
Instruction Fuzzy Hash: 4B213672504200DFDB45DF44D9C0B5ABFB5FB84324F20C56ADC090F246C376E446CAA2

Function 0155D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1376437513.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_155d000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 440d6fe10b261e7399463bfd99b236e88bfe5e70c14f46d830d2f39d90b31946
Instruction ID: 7b6b5b602a69c1488202408371562082a8f5e35666c22097c5debfb8c34243cf
Opcode Fuzzy Hash: 440d6fe10b261e7399463bfd99b236e88bfe5e70c14f46d830d2f39d90b31946
Instruction Fuzzy Hash: 66210372504240DFDB55DF54D9D0B2ABFB5FB88328F20C56AEC090F256C336D456CAA2

Function 0156D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1376770649.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_156d000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c15f99ba6f3ff5c618df993b3880f73a176b1430231da95ec545f05279c65ebd
Instruction ID: 58a2ec7fb71ff5173dcf162dda8bcd8174997537a4f2bcb2c464395aee56edcf
Opcode Fuzzy Hash: c15f99ba6f3ff5c618df993b3880f73a176b1430231da95ec545f05279c65ebd
Instruction Fuzzy Hash: 4621F571A04200DFDB15DF94D9C0B25BBB9FB84324F24C96DD8894F252C736D446CAA1

Function 0156D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1376770649.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_156d000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017abbad4fd00a7fb247c2a13fa79fef0db210883df8d312c5b0ac3458d026b5
Instruction ID: cc719331ba170b819a7b9bdb9203b454590fd162c47bbd7e4e5c30ce97421d82
Opcode Fuzzy Hash: 017abbad4fd00a7fb247c2a13fa79fef0db210883df8d312c5b0ac3458d026b5
Instruction Fuzzy Hash: 02210375604200DFDB15DF54D984B26BBB9FB84324F20C96DD8890F246D337D447CAA1

Function 0156D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1376770649.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_156d000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f9e35eb77afba2be0ca1d14901fc0b7674c2cc9eecfa535d176d0fa7618bd1
Instruction ID: 1d8622eb0df5ab683b0d87f9a558120f4b86fdb5f10b87addad20c042ea636a2
Opcode Fuzzy Hash: 34f9e35eb77afba2be0ca1d14901fc0b7674c2cc9eecfa535d176d0fa7618bd1
Instruction Fuzzy Hash: F12183755093808FC702CF24D590715BF71FB46224F28C5DAD8898F2A7C33A980ACBA2

Function 0155D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1376437513.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_155d000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: b203f6fcc42f98a687d441c540ca318b9a2f47ec35e0255fd810aea322f8b325
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: FD11CD76504240CFDB06CF44D5C0B5ABF72FB84324F24C2AADC490A656C33AE456CBA1

Function 0155D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1376437513.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_155d000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 7b088d04802b6da968d977bf752a18532878d5b80c49448290a1a85a08a8c9f1
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 05119D76504280CFCB16CF54D5C4B1ABF72FB84328F2486AADC490B656C33AD45ACBA1

Function 0156D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1376770649.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_156d000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: bd42b4dd9bbfd94363e417e63607a404ffff5cfa4821709f4e8db69bb96a2049
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 6311BE75604240DFCB16CF54C5C0B19BB71FB84324F28CAADD8894F296C33AD44ACB91

Analysis Process: wlBldyvi.exePID: 2708, Parent PID: 2620COMMON

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	4

Executed Functions

Function 06D92358 Relevance: 9.0, Strings: 6, Instructions: 1489COMMON

Download Yara Rule

Strings

$q, xrefs: 06D93716
$q, xrefs: 06D93763
$q, xrefs: 06D9373F
$q, xrefs: 06D9376F
$q, xrefs: 06D9374B
$q, xrefs: 06D93722

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 67537d1875ee9803fa77d64c56df61e83d03d02e21c5ba1287a207dbbe03186a
Instruction ID: 5a2276b50936835c65c098a621117f212f556c3b11294d8a3181e11c4a859551
Opcode Fuzzy Hash: 67537d1875ee9803fa77d64c56df61e83d03d02e21c5ba1287a207dbbe03186a
Instruction Fuzzy Hash: 59D26830E10308DFDB64DF69C584A9DB7B2FF89314F5485A9D409AB264EB34ED85CB90

Function 06D97D68 Relevance: 3.0, Strings: 2, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06D98303
$q, xrefs: 06D9830F

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 7bfee7772cd8355a4594f142c3032f45c48286964cd28908a4cef2c71d85261b
Instruction ID: c2811e0dca5863ed781f765d0887db3f46c0d13a9631ba0f4f414621ce8b4b27
Opcode Fuzzy Hash: 7bfee7772cd8355a4594f142c3032f45c48286964cd28908a4cef2c71d85261b
Instruction Fuzzy Hash: EA028D30B002158FDF64DB69D490BAEBBA2FF85310F148969D905DB384DB75EC82CBA0

Function 06D965E0 Relevance: .8, Instructions: 809COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bef5e6b4f28361ebbe872715b3951f4cd0d759df3e2a01b51e4a91d4887d198
Instruction ID: c24996636f991e782f802b1bd514ec8ec88de90a5c093f29fd0c85ef8f9274ad
Opcode Fuzzy Hash: 0bef5e6b4f28361ebbe872715b3951f4cd0d759df3e2a01b51e4a91d4887d198
Instruction Fuzzy Hash: 7A628B34B002149FEF54DB69D590BADBBB2FB88314F148569E50ADB394DB35EC42CBA0

Function 06D95588 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe249c638518ae1966f445faf6658f7abc9a82c0b8324c892cc47a48139f159
Instruction ID: e0f8dcc13d79bd5a52ba61b749c46f59122a32d24d11aad2ec4ff31788ef98ad
Opcode Fuzzy Hash: 6fe249c638518ae1966f445faf6658f7abc9a82c0b8324c892cc47a48139f159
Instruction Fuzzy Hash: 3922B035F002188FDF65DBA8D4807AEBBB2EF89310F248579D856AB345DA35DD41CBA0

Function 06D9B20F Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2fddbdf065d977b16b4938d06da2414933a0afaacc07ecb182c051861a82b6
Instruction ID: 8bb79fbd39a9b113d75d05d6ef6403365b1c157d41d0687abc4436dc2fdaa78d
Opcode Fuzzy Hash: 4a2fddbdf065d977b16b4938d06da2414933a0afaacc07ecb182c051861a82b6
Instruction Fuzzy Hash: A1224274F102099FEF64DB69E4847AEB7B2FB89310F258526E405DB351DA34EC81CBA1

Function 06D9ACB8 Relevance: 10.4, Strings: 8, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06D9AE2C
$q, xrefs: 06D9AE84
$q, xrefs: 06D9ADD9
$q, xrefs: 06D9AE38
$q, xrefs: 06D9AE5B
$q, xrefs: 06D9ADE5
$q, xrefs: 06D9AE90
$q, xrefs: 06D9AE67

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: 6b8fefd52f819406a5a3670b1c921890e3a0305732a7e922dd90a958fb3656f1
Instruction ID: 3ea11f6597ef5a7dd0006439e15ec640646a7068db2f51242c9159e79e3a16a9
Opcode Fuzzy Hash: 6b8fefd52f819406a5a3670b1c921890e3a0305732a7e922dd90a958fb3656f1
Instruction Fuzzy Hash: 4EE15C35F003198FDF64DF69D8406AEB7B2FB85204F258529D805AB344EB35EC46CBA1

Function 06D9B630 Relevance: 8.0, Strings: 6, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06D9BB63
$q, xrefs: 06D9BBA3
$q, xrefs: 06D9BB97
$q, xrefs: 06D9BBCB
$q, xrefs: 06D9BBD7
$q, xrefs: 06D9BB6F

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 03d024f2dbb8a8528a09ec6b388e335789025e465ac10fc866baa2cc04599513
Instruction ID: ae638dcb1d1b57209bc76215bcc565fc79fc94956315c7ddb2344d74607a2fde
Opcode Fuzzy Hash: 03d024f2dbb8a8528a09ec6b388e335789025e465ac10fc866baa2cc04599513
Instruction Fuzzy Hash: D5026C30E102098FDFA4DB68E4807AEB7B1FB85314F26856BE445DB255DB74EC41CBA1

Function 06D99138 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06D9918B
$q, xrefs: 06D991C6
$q, xrefs: 06D991BA
$q, xrefs: 06D9917F

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 25b39fdfead9af694670fdfd4525c5ef6cb977334a9a107814afb561b5755948
Instruction ID: dd6cd20c04fceaa55cebbe0b8f84326932ac15a16a0907cea218b8b48506ec2c
Opcode Fuzzy Hash: 25b39fdfead9af694670fdfd4525c5ef6cb977334a9a107814afb561b5755948
Instruction Fuzzy Hash: 3D913030F002199FDB64DF69D8607AE7BB6FF89300F148569D819AB344EE74ED428B91

Function 06D9CF28 Relevance: 4.5, Strings: 3, Instructions: 798
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06D9D333
$q, xrefs: 06D9D327
$q, xrefs: 06D9D31F

