Windows Analysis Report
JIL-_Document_No._2500015903.cmd

Overview

General Information

Sample name: JIL-_Document_No._2500015903.cmd
Analysis ID: 1580951
MD5: 77be0aa379a1cae6efbaa06091238fc0
SHA1: 28e485a4e1de330f0750458b6d5b8841af2fd095
SHA256: d7ab60ae836fe857b14fdc6e19147e60e8f74ede79562fa60b08cb5c3d4afd5f
Tags: cmduser-TeamDreier
Infos:

Detection

DBatLoader
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected DBatLoader
AI detected suspicious sample
Allocates many large memory junks
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Machine Learning detection for dropped file
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe ReversingLabs: Detection: 56%
Multi AV Scanner detection for submitted file
Source: JIL-_Document_No._2500015903.cmd ReversingLabs: Detection: 39%
Source: JIL-_Document_No._2500015903.cmd Virustotal: Detection: 34% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 96.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_028358B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 3_2_028358B4
Contains functionality to check if a connection to the internet is available
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0284E2F8 InternetCheckConnectionA, 3_2_0284E2F8
Source: x.exe, 00000003.00000000.2032574356.0000000000483000.00000002.00000001.01000000.00000004.sdmp, x.exe, 00000003.00000003.2037165809.000000007F2F0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.2039316097.000000007F55B000.00000004.00001000.00020000.00000000.sdmp, JIL-_Document_No._2500015903.cmd, x.exe.2.dr String found in binary or memory: http://programania.com/en.htm
Source: x.exe, 00000003.00000000.2032574356.0000000000483000.00000002.00000001.01000000.00000004.sdmp, x.exe, 00000003.00000003.2037165809.000000007F2F0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.2039316097.000000007F55B000.00000004.00001000.00020000.00000000.sdmp, JIL-_Document_No._2500015903.cmd, x.exe.2.dr String found in binary or memory: http://programania.com/en.zip
Source: x.exe, 00000003.00000000.2032574356.0000000000483000.00000002.00000001.01000000.00000004.sdmp, x.exe, 00000003.00000003.2037165809.000000007F2F0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.2039316097.000000007F55B000.00000004.00001000.00020000.00000000.sdmp, JIL-_Document_No._2500015903.cmd, x.exe.2.dr String found in binary or memory: http://programania.com/en_source.zip
Source: x.exe, 00000003.00000002.4508660114.000000002077C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://programania.com/index_ru.htm
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\x.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0284DBB0 RtlDosPa,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose, 3_2_0284DBB0
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02847D00 NtWriteVirtualMemory, 3_2_02847D00
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0284DACC RtlDosPa,NtCreateFile,NtWriteFile,NtClose, 3_2_0284DACC
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0284DA44 RtlInitUnicodeString,RtlDosPa,NtDeleteFile, 3_2_0284DA44
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02848BAE GetThreadContext,SetThreadContext,NtResumeThread, 3_2_02848BAE
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02848BB0 GetThreadContext,SetThreadContext,NtResumeThread, 3_2_02848BB0
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0284D9F0 RtlInitUnicodeString,RtlDosPa,NtDeleteFile, 3_2_0284D9F0
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0284EC74 InetIsOffline,CoInitialize,CoUninitialize,Sleep,MoveFileA,MoveFileA,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess, 3_2_0284EC74
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_028320C4 3_2_028320C4
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0285D59A 3_2_0285D59A
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: String function: 0283480C appears 931 times
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: String function: 028344AC appears 73 times
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: String function: 028344D0 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: String function: 02848824 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: String function: 028487A0 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: String function: 028346A4 appears 244 times
Source: classification engine Classification label: mal80.troj.evad.winCMD@6/1@0/0
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02837F5A GetDiskFreeSpaceA, 3_2_02837F5A
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02846D50 CoCreateInstance, 3_2_02846D50
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4564:120:WilError_03
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\user\AppData\Local\Temp\CAB05252.TMP Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\System32\extrac32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: JIL-_Document_No._2500015903.cmd ReversingLabs: Detection: 39%
Source: JIL-_Document_No._2500015903.cmd Virustotal: Detection: 34%
Source: unknown Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "C:\Users\user\AppData\Local\Temp\x.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: url.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??????s.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ???.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ieproxy.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ieproxy.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ieproxy.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: mssip32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: mssip32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: mssip32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ieproxy.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ieproxy.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ieproxy.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: mssip32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: mssip32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: mssip32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ieproxy.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ieproxy.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ieproxy.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: mssip32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: mssip32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: mssip32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: JIL-_Document_No._2500015903.cmd Static file information: File size 1268675 > 1048576