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: 4458df8676753a4a5e8dee57c58606b4978f46d837fbd478a55bbc7caeb56228
Instruction ID: 9e47aede249da3385b2348ed9a4b918627bda7e2b241bf0b581aa9318a02a909
Opcode Fuzzy Hash: 4458df8676753a4a5e8dee57c58606b4978f46d837fbd478a55bbc7caeb56228
Instruction Fuzzy Hash: CB628C34A007158FDB64EF68D590A5EBBB2FF84704B208A68D0059F759DB39FC46CB91

Function 06D94B50 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Oq, xrefs: 06D94D07
XPq, xrefs: 06D94C7D
fq, xrefs: 06D9525D

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: fq$XPq$\Oq
API String ID: 0-132346853
Opcode ID: 7b4ced7ea3a6636ef61f34fdd11bfa3cf698e06979f0ef76c84d3081f03c6370
Instruction ID: c0a2cee02c81cd8139c7851f2517aadd4acef624618fd7f7d210ee5904e1442f
Opcode Fuzzy Hash: 7b4ced7ea3a6636ef61f34fdd11bfa3cf698e06979f0ef76c84d3081f03c6370
Instruction Fuzzy Hash: 18616134F002199FEF549FA9C8157AEBAF6FF88304F248429D506AB395DE758C458BA0

Function 06D99127 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06D991BA
$q, xrefs: 06D9917F

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: e729acb284e2d2036bbf0e16e925e22f31557f4c56cf44f0b84e8d846d3eb0fa
Instruction ID: bf8892a4bf3df54935cf1b614e368bd2922353feb4d79a07934a9ee3f9c58461
Opcode Fuzzy Hash: e729acb284e2d2036bbf0e16e925e22f31557f4c56cf44f0b84e8d846d3eb0fa
Instruction Fuzzy Hash: EA510F30B102149FDB54DB79D861BAE7BF6FF88300F148569D819EB384EA74ED428B91

Function 015CEB48 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2488553863.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_15c0000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 173bf97836fc8cb0a339a3e9fe25e993ab12de62b244963257398836c7008670
Instruction ID: 3eea8818b3541d5c761fdbf529707bf5fdf2d0721a476873fc3bdfbd03519ed2
Opcode Fuzzy Hash: 173bf97836fc8cb0a339a3e9fe25e993ab12de62b244963257398836c7008670
Instruction Fuzzy Hash: A6412272D003598FDB14DFAAD8406AEBBF5EF89210F15866AD408E7340EB389845CBE0

Function 015CEC18 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 015CEC87

Memory Dump Source

Source File: 00000025.00000002.2488553863.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_15c0000_wlBldyvi.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 5be0d95ce22abfa5f4a64f5d823ce73845f256f95f71e2013c63f1561e403a2e
Instruction ID: c266b7e07a5e336e6899adc198716a6b528594efcc49a6f74969de9bce65c9e2
Opcode Fuzzy Hash: 5be0d95ce22abfa5f4a64f5d823ce73845f256f95f71e2013c63f1561e403a2e
Instruction Fuzzy Hash: 651103B1C0026A9FDB10DFAAD545BDEFBF4BB48320F15816AD818A7240D378A945CFA1

Function 06D94B40 Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPq, xrefs: 06D94C7D

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: XPq
API String ID: 0-1601936878
Opcode ID: 09268c5f2dd19729ac830ae67aff7d9526a4ad579db6996a3fb3d6d05f4406f3
Instruction ID: a8327af631d26f3465f19846dd985b84a18e64fdf10db7a670c82a2bf9f5e6d5
Opcode Fuzzy Hash: 09268c5f2dd19729ac830ae67aff7d9526a4ad579db6996a3fb3d6d05f4406f3
Instruction Fuzzy Hash: D9416F74F002189FDB559FA9C8557AEBBF6FF88300F24852AD106AB395DA758C05CB90

Function 06D9DAB0 Relevance: 1.4, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 06D9DBF9

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 537401ffe55c8835c2afcd26582cb74e22292ec401d7de517a679b9e12f7c8ce
Instruction ID: 1cd9a6ca3fa7e96776e9121f2ebcdf7580c011fc088ff3376a3aca4beeb73269
Opcode Fuzzy Hash: 537401ffe55c8835c2afcd26582cb74e22292ec401d7de517a679b9e12f7c8ce
Instruction Fuzzy Hash: 97414D34E00B099FDF64DF65C49469EBBB2FF85304F204529E816EB244EB74E946CBA1

Function 06D9DA9D Relevance: 1.4, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 06D9DBF9

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: e8cc88d14ffa10021ac3ba22e8943f9bc9e4cf758e9e32f35d7cf11f6f79a28b
Instruction ID: 3d81def2b9ed160b7cbe82e61f761c1bad6b92900eadafee4ff37296183f9c74
Opcode Fuzzy Hash: e8cc88d14ffa10021ac3ba22e8943f9bc9e4cf758e9e32f35d7cf11f6f79a28b
Instruction Fuzzy Hash: AD416C34E006099FDF64DF65C48469EBBB3EF85304F144529E806EB240EB74E846CBA1

Function 06D921BD Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

PHq, xrefs: 06D9230B

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 92574ffdf887cefc641fb122f3b8b279e54bfa0799acb2e420c5f6f3d55082ef
Instruction ID: 86d9fedf19a3a0585cc62c106c11bd0d47f63b832e5495381e3a9f157dc9e47e
Opcode Fuzzy Hash: 92574ffdf887cefc641fb122f3b8b279e54bfa0799acb2e420c5f6f3d55082ef
Instruction Fuzzy Hash: 0E31F230B103069FDF699B78C4507AE7BA6AF8A310F244568D402DB385DF39ED42C7A4

Function 06D921D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHq, xrefs: 06D9230B

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 02e7a3c17072e144623add289fbce509f679da61aa91fe20d1bd9a42d5a75150
Instruction ID: 28d69ac4f31b81f9645e90463140e66cbbd480993263d9b1ab23a75a2f4320ed
Opcode Fuzzy Hash: 02e7a3c17072e144623add289fbce509f679da61aa91fe20d1bd9a42d5a75150
Instruction Fuzzy Hash: AE31DC30B20205AFDF68AB79C4547AE7BA6BF89300F244538D406DB385DE39ED02C7A5

Function 06D982DE Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$q, xrefs: 06D98303

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q
API String ID: 0-1301096350
Opcode ID: dc8ca48a6f06b130ad605401e3f4d08e45599db5a6f855c56419f280784ec3d2
Instruction ID: 7ae03c698a62a82eea6f4b5f4a3230dafa326f4521f7046ac7d56ebeeee2b7a3
Opcode Fuzzy Hash: dc8ca48a6f06b130ad605401e3f4d08e45599db5a6f855c56419f280784ec3d2
Instruction Fuzzy Hash: 49F0A032B14201CFDF644E66E8402A87374EB42A11F084866CE00D7140D275DA00E6B1

Function 06D9C170 Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503b458b055660cbe6139ff76bd55266438e02df77cf4e6b133e41552179a649
Instruction ID: c042df1436078f3d6a3c500da84c1b6e207cb857c5bd7dc0fa456d0ccf01dc46
Opcode Fuzzy Hash: 503b458b055660cbe6139ff76bd55266438e02df77cf4e6b133e41552179a649
Instruction Fuzzy Hash: A3325E34B102059FDF64DF69D890BAEBBB6EB89310F108529D405EB385DB35EC46CBA0

Function 06D961E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be4b2e3358ddaa175026fd85960a84047c340f52aff083183eea33b858a4212
Instruction ID: a9b08b919cad1204ab2b2bf4cad07c4b06b86efeec27ab44b67b63f2fa04a8b6
Opcode Fuzzy Hash: 7be4b2e3358ddaa175026fd85960a84047c340f52aff083183eea33b858a4212
Instruction Fuzzy Hash: D161A371F001214FEF649B7DC88069EBAD7AFC5214B194439D80AEB364DEB5ED4287D2

Function 06D94280 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e273a1d0955c34633bbff6104d1d3c4e99c62ba665ed4839406da3f99332ba
Instruction ID: a8508d291296a9101f8e71c031cd6bda8ca66b4f290e282ce40522be252e46ec
Opcode Fuzzy Hash: 56e273a1d0955c34633bbff6104d1d3c4e99c62ba665ed4839406da3f99332ba
Instruction Fuzzy Hash: 87812D34B102098FDF94DFB9D4547AEBBF2AF89304F108529D41AEB345EA74EC428B91

Function 06D945A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e6353c8f3a69bfb5d89cba8cd3c26ec28eb06d8768cbca4239d49099a834d3
Instruction ID: 1a81b7b1e14f53a4efb8908545a391c07dfc0e90902aa3bc75652f643bc092a1
Opcode Fuzzy Hash: 17e6353c8f3a69bfb5d89cba8cd3c26ec28eb06d8768cbca4239d49099a834d3
Instruction Fuzzy Hash: 5B913D34E102198FDF60DF68C890B9DB7B1FF89314F208699D549AB345DB70AA86CB91

Function 06D94290 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3beedc2e5321c4b0eca96758b02de3e62c8f16b031de0cb7752a79a8b6f7cc24
Instruction ID: 15b3d9749e8e3b2ae75a3a402f592242e27d2853dab3374d61b251366bf60c9c
Opcode Fuzzy Hash: 3beedc2e5321c4b0eca96758b02de3e62c8f16b031de0cb7752a79a8b6f7cc24
Instruction Fuzzy Hash: 83810B30B102098FDF94DFB9D4507AEBBF6AF89304F108529D41ADB355EA74EC428B91

Function 06D945B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5097af2192d24aed567671eb93a078a1734df8f26318cb7ddb0383df349760
Instruction ID: d888fdb375c97cc42793c0b0df9312a2475d6b5a4bac4a1707d0db8e9a34384f
Opcode Fuzzy Hash: 8c5097af2192d24aed567671eb93a078a1734df8f26318cb7ddb0383df349760
Instruction Fuzzy Hash: 82913C34E102198BDF64DF68C880B9DB7B1FF89314F208699D549BB345DB70AA86CF91

Function 06D9EEF0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9dcd5b2c05ce0f6ddf972955e27e4b2cebd5249c1ed9a566b736a2da6e14b3b
Instruction ID: d1a9a7d8b526fcc6fa5e260bdd42355aa49e189591297b7b28a77e891bb7ef1d
Opcode Fuzzy Hash: a9dcd5b2c05ce0f6ddf972955e27e4b2cebd5249c1ed9a566b736a2da6e14b3b
Instruction Fuzzy Hash: 5C713870A002199FDF54DFA9D980A9EBBF6FF88304F148569D409EB355DA34EC46CB60

Function 06D9EF00 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8797184f63f5975a03b4ac36dbfa01a24811b571a188320727c1d9a6721cb3b4
Instruction ID: e9a8d1570eb4917d31da378502a631132b453ac5d23ccf8affacfa1d3b711316
Opcode Fuzzy Hash: 8797184f63f5975a03b4ac36dbfa01a24811b571a188320727c1d9a6721cb3b4
Instruction Fuzzy Hash: EC712970A002099FDB54DFA9D980A9EBBF6FF88300F148529D419EB355DB34EC46CB60

Function 06D9FC68 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4adfef4afc6decdc660ed7c45688782b1c24731b3d6d2df77c6193303ed6ef3
Instruction ID: 3065b2e7019d909ad24128ac70ba5a38ba5e4917f921e01df1d7ba692a72d03b
Opcode Fuzzy Hash: a4adfef4afc6decdc660ed7c45688782b1c24731b3d6d2df77c6193303ed6ef3
Instruction Fuzzy Hash: B351BE31F002099FDF64EBB8E4846ADBBB2FB88315F208879E516D7350DB359955CBA0

Function 06D9FA09 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549d14885c5ec28a1947091fe72cf525d6acaa6dd85a7022314a0c3d11866bb6
Instruction ID: 2497dda2ef5b677f3aa32fa535da86e71acbc8b2a74c1e023810940bdfe6047c
Opcode Fuzzy Hash: 549d14885c5ec28a1947091fe72cf525d6acaa6dd85a7022314a0c3d11866bb6
Instruction Fuzzy Hash: 0951C670F103149BEF645BB8D894B6F2A5AE78D710F20443AE40BD7790CA7CDC4297A2

Function 06D9FA18 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2dff5e82ed651d202822768d37bda9f599fd5ddd1c0f2a41b8906c0aeece1c
Instruction ID: 3a4453c035a0de23648241690e4143a435bcdae0ce3aa4e8506bdb566c46214e
Opcode Fuzzy Hash: bc2dff5e82ed651d202822768d37bda9f599fd5ddd1c0f2a41b8906c0aeece1c
Instruction Fuzzy Hash: A851B270F202149BEF645BB8D894B6F2A5AE78D750F20443AE40BD7790CA7CDC4297A2

Function 06D95408 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a4a452eeb81d0f3b0b63a6efc2bdcd75678043a605e2f302f7c64c9218e6bb
Instruction ID: b8f53001d703d6e748f632aa79c27a7f810b429024d1d311c43953c1ae098b56
Opcode Fuzzy Hash: 94a4a452eeb81d0f3b0b63a6efc2bdcd75678043a605e2f302f7c64c9218e6bb
Instruction Fuzzy Hash: 4B413D71E006098FDFB1CF99E880AAFF7B2FB88210F10493AE156D7651D630E9558BA1

Function 06D9FC58 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5ddb170838a94ca20241c115714cbe711fd63e7c451085ce11f61dc6b6b99e
Instruction ID: 51c10ac6f53d93bb232974a24c3547ec4565a55c84537acd04eb75af4204ebe8
Opcode Fuzzy Hash: 2b5ddb170838a94ca20241c115714cbe711fd63e7c451085ce11f61dc6b6b99e
Instruction Fuzzy Hash: 5331AF32E002189FCF18ABB8E4546AEBBB3FB84316F108979E556D7340DF359856C7A1

Function 06D9D950 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ef24142d228582bb4cdddd3d3154aef9de7a76a58dc827a309ed51b58336be
Instruction ID: 94cde4b63c3d0f89526bd082191c81fabf90e9b844642ff0712527916df700b3
Opcode Fuzzy Hash: 64ef24142d228582bb4cdddd3d3154aef9de7a76a58dc827a309ed51b58336be
Instruction Fuzzy Hash: 68319230E1075A9FDF25DF68C89069EBBB2EF85204F104929D405EB644EB74E9468BA0

Function 06D92090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a32f42bda8026196701ef01a83f5999ff4bcff6516f4dec02e968f051966d33
Instruction ID: 47f848dfaf79314d083ff4e8e16045edf79214fe2e5852cc9c51e3b69cef00a9
Opcode Fuzzy Hash: 1a32f42bda8026196701ef01a83f5999ff4bcff6516f4dec02e968f051966d33
Instruction Fuzzy Hash: 4D317E34E20215ABCB59CF65D85469EBBB2FF89300F108529E906FB344DB71AD81CB60

Function 06D9208B Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd3a80bd9896dea79de8e5dde2dc6a6bc9de572eb2982bd3e93ce2ccf1f2dd3
Instruction ID: 1a51ef4aecd8f8ac11384031c05eff8c679d742c30dee93442d37e4bd31d8e16
Opcode Fuzzy Hash: fcd3a80bd9896dea79de8e5dde2dc6a6bc9de572eb2982bd3e93ce2ccf1f2dd3
Instruction Fuzzy Hash: 85319E34E20615ABCB59CF65D89469EBBB2FF89300F108529E906FB344DB71AD82CB50

Function 06D93A80 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f1af543935592ebb3c3bae4284a204afcd29cb416dba9b743471f2b00ceb414
Instruction ID: f781ce218b553fe5d83c7322ffdf93073374c41837d01bd72e6f2be53f659515
Opcode Fuzzy Hash: 4f1af543935592ebb3c3bae4284a204afcd29cb416dba9b743471f2b00ceb414
Instruction Fuzzy Hash: 30216976E002199FDF40CF69D880AEEBBF5EB88710F158029E944E7380E735ED418BA0

Function 06D93A90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6462caaea197bc59c58e0a16b3823c668785c08dc8e9eb6c37eef9aaef4e0712
Instruction ID: f7e3be5b471391f70a143927afa64f113740cb81ca201e0d119ccb66ef03b330
Opcode Fuzzy Hash: 6462caaea197bc59c58e0a16b3823c668785c08dc8e9eb6c37eef9aaef4e0712
Instruction Fuzzy Hash: 46213975E007199FDF50CFA9D880AAEBBF5EB88710F118029E905E7350E735ED408BA4

Function 0133D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2484304184.000000000133D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0133D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_133d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72db13fd2f5f9e9868df84a48f95917a71987412dd11564e83b97ecd6761d775
Instruction ID: 0db353ae57d6b13a887c7e18e52e6053de21c009307875e892faea5ed8e9fb65
Opcode Fuzzy Hash: 72db13fd2f5f9e9868df84a48f95917a71987412dd11564e83b97ecd6761d775
Instruction Fuzzy Hash: FD2100B1608204DFDB15DF54D980B26FBA5EBC4718F60C66DE8090A296C33AD847CA66

Function 06D953F8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f812987169734c37ade562eecda3652b1d5aaef66dbd5fc21d6ace53a2c5e6
Instruction ID: 606eccf71ea782d4c52b838b94ff4358a27df9cac436f019cd8b3e9e2a542924
Opcode Fuzzy Hash: b7f812987169734c37ade562eecda3652b1d5aaef66dbd5fc21d6ace53a2c5e6
Instruction Fuzzy Hash: 22216F31E007059FCB61CFA9DCC1AAFFBB6FB88610F144929E15597650D630A8568BA0

Function 06D96D00 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e17731958abaa39371ba83b16411b4d06c2eb7afb580e0baf8f92f30efd989
Instruction ID: 01c6a4778b791b24ba8ff2938e0014f7f3faa5436651b9f078564b319132e97c
Opcode Fuzzy Hash: 80e17731958abaa39371ba83b16411b4d06c2eb7afb580e0baf8f92f30efd989
Instruction Fuzzy Hash: 1A21AF30B101189FDF94DB6AE8506AEBBB6EB84350F248569E405EB380DB35ED4187A4