Data Obfuscation
barindex
Yara detected DBatLoader
Source: Yara match File source: 3.2.x.exe.22765a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.x.exe.22765a8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.x.exe.2830000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.4495741338.0000000002276000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4509288253.000000007FB80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_028487A0 LoadLibraryW,GetProcAddress,FreeLibrary, 3_2_028487A0
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0285C2FC push 0285C367h; ret 3_2_0285C35F
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_028332FC push eax; ret 3_2_02833338
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0283635A push 028363B7h; ret 3_2_028363AF
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0283635C push 028363B7h; ret 3_2_028363AF
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0285C0AC push 0285C125h; ret 3_2_0285C11D
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0285C1F8 push 0285C288h; ret 3_2_0285C280
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0285C144 push 0285C1ECh; ret 3_2_0285C1E4
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_028486C0 push 02848702h; ret 3_2_028486FA
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0283673E push 02836782h; ret 3_2_0283677A
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02836740 push 02836782h; ret 3_2_0283677A
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0283C4F4 push ecx; mov dword ptr [esp], edx 3_2_0283C4F9
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0284E5B4 push ecx; mov dword ptr [esp], edx 3_2_0284E5B9
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0283D528 push 0283D554h; ret 3_2_0283D54C
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0283CB0F pushfd ; iretd 3_2_0283CB3D
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0283CB57 push 0283CCFAh; ret 3_2_0283CCF2
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0285BB6C push 0285BD94h; ret 3_2_0285BD8C
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0283CB74 push 0283CCFAh; ret 3_2_0283CCF2
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02847894 push 02847911h; ret 3_2_02847909
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_028468CE push 0284697Bh; ret 3_2_02846973
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_028468D0 push 0284697Bh; ret 3_2_02846973
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02848916 push 02848950h; ret 3_2_02848948
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0284A91F push 0284A958h; ret 3_2_0284A950
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02848918 push 02848950h; ret 3_2_02848948
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0284A920 push 0284A958h; ret 3_2_0284A950
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0283C94F push eax; iretd 3_2_0283C975
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02842EE8 push 02842F5Eh; ret 3_2_02842F56
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02845E04 push ecx; mov dword ptr [esp], edx 3_2_02845E06
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02842FF4 push 02843041h; ret 3_2_02843039
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02842FF3 push 02843041h; ret 3_2_02843039
Drops PE files
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\user\AppData\Local\Temp\x.exe Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0284A95C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_0284A95C
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Allocates many large memory junks
Source: C:\Users\user\AppData\Local\Temp\x.exe Memory allocated: 2830000 memory commit 500006912
Source: C:\Users\user\AppData\Local\Temp\x.exe Memory allocated: 2831000 memory commit 500178944
Source: C:\Users\user\AppData\Local\Temp\x.exe Memory allocated: 285C000 memory commit 500002816
Source: C:\Users\user\AppData\Local\Temp\x.exe Memory allocated: 285D000 memory commit 500199424
Source: C:\Users\user\AppData\Local\Temp\x.exe Memory allocated: 288E000 memory commit 501014528
Source: C:\Users\user\AppData\Local\Temp\x.exe Memory allocated: 2986000 memory commit 500006912
Source: C:\Users\user\AppData\Local\Temp\x.exe Memory allocated: 2988000 memory commit 500015104
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\x.exe API coverage: 8.9 %
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_028358B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 3_2_028358B4
Source: x.exe, 00000003.00000002.4495581747.000000000075E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9
Source: C:\Users\user\AppData\Local\Temp\x.exe API call chain: ExitProcess graph end node

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0284EBF0 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent, 3_2_0284EBF0
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\x.exe Process queried: DebugPort Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_028487A0 LoadLibraryW,GetProcAddress,FreeLibrary, 3_2_028487A0
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "C:\Users\user\AppData\Local\Temp\x.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe" Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 3_2_02835A78
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: GetLocaleInfoA, 3_2_0283A798
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: GetLocaleInfoA, 3_2_0283A74C
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 3_2_02835B84
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_02839194 GetLocalTime, 3_2_02839194
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 3_2_0283B714 GetVersionExA, 3_2_0283B714
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1580951 Sample: JIL-_Document_No._2500015903.cmd Startdate: 26/12/2024 Architecture: WINDOWS Score: 80 18 Multi AV Scanner detection for submitted file 2->18 20 Yara detected DBatLoader 2->20 22 AI detected suspicious sample 2->22 6 cmd.exe 1 2->6         started        process3 process4 8 x.exe 6->8         started        11 extrac32.exe 8 6->11         started        14 conhost.exe 6->14         started        file5 24 Multi AV Scanner detection for dropped file 8->24 26 Machine Learning detection for dropped file 8->26 28 Allocates many large memory junks 8->28 30 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 8->30 16 C:\Users\user\AppData\Local\Temp\x.exe, PE32 11->16 dropped signatures6
⊘No contacted IP infos