Function 06D93BA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c8d8e98536458616a290b5ba9d2d9d4aeb8f2741e45801dc67414b8c615477
Instruction ID: 32013e6c7064e0a9972955f0e2f5350c631b6f9ed4757b5a96efa98481c1d828
Opcode Fuzzy Hash: a3c8d8e98536458616a290b5ba9d2d9d4aeb8f2741e45801dc67414b8c615477
Instruction Fuzzy Hash: A4116131B146288FDF989A6DD8146EE7BBAEBC8310F058579E406E7344EE64DC0287E1

Function 06D9A2F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da6e64cc402565450daa35149906684e3e6e7ebdb19d79695d88ff9a878c432
Instruction ID: 4d8461d1f58022cf5e91aef54c6541e7e1c673e91f7f642a14ad64b00f91b932
Opcode Fuzzy Hash: 6da6e64cc402565450daa35149906684e3e6e7ebdb19d79695d88ff9a878c432
Instruction Fuzzy Hash: 1401FC31B042205FDBA197BCD46176E77E5EB8B750F14887AE50BCB781D925DC028B91

Function 06D941E1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb7ca94a8417045dcf95ffa1cbc7da07478c7eb365cf5b7a4cc28a78d7d4419
Instruction ID: f4da1945148b1900e94cbd47d012532328754a3f8ce1ba361372cbe1a20d6b82
Opcode Fuzzy Hash: ddb7ca94a8417045dcf95ffa1cbc7da07478c7eb365cf5b7a4cc28a78d7d4419
Instruction Fuzzy Hash: 7A01DF35B101201FEFA496ADD84572BA7C6EBCA720F10843AF10ACB742ED69DC4343A1

Function 06D93B8F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe15291db9963022781ef4c77cc8b08b4e12aa944ff1f872cd36b84ce2e8eef7
Instruction ID: 6780ba4f298ba4b1afdb43c7bcc0661dd4e1f55ae24ae7b19c332b06cb11937a
Opcode Fuzzy Hash: fe15291db9963022781ef4c77cc8b08b4e12aa944ff1f872cd36b84ce2e8eef7
Instruction Fuzzy Hash: B901F532B082684FDF94D6AED8206EF7BBA9BC8310F05407AE446D3280EF24DC05C7A1

Function 06D93859 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cb5d4b2bf472669e2b4939bb6d451027899f870abd39c0bc762940a2ccee9e
Instruction ID: d0f6d8ddc612fcc4bd8f000a46122048aa54069265b178a5ec7ad061f91c2df9
Opcode Fuzzy Hash: c0cb5d4b2bf472669e2b4939bb6d451027899f870abd39c0bc762940a2ccee9e
Instruction Fuzzy Hash: 4021D6B5D01219AFCB10DF9AD885ADEFFB4FB48310F50822AE918A7340D375A954CFA5

Function 06D9F171 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c1397627acc632d1d237d702a9ea576cdd6e9c42a83f7cb73e4577af3ae531
Instruction ID: 0f4057872901121be358b78ec92c77e30175d76bb7414d48d90849176df18408
Opcode Fuzzy Hash: c7c1397627acc632d1d237d702a9ea576cdd6e9c42a83f7cb73e4577af3ae531
Instruction Fuzzy Hash: D901F231F005205BDF64E72CD861B2F72D6EBCA214F108939E60AD7740D914DC0303E2

Function 06D93040 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e15846e79b3e9065f84d31455bf25d14f218c0de9c4e8ed27fe1d5ef5d74da8
Instruction ID: ea97de38664317e91f233c67517bcb0ac133c4bd9b8f8940b91a9e27ddb4bb8d
Opcode Fuzzy Hash: 5e15846e79b3e9065f84d31455bf25d14f218c0de9c4e8ed27fe1d5ef5d74da8
Instruction Fuzzy Hash: 7C015E71E002189ACF58DF79D8405DEFBB5EF89310F11856AD509E7200EA31DA44CBA0

Function 0133D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2484304184.000000000133D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0133D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_133d000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 2a7354df7a31add58041e4fa6a49a8d500c7a4f100fab2a2f598c0311a2c5868
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: AB11BE75504280CFCB16CF54D9C0B15FB61FB84318F24C6AAD8494B656C33AD44ACB61

Function 06D93860 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4492c6de1dfd618a3016e5f5fdf4ce438fbc2487338d8b2cc9c5a56dbce50781
Instruction ID: 677824819b171f37cd8721670032191712d38f49ea93a2c057602af3f65e7b55
Opcode Fuzzy Hash: 4492c6de1dfd618a3016e5f5fdf4ce438fbc2487338d8b2cc9c5a56dbce50781
Instruction Fuzzy Hash: DC11E4B5D01219AFCB10DF9AD884ADEFFB4FB48310F10822AE918A7340C375A944CFA5

Function 06D941F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ccfc56068f4f02b4d39ddb7e5709dd3a2ded9ea48a1d499cc035638c0c0a8da
Instruction ID: 8e17da8d61ebf6ba560fd8430f97519265e3762d01ae9dd31b849241576130fe
Opcode Fuzzy Hash: 5ccfc56068f4f02b4d39ddb7e5709dd3a2ded9ea48a1d499cc035638c0c0a8da
Instruction Fuzzy Hash: 9101D134B101200BDFA496AEE45572BE7CAEBCA720F10843AF10AC7746DD25EC4303A1

Function 06D9F180 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33888f6b765b68e112af3fdcfe197e6fc00fb62d5a774a1b30b8e1c3527b870d
Instruction ID: f654aea3970dafaa1b9240c43ec484553a710eb71b6fb5b222f1e761ea1e7b72
Opcode Fuzzy Hash: 33888f6b765b68e112af3fdcfe197e6fc00fb62d5a774a1b30b8e1c3527b870d
Instruction Fuzzy Hash: 6601DC71B106205BDFA4976DD85072FB6D6EBCA210F208839E60AD7340DE25DC0203E1

Function 06D9A300 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bcd4a9d0f8497b78ce42938c3f185d8c04bc834973edfee0789d502710c46fb
Instruction ID: 63fdabf63f7cc4f433ee091ab46eb861936f23980dee3b970cc9abee1f7be100
Opcode Fuzzy Hash: 5bcd4a9d0f8497b78ce42938c3f185d8c04bc834973edfee0789d502710c46fb
Instruction Fuzzy Hash: 2801A431B102245FDBA0E7BDE45072FB7D9EB8A350F10897AE60BCB380D925EC018790

Function 06D96461 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac36d211908efa61e34a6d8864c44a32261b7383b7d1d24185ed02a4f166c33
Instruction ID: cf220c2144eae13006824fb8aa52553d4cd5360d329754a290b5bf395598b17f
Opcode Fuzzy Hash: fac36d211908efa61e34a6d8864c44a32261b7383b7d1d24185ed02a4f166c33
Instruction Fuzzy Hash: 8EE0D871E1C188ABFF90CFF0C95435E77AAD705244F2148A1D405CB142E236DD018F71

Function 06D96470 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction ID: f0ecc6cfbd8a77b65289f5867ca36018936f0d2e263357d7e519088c4d244c11
Opcode Fuzzy Hash: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction Fuzzy Hash: 95E01271E18148ABEF50DFF4C95575A77ADD705214F2089A5D409CB201E576DE014BA0

Non-executed Functions

Function 06D97688 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$q, xrefs: 06D977BC
$q, xrefs: 06D97B79
$q, xrefs: 06D97C2E
$q, xrefs: 06D97C24
$q, xrefs: 06D97C18
$q, xrefs: 06D977C8
$q, xrefs: 06D977F9
$q, xrefs: 06D977ED
$q, xrefs: 06D97B85
$q, xrefs: 06D97C3A

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-1298971921
Opcode ID: e9154946ccde5ec76e602a95d3dbda6c13b219a1de3b92f0e46a28c0b19751da
Instruction ID: 9b7e0297e704a0685c6a30df3f214f6167d90b0cfb4795da483d6a8ca2989e7b
Opcode Fuzzy Hash: e9154946ccde5ec76e602a95d3dbda6c13b219a1de3b92f0e46a28c0b19751da
Instruction Fuzzy Hash: A6120A34E10219CFDB64DF69D854AADB7B2FF88305F2485A9D40AAB354DB30ED85CB90

Function 06D9A920 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$q, xrefs: 06D9AA7D
$q, xrefs: 06D9AA22
$q, xrefs: 06D9AAA8
$q, xrefs: 06D9AA16
$q, xrefs: 06D9AA9C
$q, xrefs: 06D9AAD2
$q, xrefs: 06D9AA71
$q, xrefs: 06D9AADE

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: fa760f5a2caf7a3d1fe54c0d1798aea5d03799cf9352982109e17f1679b0a935
Instruction ID: 1b55460088105052aad3f218987adbf942e064ac794f9d4d451b6e74d9e1e037
Opcode Fuzzy Hash: fa760f5a2caf7a3d1fe54c0d1798aea5d03799cf9352982109e17f1679b0a935
Instruction Fuzzy Hash: 84914035E0021ADFEF64DF65D554BAE77B6FF84304F188529E802AB290DB789C45CBA0

Function 06D97088 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$q, xrefs: 06D973D0
$q, xrefs: 06D9736A
$q, xrefs: 06D973C4
$q, xrefs: 06D9759C
$q, xrefs: 06D97590
$q, xrefs: 06D97524

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 346aa9e2a495d8f701f59d23f657955fb445f6e8b558c7245211b2f7356472e7
Instruction ID: 20b90bef8e2ddc5378b63072581d5200b2e36ba235958b56c9dfab639c526ecd
Opcode Fuzzy Hash: 346aa9e2a495d8f701f59d23f657955fb445f6e8b558c7245211b2f7356472e7
Instruction Fuzzy Hash: A8F11A34B10309CFDB95EFA5D450A6EBBB6FB88305F248568D4069B394DB75EC42CB90

Function 06D983C0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$q, xrefs: 06D98626
$q, xrefs: 06D9861A
$q, xrefs: 06D9868B
$q, xrefs: 06D9867F

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 7dd8900a18f5e059d9b236a9347fcdefdac428a9caad2a3a311934fe1908864f
Instruction ID: 86926652ca36676fd2e79b7723249ce7f1230c58b24c33465c7e0ba04bc2212f
Opcode Fuzzy Hash: 7dd8900a18f5e059d9b236a9347fcdefdac428a9caad2a3a311934fe1908864f
Instruction Fuzzy Hash: FCB13B34F10219CFDB64DBA9D4406AEB7B6FF89704F248929D4069B394DB75DC82CB90

Function 06D987D8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRq, xrefs: 06D988CB
$q, xrefs: 06D98863
LRq, xrefs: 06D9891A
$q, xrefs: 06D98857

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: LRq$LRq$$q$$q
API String ID: 0-2204215535
Opcode ID: 2b3a1b815d806769df5610889f07dbfb5ba2f451b370d109bb77424a14f86687
Instruction ID: 7987ecdcf4aa70c7827123c92ed34e1170deaae3e4ef4202ed92ccc26ab2de2d
Opcode Fuzzy Hash: 2b3a1b815d806769df5610889f07dbfb5ba2f451b370d109bb77424a14f86687
Instruction Fuzzy Hash: AF518E30B00205DFDF58EB69D840A6EB7B6FF89700F148A69E4129B395DA35EC41CBA1

Function 06D9ACA8 Relevance: 5.2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

Strings

$q, xrefs: 06D9AE2C
$q, xrefs: 06D9AE84
$q, xrefs: 06D9ADD9
$q, xrefs: 06D9AE5B

Memory Dump Source

Source File: 00000025.00000002.2528340306.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_6d90000_wlBldyvi.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: e2995c802399853e696e1fc76e956e2936aa36db9bb59d4ead319ce4a29112a6
Instruction ID: 08c58e89b895d0019996615e32e89bd7246c87a52e63b410ad09a2bec325c79a
Opcode Fuzzy Hash: e2995c802399853e696e1fc76e956e2936aa36db9bb59d4ead319ce4a29112a6
Instruction Fuzzy Hash: 39517F35F10205DFDF65DB64D4806AEB7B2FB88211F288529D806EB344EB35EC41CBA1

Analysis Process: IxumRsOtTdrVAu.exePID: 5096, Parent PID: 6688COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06C83040 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C8376F
$q, xrefs: 06C83722
$q, xrefs: 06C83716
$q, xrefs: 06C8374B
$q, xrefs: 06C83763
$q, xrefs: 06C8373F

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: b4c00ce2cf247d0b21e3d0b8135131a8b6913124c32c2fe0da4bf347a23e372e
Instruction ID: 32da7d8f6dc93d3bb126891663a13d5d0f2e1adb040e9957429861ccf314b87d
Opcode Fuzzy Hash: b4c00ce2cf247d0b21e3d0b8135131a8b6913124c32c2fe0da4bf347a23e372e
Instruction Fuzzy Hash: 1D322F71E10759CFCB14EFB9D89069DF7B2BF99300F61966AD409A7214EF30A985CB80

Function 06C87D68 Relevance: 3.0, Strings: 2, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C88303
$q, xrefs: 06C8830F

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 8572a19a29965ab232cbf07e4a43aa560f64f568ac79aa9cc5fc7fa36d3c1f45
Instruction ID: 6fc40615b7587f58511a7d1e49390e2b4d28d7e460ef6632da1283c57030f1f0
Opcode Fuzzy Hash: 8572a19a29965ab232cbf07e4a43aa560f64f568ac79aa9cc5fc7fa36d3c1f45
Instruction Fuzzy Hash: 0202C030B012198FDB64EB68D890BAEBBE2FF84314F648529D406DB744DB35ED42CB90

Function 06C8234A Relevance: 1.0, Instructions: 1000COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a95673e3715773e183f68750fe48bff7ae1364a3ff2579d30b3ebbeb58399a1
Instruction ID: bd2c5c3a33e46c83af6763e8975bd4321b0a5531384fd7b6f376f212256e0a0a
Opcode Fuzzy Hash: 8a95673e3715773e183f68750fe48bff7ae1364a3ff2579d30b3ebbeb58399a1
Instruction Fuzzy Hash: FD924934A002048FDB74EB68C598B5DBBF2EF45318F5484AED449AB365DB39EE45CB80

Function 06C865E0 Relevance: .8, Instructions: 810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692f50e6b0367b57a3e011be23f9dbb228552d227afcbf27c879c021ee6b7ac8
Instruction ID: 909f63e7125557614ee54a0ed1d8aebbf3176781ee7e35e3dc42afc67acc951c
Opcode Fuzzy Hash: 692f50e6b0367b57a3e011be23f9dbb228552d227afcbf27c879c021ee6b7ac8
Instruction Fuzzy Hash: B7628D34A002088FDB64EB69D594BADB7F2FF84318F248569E416DB394DB35ED46CB80

Function 06C85588 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7e7111d6cbdbdb0a744fa5cf2fbdcbeea73f5e6b32ce98e1b64a8cd26e6bcb
Instruction ID: 3d3327c998775b5fd24e6f39f3264b1b8be259fb52389a104c62de1c8c2b8c03
Opcode Fuzzy Hash: ba7e7111d6cbdbdb0a744fa5cf2fbdcbeea73f5e6b32ce98e1b64a8cd26e6bcb
Instruction Fuzzy Hash: B822CF71E102148FDFB4EB68C4807AEBBB2EF85314F64846ED455AB385DAB1DD41CB90

Function 06C8B20F Relevance: .6, Instructions: 593COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d2900fcb7f6d188e556c7cb47e54b0281ce0ad2294ecd99e68ffb00277f078
Instruction ID: 6b0fc66e31cf502852e83f509f643fa1d10417050d4458d0833aa5ac388393a8
Opcode Fuzzy Hash: e8d2900fcb7f6d188e556c7cb47e54b0281ce0ad2294ecd99e68ffb00277f078
Instruction Fuzzy Hash: 3F225E70E102098FEF74EB68D4907AEB7B2EB85318F24842AE419DB395DB35ED81C751

Function 06C8ACB8 Relevance: 10.4, Strings: 8, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C8AE84
$q, xrefs: 06C8ADD9
$q, xrefs: 06C8AE67
$q, xrefs: 06C8AE38
$q, xrefs: 06C8AE5B
$q, xrefs: 06C8ADE5
$q, xrefs: 06C8AE2C
$q, xrefs: 06C8AE90

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: 183539eacb905273d323635e7ad5f77566bc542fd00b43a2d9ed7ff54141d0c3
Instruction ID: a3481248a53b2b068a3e511b51d564c0c722da972c833dc52e2367f4da05c10b
Opcode Fuzzy Hash: 183539eacb905273d323635e7ad5f77566bc542fd00b43a2d9ed7ff54141d0c3
Instruction Fuzzy Hash: 17E16E30E103098FDB69EFA9D4906AEB7B2FF85305F10892AD8059B354DB71ED46CB91

Function 06C8B630 Relevance: 8.0, Strings: 6, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C8BBD7
$q, xrefs: 06C8BB6F
$q, xrefs: 06C8BB97
$q, xrefs: 06C8BBCB
$q, xrefs: 06C8BB63
$q, xrefs: 06C8BBA3

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 52a4cb2c36d951287d6501f0d74bb40dc9835ac0a057239081a6d93612af5769
Instruction ID: f5dc1dcf719c8d8fcc178efd578be1e4f276262e85915326ffb624b3b7be76dd
Opcode Fuzzy Hash: 52a4cb2c36d951287d6501f0d74bb40dc9835ac0a057239081a6d93612af5769
Instruction Fuzzy Hash: 16028C30E102098FEBB4EF68D4907AEB7B2FB45318F24856AD419DB255DB30EE45CB91

Function 06C89138 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C8918B
$q, xrefs: 06C8917F
$q, xrefs: 06C891BA
$q, xrefs: 06C891C6

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: bff6649d3643b30f7587a5a141033154bd40d091baf7fc012e0d0a80135ae788
Instruction ID: 098eaa66400ba67a19faac593bdb494647eb0fa8c2a1d3776aa8d39b36509ffe
Opcode Fuzzy Hash: bff6649d3643b30f7587a5a141033154bd40d091baf7fc012e0d0a80135ae788
Instruction Fuzzy Hash: 0F917470F002198FDB64EB69D8A07AE77B6BFC8304F108569D9199B348EE70DD41CB91

Function 06C8CF28 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C8D327
$q, xrefs: 06C8D31F
$q, xrefs: 06C8D333

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: aeb819a3dff3bca49f0d892ed82d93831293b1986f0028b9b854343855ba00db
Instruction ID: 4718a64d0310532914aefbdc3abcf46d5d02d2b3aa3e6eaae8cd6e04d7d15c0b
Opcode Fuzzy Hash: aeb819a3dff3bca49f0d892ed82d93831293b1986f0028b9b854343855ba00db
Instruction Fuzzy Hash: C8623834A003198FDB69EF68D590A5EB7E2FF84314F208A68D0169F259DB71FD46CB81

Function 06C84B50 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fq, xrefs: 06C8525D
\Oq, xrefs: 06C84D07
XPq, xrefs: 06C84C7D

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: fq$XPq$\Oq
API String ID: 0-132346853
Opcode ID: 786a587d59b9a424ceca7b684bc0c8453a014e48777a7e727bc3efecfb84d3e7
Instruction ID: 58f3bd1d6974ddf8a41a9eba5e839297a2a025e7a4d22b732aeb509147899a08
Opcode Fuzzy Hash: 786a587d59b9a424ceca7b684bc0c8453a014e48777a7e727bc3efecfb84d3e7
Instruction Fuzzy Hash: F5616E70E002199FEB54ABA9C8547AEBAF6FF88304F20842AD505AB395DF758D45CB90

Function 06C89127 Relevance: 2.7, Strings: 2, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C8917F
$q, xrefs: 06C891BA

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 1114488c11f422da6e0228d10c5b919c618f0cf2f49f8cefc3ea3d5a0bf408bc
Instruction ID: 41df466adc8c7c3cfdfa23c2de3afb5674c5262aacbb6a2f01a7f22eac1f86dd
Opcode Fuzzy Hash: 1114488c11f422da6e0228d10c5b919c618f0cf2f49f8cefc3ea3d5a0bf408bc
Instruction Fuzzy Hash: 73517470B002099FDB64EB79D8A0B6E7BF6BF88300F108569D919DB358EA74DD41CB91

Function 014AEB38 Relevance: 1.6, APIs: 1, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2488653902.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_14a0000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb9aebe0b4ce6c7877de85bdf80ccf07d4d8779bc47f760d0f3ea096d1a04c3
Instruction ID: 8f7c1f788be380023c10936d1f9803c89ae951ef0bd10f8ed18112a00d151267
Opcode Fuzzy Hash: 0eb9aebe0b4ce6c7877de85bdf80ccf07d4d8779bc47f760d0f3ea096d1a04c3
Instruction Fuzzy Hash: AF516572D003458FD724CF69D80439EBFF2AF89210F1A856BC519EB361DB349846CB90

Function 014AEC20 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 014AEC87

Memory Dump Source

Source File: 00000027.00000002.2488653902.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_14a0000_IxumRsOtTdrVAu.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: da7b579f468811059313038943bf09c6ce3d3505224e36ec5fb296d921667fde
Instruction ID: 7939f3ed36e49718f13a4a7f6bb59a5bc7cb2c4305186f2ab6d3eeca89ab6dfa
Opcode Fuzzy Hash: da7b579f468811059313038943bf09c6ce3d3505224e36ec5fb296d921667fde
Instruction Fuzzy Hash: 831112B1C0065A9BDB10DF9AC544B9EFBF4AB48220F11812AD918B7240D778A941CFA1

Function 06C84B40 Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPq, xrefs: 06C84C7D

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: XPq
API String ID: 0-1601936878
Opcode ID: 53b8da7067e7770c9e3dc8e3a615fc306a04a8254818253ea172a13158e1c21e
Instruction ID: c97bc38deedb3f7fedf266a2e9c979a3f8c0766a302218d1457a0ea28eb47bcf
Opcode Fuzzy Hash: 53b8da7067e7770c9e3dc8e3a615fc306a04a8254818253ea172a13158e1c21e
Instruction Fuzzy Hash: 63416074F002199FEB549FA9C854B9EBBF6BF88300F24852DD105AB395DB759C05CB90

Function 06C8DA9D Relevance: 1.4, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 06C8DBF9

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: d187fe0b7fbdc556230f1f8a6de718b1a2219d8e87c305d286656a2ea8e634ec
Instruction ID: 558f6fcf45cb817730d83fa1918f96bf23ac8e4b93af14dc03f89453a89797ef
Opcode Fuzzy Hash: d187fe0b7fbdc556230f1f8a6de718b1a2219d8e87c305d286656a2ea8e634ec
Instruction Fuzzy Hash: B8417130E00309DFDB64EF65D4546AEBBB2BF85304F24452AE806DB284DB70A946CB91

Function 06C821D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHq, xrefs: 06C8230B

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 46e9e54a431834ec3805f9a2bef42beabda4c0a9f84d31901f8a970722abf86e
Instruction ID: 5ce40d2b8713e8628ef61097ce4b0e5862f20146865e4291e8fc5965c09ed790
Opcode Fuzzy Hash: 46e9e54a431834ec3805f9a2bef42beabda4c0a9f84d31901f8a970722abf86e
Instruction Fuzzy Hash: 3731CF30B102098FDB68AB75D46866E7BE6AB89214F24443CD406DB388DF39DE06C7D5

Function 06C882DE Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$q, xrefs: 06C88303

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q
API String ID: 0-1301096350
Opcode ID: 119407b9af77c573be6b644dca1929f88dd4e633c912e1e6b3deaa6124781e48
Instruction ID: f386554c8666be5599eab0741bd846d84172ae156d80e2b102ab7d4f9953d40f
Opcode Fuzzy Hash: 119407b9af77c573be6b644dca1929f88dd4e633c912e1e6b3deaa6124781e48
Instruction Fuzzy Hash: 7DF0A936A06209DFEF747986FC902A873A0EB04259B8845AADE00C3945E370DF00C690

Function 06C8C170 Relevance: .6, Instructions: 641COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deaec7d892c8b53eaaff0f037f7e6acd00bae5728d7d784988b799efbd2d3d3b
Instruction ID: 76a352d33b268f18d7246333634a3b9fbe6d7d16d9705180762c3606af7a823c
Opcode Fuzzy Hash: deaec7d892c8b53eaaff0f037f7e6acd00bae5728d7d784988b799efbd2d3d3b
Instruction Fuzzy Hash: 2B329374B002098FDB64EFA8D490BAEBBB2FB88314F108529D505DB355DB35ED46CB91

Function 06C861E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847f51290b3ae0e4bcd893302af05a761213d013dfc70f985591434f2251e9f3
Instruction ID: 733e82c1fdd1f31c5fb6fc3a34ea512e06c12bb9ce43171d0876533e240c2f4c
Opcode Fuzzy Hash: 847f51290b3ae0e4bcd893302af05a761213d013dfc70f985591434f2251e9f3
Instruction Fuzzy Hash: 7961C471F001204FDF64AA7EC884A5EBAD7AFC4214B194479D80AEB364DEB5ED4287C2

Function 06C84280 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b7f3f5d24c23fe069d2b4ceb75718571be1c5f8a13c2e7416c38f5c8c7c8dcd
Instruction ID: f9ef2a132c99fc947da0bd32cbe26931f0a2504289ef0840441d9ff35b42ea15
Opcode Fuzzy Hash: 4b7f3f5d24c23fe069d2b4ceb75718571be1c5f8a13c2e7416c38f5c8c7c8dcd
Instruction Fuzzy Hash: 3B813F74B102098FDB58EFA9D4907AEBBE2AF89304F108529D40ADB355EE34DD42C791

Function 06C845A0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7892fea439a705d73b466ae9a48f777e342b8e07a6f7055c19e2e85f5e7cb9d6
Instruction ID: 9d551a54051a953901856a9f5151ee9700dc13989356faa6cb82182c4a4202bb
Opcode Fuzzy Hash: 7892fea439a705d73b466ae9a48f777e342b8e07a6f7055c19e2e85f5e7cb9d6
Instruction Fuzzy Hash: AA915F30E1021A8FDB64DF64C850B9DBBB1FF89304F20C699D449BB255DB71AA85CB91

Function 06C845B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 542edfec2893f3a09dd489acdc5b05a2296fa23f8e069a3c0219e694d0cbdd79
Instruction ID: 584637ab578fb4a381c763f1cf87dacff2c23afdc38940a306db3fa84d109142
Opcode Fuzzy Hash: 542edfec2893f3a09dd489acdc5b05a2296fa23f8e069a3c0219e694d0cbdd79
Instruction Fuzzy Hash: E0913934E1021A8FDF64DF68C880B9DB7B1FF89304F20C699D549BB244DB71AA85CB90

Function 06C8EEF0 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4086b0309efeeb3be116669cb9201c5a410a219439de814a1f88e46a7e1a0df2
Instruction ID: 215a3591f7ba7c687de364d133b09dc6c72382f24d88e7aa11181150d919dac6
Opcode Fuzzy Hash: 4086b0309efeeb3be116669cb9201c5a410a219439de814a1f88e46a7e1a0df2
Instruction Fuzzy Hash: AD714B70A002499FDB64EFA9D990A9EBBF6FF88304F248529D415EB354DB30ED46CB50

Function 06C8EF00 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e1bf1cc3c01d6a7403978822bbddd5ced20998731ac4bd086e5710e4bd151ab
Instruction ID: e8262c3b9b20f025a1ec87f137d3d0d56dbf7baf7ce2e7c4bff917cb126ef68f
Opcode Fuzzy Hash: 7e1bf1cc3c01d6a7403978822bbddd5ced20998731ac4bd086e5710e4bd151ab
Instruction Fuzzy Hash: 2E714B70A002499FDB64EBA9D990A9EBBF6FF88304F248429D415EB354DB31ED46CB50

Function 06C8FC58 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562b4f84d8ad16c1d4534f0f687cb6d373d1e0ebbfdae012d8fdbd5777cb7599
Instruction ID: 81f914d222f282eef8910fd1c09e5d5e03dd9b0d3e41243ed118c4f0788f0de0
Opcode Fuzzy Hash: 562b4f84d8ad16c1d4534f0f687cb6d373d1e0ebbfdae012d8fdbd5777cb7599
Instruction Fuzzy Hash: 9951D431E01109DFCB74BF78E4546ADBBB2FB88359F20486EE126D7251DB319A55C780

Function 06C8FA09 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3ec5a4af385f41ddb5e86214d78f9a583c92947abdd38375846befc005647f
Instruction ID: 3e7eaba35f0a4683909564547d35eebefb7bd2edf5a21d60ec18c12432c4c664
Opcode Fuzzy Hash: 2d3ec5a4af385f41ddb5e86214d78f9a583c92947abdd38375846befc005647f
Instruction Fuzzy Hash: 0451D330B103188FEF747668D864B7F365AE789394F20442EE51AC7395CB78CD4293A2

Function 06C8FA18 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e93e967701fab4b6804673b130d11bedec206f929c5a04425f04f5f486b6cbd
Instruction ID: 25211aa39c0c1c13b32c3720e9fe085292d6ace6aa4729383f4eed2c94455003
Opcode Fuzzy Hash: 2e93e967701fab4b6804673b130d11bedec206f929c5a04425f04f5f486b6cbd
Instruction Fuzzy Hash: 9B51B030F103189FEF747668D864B6F365AE789394F20442ED51AC7394CA78DD4293A2

Function 06C853F8 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6728f31d3d0558f35b2721de2eab21f8042cd9bcb8f0de360b7df6b7431b5f2
Instruction ID: 6da3b969a5465668390ca690bfb0bca4663bd9203b45047292bc27e9056dc44b
Opcode Fuzzy Hash: e6728f31d3d0558f35b2721de2eab21f8042cd9bcb8f0de360b7df6b7431b5f2
Instruction Fuzzy Hash: D7418D71E007098FDBB0DEA9C880AAFBBB2EB84214F50492AE155D7650D370E959CB90

Function 06C8D950 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1579793bf7dfd72f99c75b9e1425043c92f87e95af4c42aa1f3b6b1f3faccb62
Instruction ID: ad644067fdda7872375c52466592694863a36dca0da8ff437725747d343d6f0d
Opcode Fuzzy Hash: 1579793bf7dfd72f99c75b9e1425043c92f87e95af4c42aa1f3b6b1f3faccb62
Instruction Fuzzy Hash: 18317430E1071A8FDB25EF68D89069EB7B2FF85314F104A2DD416EB294DB71B946CB81

Function 06C82081 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c419cf9badd49056bc044d8d40b8b2ceffedf836684d3413618cc1014a37b1
Instruction ID: 77de2d1f7a5869e87985b188270a923c31cd7545f8d4b88ee7580bfb8c497691
Opcode Fuzzy Hash: f6c419cf9badd49056bc044d8d40b8b2ceffedf836684d3413618cc1014a37b1
Instruction Fuzzy Hash: E9318E31E102059FCB59DFA4D85469EB7B2FF89304F208429E906EB350DB75EE41CB80

Function 06C82090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101faaf847048c44516599419d86cb5394b98004dbec841acf969f8b81ac19dc
Instruction ID: c62592867dd02b9cdbef7b1a82aea2f5f8327327b7aebbe8ad1bc9ff229ba5d2
Opcode Fuzzy Hash: 101faaf847048c44516599419d86cb5394b98004dbec841acf969f8b81ac19dc
Instruction Fuzzy Hash: 44319030E102059FCB59DFA8D85469EB7B2FF89300F208429E906EB354DB71EE41CB80

Function 06C83A80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bcc109427c0543664ce6aa943e6ffd2fc86d8b4b2b588d036149f30d58e7988
Instruction ID: bc389fb9034debe736e03384a61a642a3ba8a07cacd72f289060688aae7b8de3
Opcode Fuzzy Hash: 3bcc109427c0543664ce6aa943e6ffd2fc86d8b4b2b588d036149f30d58e7988
Instruction Fuzzy Hash: 8921A6B5F002199FEB50DFA9D891BEEBBF5AB48710F108029E505E7344EB30D941CB94

Function 0127D006 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2487899373.000000000127D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0127D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_127d000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1a1b45de87fdb191a72dc63009cb43d17e399a2d51bfbd6b89f455b018df12
Instruction ID: d3b66a4ac13978641d12a03433c128b4880a222988eb44c1b9f1b82f7dac50ba
Opcode Fuzzy Hash: 9d1a1b45de87fdb191a72dc63009cb43d17e399a2d51bfbd6b89f455b018df12
Instruction Fuzzy Hash: C33159755093C49FCB03CB64D994712BF71AF46214F29C5DBD9898B2A3C23A980ACB62

Function 06C83A90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d345674fcacef87a92a459bea35e50434677f120981eaa1291c0061da1aadca5
Instruction ID: 05fa0fde9307eeea6a141ebd374e9f9810af3c1688b85f57b0ee161306f0d184
Opcode Fuzzy Hash: d345674fcacef87a92a459bea35e50434677f120981eaa1291c0061da1aadca5
Instruction Fuzzy Hash: D6214FB5E006199FDB50EFA9D890AAEBBF5EB48710F108029E909E7354EB31DD40CB94

Function 0127D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2487899373.000000000127D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0127D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_127d000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931356f269877db981d0a4c0aafaca61b62df39a9e401d2ddef743a5ce3d9be7
Instruction ID: 4e33d8ee83a018ee140c6dea7e60b8f60c54a8505157a1e7e82e0d198d64e38c
Opcode Fuzzy Hash: 931356f269877db981d0a4c0aafaca61b62df39a9e401d2ddef743a5ce3d9be7
Instruction Fuzzy Hash: 3F212271614208DFDB16DF54D9C0B26BBA1FF84314F24C56DD94A0B282C376D847CA62

Function 06C86D00 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b093d04982a3048d5ffeb5926417825c70a906b35a6200058622ac9e7b5aea4e
Instruction ID: 6b1680f5cc531732034c17f6a344f9381b6040c8b78dfc37388e8300a56bad39
Opcode Fuzzy Hash: b093d04982a3048d5ffeb5926417825c70a906b35a6200058622ac9e7b5aea4e
Instruction Fuzzy Hash: 8A217270B101189FDF64EA6AE8A06AEBBB7EB84354F24842AD405DB345EB31ED41C790

Function 06C83BA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72bf410a2904303d8d66971605e9b652bd6ffa050e9699d524c1765dd541f7c
Instruction ID: 99f539bdf322de3d72761c016cb9100505802342a94990692c62b50a5ac5ccf0
Opcode Fuzzy Hash: e72bf410a2904303d8d66971605e9b652bd6ffa050e9699d524c1765dd541f7c
Instruction Fuzzy Hash: 3311A171B101284FDBA4AAA9D8606AE7BABABC8710F008539C40AE7354EE64DC0287D0

Function 06C8F171 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5bf5d29cad41f73b5a9d274151faba401a0ee883c630b73420d2fcbdea4ae23
Instruction ID: a530ec7ccaa54ad275d2a6a8efb2d69dcd8b32db6c23ffa2cc883e6e8bd82b09
Opcode Fuzzy Hash: a5bf5d29cad41f73b5a9d274151faba401a0ee883c630b73420d2fcbdea4ae23
Instruction Fuzzy Hash: 3A01B171B206101FDBB5A92CD850B7F67D6EBC9654F10843EE00ACB344DA15DD078391

Function 06C841E1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce66c3de6768c50f7a27a5e2c99011c8b1eb1c490514d3fb24e9497de049739
Instruction ID: 4ccd75b7099c16eb04928de941613d284bdc095cd9c55dfea4eae798e54ac1df
Opcode Fuzzy Hash: cce66c3de6768c50f7a27a5e2c99011c8b1eb1c490514d3fb24e9497de049739
Instruction Fuzzy Hash: D2012870B042520FDBA5A6BC985472BFBD6DFCA320F14C56EE10ACB3A2D915CD428391

Function 06C83859 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c97612485cf5079bf563f08082a7f8c8d61f233cf53d6280b2fa2483202ea6e4
Instruction ID: 4f8980110eb336500b361e6915867bb6d735310d0d945d6943e3a6f1a2c0ee75
Opcode Fuzzy Hash: c97612485cf5079bf563f08082a7f8c8d61f233cf53d6280b2fa2483202ea6e4
Instruction Fuzzy Hash: D421CFB5D11259AFCB10DF9AD984ADEFBB4FB48310F10822AE918A7240C374A945CFA4

Function 06C8A2F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eaba43e09d50648a4426cf560cf0f898782b33221b4573b4f5c2151d17d1d02
Instruction ID: 8babcaff64d7674af08d7c0f64b09b0e693bfb13f0a26a9ccf7dd25bdcf60015
Opcode Fuzzy Hash: 4eaba43e09d50648a4426cf560cf0f898782b33221b4573b4f5c2151d17d1d02
Instruction Fuzzy Hash: 8C01B570B146144FDB75AB7CE86076EBBD5EB86314F10846FE14ACB394EA25ED01C381

Function 06C83860 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d603e660ed760944769f0a98aa5a809d102cb075152564f6652b3baa89d53cb5
Instruction ID: 6c5df774a33f4c436f07487682d74f4ce0e93a11723b88451ebaaf60e7f87cea
Opcode Fuzzy Hash: d603e660ed760944769f0a98aa5a809d102cb075152564f6652b3baa89d53cb5
Instruction Fuzzy Hash: 6811E2B5D01259AFCB10DF9AD884ADEFFB8FB48310F10812AE918A7340C375A944CFA5

Function 06C841F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47d17477313bcb6e74e05ff80b6f74a51f972fb4e42b655ef6fcd9ceae62d7c
Instruction ID: 695f965e6b4f9613e763f873dfe94f5b99f0e8f1fce3d6d72a1056c1cb30a6bf
Opcode Fuzzy Hash: d47d17477313bcb6e74e05ff80b6f74a51f972fb4e42b655ef6fcd9ceae62d7c
Instruction Fuzzy Hash: 13016D71B102110FDBA8A6ADA85472BE2DAEBC9725F10C43DE10ACB355EA66DD428391

Function 06C83B8F Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24efc174784cd878d30eeedb122d48e9f3ef04f1f1935562199658887d4ee24b
Instruction ID: 5cadf4024275ade66c86e235343bcce20b70404b38655891701ce400c284306c
Opcode Fuzzy Hash: 24efc174784cd878d30eeedb122d48e9f3ef04f1f1935562199658887d4ee24b
Instruction Fuzzy Hash: 9401F772B100144FEBA4AAADD8207EF3B9BABC8310F04453ED409E3384EE64CD0283D1

Function 06C8F180 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9b6b5142e08847bd74809a80d4aa2dbd288f65744640e43d5fe0a9a26a1dfd
Instruction ID: da9ddbf001acf361da979293aa62b52c5f67dfbb7448d61cdb50f87e4bd547f5
Opcode Fuzzy Hash: cb9b6b5142e08847bd74809a80d4aa2dbd288f65744640e43d5fe0a9a26a1dfd
Instruction Fuzzy Hash: CD018175B105141FDBB4A56DD85072FA3DAEBC9658F10842DE51ACB344DE21DD028391

Function 06C8A300 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b18a663d9c2ccf0328d3961e11d856b9e257ccb6eceaf8dcde7f066cf18d2a
Instruction ID: 6333587b87d6dd8c507d9eca4a56de3129887c0d07965b74460b555fd7c166e4
Opcode Fuzzy Hash: 38b18a663d9c2ccf0328d3961e11d856b9e257ccb6eceaf8dcde7f066cf18d2a
Instruction Fuzzy Hash: 69013170B106144FDB74AAADD8A072EB7DAEB89718F10843EE50BCB354EA25ED01C781

Function 06C86461 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95f9290f6887c2c31d95be34cb88b05f521268d0671c5ca83416166649c9f3a
Instruction ID: 1cbd8174044839a336d939f2dddf618235a3134686f9cdd2bc6e2e5f79ca0749
Opcode Fuzzy Hash: a95f9290f6887c2c31d95be34cb88b05f521268d0671c5ca83416166649c9f3a
Instruction Fuzzy Hash: 2CE02270E141858EEBB0EE70851076EBBA6DBC220CF204A99C049CB242E236EA10C340

Non-executed Functions

Function 06C87688 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$q, xrefs: 06C877ED
$q, xrefs: 06C877F9
$q, xrefs: 06C87C3A
$q, xrefs: 06C87B79
$q, xrefs: 06C87C2E
$q, xrefs: 06C87C24
$q, xrefs: 06C87C18
$q, xrefs: 06C87B85
$q, xrefs: 06C877BC
$q, xrefs: 06C877C8

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-1298971921
Opcode ID: 3caa4f04cc70303dcb0bbb09d6d85d80e9c58eae243134789b26a12c60388fd4
Instruction ID: fbb70ad012274b70b80ef63b3c1468af8cd889c9f73f013504de1e6c61bd784b
Opcode Fuzzy Hash: 3caa4f04cc70303dcb0bbb09d6d85d80e9c58eae243134789b26a12c60388fd4
Instruction Fuzzy Hash: 15124D70E002198FDB64EF69D854B9DB7B2FF88305F21856AD40AAB355EB31AD41CF90

Function 06C8A920 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$q, xrefs: 06C8AA16
$q, xrefs: 06C8AA9C
$q, xrefs: 06C8AAD2
$q, xrefs: 06C8AA7D
$q, xrefs: 06C8AAA8
$q, xrefs: 06C8AA71
$q, xrefs: 06C8AADE
$q, xrefs: 06C8AA22

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: 2f1bb718626f7b5de05999c4c5b61daae8e207627d32834ef42b7ad9d100273f
Instruction ID: 19f660389d56e119f3bccd06e375f4a4a8fa8b9d8d333b5ac502c6bffc74dcf3
Opcode Fuzzy Hash: 2f1bb718626f7b5de05999c4c5b61daae8e207627d32834ef42b7ad9d100273f
Instruction Fuzzy Hash: 84916E30A00209DFEB78FFA5D9947AE7BB2BF44304F14852EE4029B255DB75AD45CB90

Function 06C87088 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$q, xrefs: 06C873C4
$q, xrefs: 06C87590
$q, xrefs: 06C87524
$q, xrefs: 06C8759C
$q, xrefs: 06C873D0
$q, xrefs: 06C8736A

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 60c6fcad3e07113903df446210e328ce6a9a575590b6918d14b3cc05197ec1a3
Instruction ID: 356325dbe14a4880aeb593b4f790ba38d44c09d934cb13ede7fc5981659b80e8
Opcode Fuzzy Hash: 60c6fcad3e07113903df446210e328ce6a9a575590b6918d14b3cc05197ec1a3
Instruction Fuzzy Hash: 7BF14E30B00309CFDB69EF65D494A6EB7B2BF98305F648569D4059B368EB35EC42CB90

Function 06C883C0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$q, xrefs: 06C8868B
$q, xrefs: 06C8861A
$q, xrefs: 06C88626
$q, xrefs: 06C8867F

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: c561847c9f3b8b103a6009b0773a1811efec129648840baef7b17aced08225a9
Instruction ID: 959428fcacb350ab7bbcc3e16d89d417a3dae06defd9ea0bd230f417dc792891
Opcode Fuzzy Hash: c561847c9f3b8b103a6009b0773a1811efec129648840baef7b17aced08225a9
Instruction Fuzzy Hash: 8EB15B30B112098FDB64EFA5D89066EB7B2BF88304FA4852DD406DB754DB75DD42CB80

Function 06C887D8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRq, xrefs: 06C888CB
$q, xrefs: 06C88857
$q, xrefs: 06C88863
LRq, xrefs: 06C8891A

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: LRq$LRq$$q$$q
API String ID: 0-2204215535
Opcode ID: e5acc071a8f1ce2a7dd3c80df00632c0d238ae52688b5b4bc111f5a7afa1c9a3
Instruction ID: a250116f2340ba4bc525a3672f6c26c79b8c83f60c1216f0e7d83f2b58089e0a
Opcode Fuzzy Hash: e5acc071a8f1ce2a7dd3c80df00632c0d238ae52688b5b4bc111f5a7afa1c9a3
Instruction Fuzzy Hash: 1D51D230B002059FDB68EB69D890A6E77A2FF88304F54856EE406DB799DA31EC05CB91

Function 06C8ACA8 Relevance: 5.2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

Strings

$q, xrefs: 06C8AE84
$q, xrefs: 06C8ADD9
$q, xrefs: 06C8AE5B
$q, xrefs: 06C8AE2C

Memory Dump Source

Source File: 00000027.00000002.2527517358.0000000006C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_6c80000_IxumRsOtTdrVAu.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 9f2a1274af1f70612b415c4144b3b64785178ba5979dd1c1cc168ff99696e741
Instruction ID: 70fdcfb28c7396e3514b3f5f2933c26a747408791059e7af60cfa61c7a39dc06
Opcode Fuzzy Hash: 9f2a1274af1f70612b415c4144b3b64785178ba5979dd1c1cc168ff99696e741
Instruction Fuzzy Hash: CE518C34A102099FDB75EBA8D4906AEB7B2EB88305F14492FD805DB364DB31ED42CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lC7L7oBBMC.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IxumRsOtTdrVAu.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lC7L7oBBMC.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wlBldyvi.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gz2shuo.dfp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1awe5qq0.ksy.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1fdh1edr.lrp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4l3ik1zg.pay.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_acyk3i0h.un0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cigkw2n1.y1p.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d2gplr0b.ao5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dpqoyc5y.tah.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f2ovf0ty.zsr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gawabjj2.cwq.psm1

Windows Analysis Report
lC7L7oBBMC.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre