Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe

Overview

General Information

Sample name:18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Analysis ID:1587304
MD5:c847a23633e81d799fba45bde7cc9951
SHA1:090035126cabb2fb574175c271097042025202de
SHA256:18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c
Tags:DCRatexeuser-abuse_ch
Infos:

Detection

DCRat
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Yara detected DCRat
AI detected suspicious sample
Connects to a pastebin service (likely for C&C)
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Creates processes via WMI
Drops PE files to the user root directory
Drops PE files with benign system names
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: New RUN Key Pointing to Suspicious Folder
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the user directory
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: CurrentVersion NT Autorun Keys Modification
Sigma detected: Suspicious Powershell In Registry Run Keys
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe (PID: 6008 cmdline: "C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe" MD5: C847A23633E81D799FBA45BDE7CC9951)
    • schtasks.exe (PID: 2452 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 2360 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 3040 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 4580 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Music\KryJcojekJhJNSUQWyfsXjt.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 3636 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Users\Default User\Music\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 5620 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Music\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 1772 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 1440 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 1476 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 11 /tr "'C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 6500 cmdline: schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 6396 cmdline: schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 6176 cmdline: schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 6616 cmdline: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windowspowershell\Registry.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 5428 cmdline: schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\windowspowershell\Registry.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 3136 cmdline: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\windowspowershell\Registry.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 6152 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 12 /tr "'C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 3192 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 2076 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 7 /tr "'C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 2316 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 7 /tr "'C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 6156 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 6668 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 5 /tr "'C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 2448 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 14 /tr "'C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7160 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 5700 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 13 /tr "'C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 5772 cmdline: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\csrss.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 6588 cmdline: schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\csrss.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 5280 cmdline: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\csrss.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 3812 cmdline: schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 2924 cmdline: schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 2800 cmdline: schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 5684 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 13 /tr "'C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 5756 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 6768 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 14 /tr "'C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 1772 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 6 /tr "'C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 1440 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 1476 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 12 /tr "'C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 5532 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 6352 cmdline: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DCRatDCRat is a typical RAT that has been around since at least June 2019.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"L\":\"$\",\"y\":\"@\",\"o\":\"&\",\"i\":\"#\",\"R\":\"<\",\"B\":\"^\",\"O\":\"_\",\"j\":\"~\",\"Y\":\"!\",\"X\":\"(\",\"m\":\")\",\"E\":\";\",\"b\":\"-\",\"z\":\">\",\"Z\":\".\",\"J\":\",\",\"N\":\" \",\"c\":\"*\",\"S\":\"`\",\"Q\":\"%\",\"k\":\"|\"}", "PCRT": "{\"X\":\"<\",\"w\":\"*\",\"I\":\">\",\"i\":\"|\",\"f\":\",\",\"b\":\"&\",\"S\":\"-\",\"p\":\"#\",\"x\":\"@\",\"=\":\"(\",\"M\":\"`\",\"e\":\";\",\"y\":\" \",\"c\":\"%\",\"D\":\".\",\"Q\":\"$\",\"l\":\")\",\"0\":\"!\",\"j\":\"_\",\"6\":\"~\"}", "TAG": "", "MUTEX": "DCR_MUTEX-jDGdZPGXBiq4zdh91P6z", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 2, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.2062107630.000000000363A000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
    00000000.00000002.2062107630.0000000003151000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
      Process Memory Space: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe PID: 6008JoeSecurity_DCRat_1Yara detected DCRatJoe Security

        Sigma Signatures

        System Summary

        barindex
        Sigma detected: Files With System Process Name In Unsuspected Locations
        Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, ProcessId: 6008, TargetFilename: C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe
        Sigma detected: New RUN Key Pointing to Suspicious Folder
        Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Windows\Temp\audiodg.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, ProcessId: 6008, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg
        Sigma detected: CurrentVersion Autorun Keys Modification
        Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, ProcessId: 6008, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KryJcojekJhJNSUQWyfsXjt
        Sigma detected: CurrentVersion NT Autorun Keys Modification
        Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, ProcessId: 6008, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
        Sigma detected: Suspicious Powershell In Registry Run Keys
        Source: Registry Key setAuthor: frack113, Florian Roth (Nextron Systems): Data: Details: "C:\Program Files (x86)\windowspowershell\Registry.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, ProcessId: 6008, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry
        Sigma detected: Suspicious Schtasks From Env Var Folder
        Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 6 /tr "'C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exe'" /f, CommandLine: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 6 /tr "'C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe", ParentImage: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, ParentProcessId: 6008, ParentProcessName: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, ProcessCommandLine: schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 6 /tr "'C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exe'" /f, ProcessId: 1772, ProcessName: schtasks.exe

        Persistence and Installation Behavior

        barindex
        Sigma detected: Schedule system process
        Source: Process startedAuthor: Joe Security: Data: Command: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windowspowershell\Registry.exe'" /f, CommandLine: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windowspowershell\Registry.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe", ParentImage: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, ParentProcessId: 6008, ParentProcessName: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, ProcessCommandLine: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windowspowershell\Registry.exe'" /f, ProcessId: 6616, ProcessName: schtasks.exe

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeAvira: detected
        Antivirus detection for dropped file
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Windows\Temp\audiodg.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Program Files (x86)\WindowsPowerShell\Registry.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Recovery\csrss.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Program Files\WindowsPowerShell\OfficeClickToRun.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeAvira: detection malicious, Label: HEUR/AGEN.1323984
        Found malware configuration
        Source: 00000000.00000002.2062107630.0000000003151000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: DCRat {"SCRT": "{\"L\":\"$\",\"y\":\"@\",\"o\":\"&\",\"i\":\"#\",\"R\":\"<\",\"B\":\"^\",\"O\":\"_\",\"j\":\"~\",\"Y\":\"!\",\"X\":\"(\",\"m\":\")\",\"E\":\";\",\"b\":\"-\",\"z\":\">\",\"Z\":\".\",\"J\":\",\",\"N\":\" \",\"c\":\"*\",\"S\":\"`\",\"Q\":\"%\",\"k\":\"|\"}", "PCRT": "{\"X\":\"<\",\"w\":\"*\",\"I\":\">\",\"i\":\"|\",\"f\":\",\",\"b\":\"&\",\"S\":\"-\",\"p\":\"#\",\"x\":\"@\",\"=\":\"(\",\"M\":\"`\",\"e\":\";\",\"y\":\" \",\"c\":\"%\",\"D\":\".\",\"Q\":\"$\",\"l\":\")\",\"0\":\"!\",\"j\":\"_\",\"6\":\"~\"}", "TAG": "", "MUTEX": "DCR_MUTEX-jDGdZPGXBiq4zdh91P6z", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 2, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}
        Multi AV Scanner detection for dropped file
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeReversingLabs: Detection: 76%
        Source: C:\Program Files (x86)\Mozilla Maintenance Service\KryJcojekJhJNSUQWyfsXjt.exeReversingLabs: Detection: 76%
        Source: C:\Program Files (x86)\WindowsPowerShell\Registry.exeReversingLabs: Detection: 76%
        Source: C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exeReversingLabs: Detection: 76%
        Source: C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exeReversingLabs: Detection: 76%
        Source: C:\Program Files\WindowsPowerShell\OfficeClickToRun.exeReversingLabs: Detection: 76%
        Source: C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exeReversingLabs: Detection: 76%
        Source: C:\Recovery\csrss.exeReversingLabs: Detection: 76%
        Source: C:\Users\Default\Music\KryJcojekJhJNSUQWyfsXjt.exeReversingLabs: Detection: 76%
        Source: C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exeReversingLabs: Detection: 76%
        Source: C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exeReversingLabs: Detection: 76%
        Source: C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exeReversingLabs: Detection: 76%
        Source: C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exeReversingLabs: Detection: 76%
        Source: C:\Windows\Temp\audiodg.exeReversingLabs: Detection: 76%
        Source: C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exeReversingLabs: Detection: 76%
        Multi AV Scanner detection for submitted file
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeReversingLabs: Detection: 76%
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeVirustotal: Detection: 69%Perma Link
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
        Machine Learning detection for dropped file
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeJoe Sandbox ML: detected
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeJoe Sandbox ML: detected
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeJoe Sandbox ML: detected
        Source: C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exeJoe Sandbox ML: detected
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeJoe Sandbox ML: detected
        Source: C:\Windows\Temp\audiodg.exeJoe Sandbox ML: detected
        Source: C:\Program Files (x86)\WindowsPowerShell\Registry.exeJoe Sandbox ML: detected
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeJoe Sandbox ML: detected
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeJoe Sandbox ML: detected
        Source: C:\Recovery\csrss.exeJoe Sandbox ML: detected
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeJoe Sandbox ML: detected
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeJoe Sandbox ML: detected
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeJoe Sandbox ML: detected
        Source: C:\Program Files\WindowsPowerShell\OfficeClickToRun.exeJoe Sandbox ML: detected
        Source: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeJoe Sandbox ML: detected
        Machine Learning detection for sample
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeJoe Sandbox ML: detected
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeDirectory created: C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exeJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeDirectory created: C:\Program Files\Windows Multimedia Platform\24dbde2999530eJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeDirectory created: C:\Program Files\WindowsPowerShell\OfficeClickToRun.exeJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeDirectory created: C:\Program Files\WindowsPowerShell\e6c9b481da804fJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeDirectory created: C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exeJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeDirectory created: C:\Program Files\Windows Defender\fc3ef8bff8a8faJump to behavior
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

        Networking

        barindex
        Connects to a pastebin service (likely for C&C)
        Source: unknownDNS query: name: pastebin.com
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficDNS traffic detected: DNS query: pastebin.com
        Source: global trafficDNS traffic detected: DNS query: a1066647.xsph.ru
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, 00000000.00000002.2062107630.000000000363A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exeJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe\:Zone.Identifier:$DATAJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\ServiceProfiles\fc3ef8bff8a8faJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exeJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe\:Zone.Identifier:$DATAJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\bcastdvr\fc3ef8bff8a8faJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exeJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe\:Zone.Identifier:$DATAJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\LiveKernelReports\fc3ef8bff8a8faJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeCode function: 0_2_00007FF848F39A2F0_2_00007FF848F39A2F
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: audiodg.exe.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: WmiPrvSE.exe.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: Registry.exe.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: KryJcojekJhJNSUQWyfsXjt.exe.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: KryJcojekJhJNSUQWyfsXjt.exe0.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: KryJcojekJhJNSUQWyfsXjt.exe1.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: KryJcojekJhJNSUQWyfsXjt.exe2.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: KryJcojekJhJNSUQWyfsXjt.exe3.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: KryJcojekJhJNSUQWyfsXjt.exe4.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: csrss.exe.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: OfficeClickToRun.exe.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: KryJcojekJhJNSUQWyfsXjt.exe5.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: KryJcojekJhJNSUQWyfsXjt.exe6.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: KryJcojekJhJNSUQWyfsXjt.exe7.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: KryJcojekJhJNSUQWyfsXjt.exe8.0.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, 00000000.00000002.2065528190.000000001C3B5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameli8! vs 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, 00000000.00000000.2033030171.0000000000FB2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dll4 vs 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeBinary or memory string: OriginalFilenamelibGLESv2.dll4 vs 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
        Source: classification engineClassification label: mal100.troj.evad.winEXE@37/46@2/0
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exeJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Users\Default User\Music\KryJcojekJhJNSUQWyfsXjt.exeJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeMutant created: NULL
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeMutant created: \Sessions\1\BaseNamedObjects\Local\a75e7ebeeb664450bf97a1676e5e368cae182978
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\Temp\audiodg.exeJump to behavior
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeReversingLabs: Detection: 76%
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeVirustotal: Detection: 69%
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile read: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeJump to behavior
        Source: unknownProcess created: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe "C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe"
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Music\KryJcojekJhJNSUQWyfsXjt.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Users\Default User\Music\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Music\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 11 /tr "'C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windowspowershell\Registry.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\windowspowershell\Registry.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\windowspowershell\Registry.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 12 /tr "'C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 7 /tr "'C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 7 /tr "'C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 5 /tr "'C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 14 /tr "'C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 13 /tr "'C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\csrss.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\csrss.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\csrss.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 13 /tr "'C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 14 /tr "'C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /fJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: edputil.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: windows.staterepositoryps.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: appresolver.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: bcp47langs.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: slc.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: onecorecommonproxystub.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32Jump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeDirectory created: C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exeJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeDirectory created: C:\Program Files\Windows Multimedia Platform\24dbde2999530eJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeDirectory created: C:\Program Files\WindowsPowerShell\OfficeClickToRun.exeJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeDirectory created: C:\Program Files\WindowsPowerShell\e6c9b481da804fJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeDirectory created: C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exeJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeDirectory created: C:\Program Files\Windows Defender\fc3ef8bff8a8faJump to behavior
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeCode function: 0_2_00007FF848F39157 push edx; retf 0_2_00007FF848F39158
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeCode function: 0_2_00007FF848F32CF8 pushad ; retf 0_2_00007FF848F32D11
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeCode function: 0_2_00007FF848F32D08 pushad ; retf 0_2_00007FF848F32D11

        Persistence and Installation Behavior

        barindex
        Creates processes via WMI
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Drops PE files with benign system names
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Recovery\csrss.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Program Files\WindowsPowerShell\OfficeClickToRun.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Users\Default\Music\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Program Files (x86)\Mozilla Maintenance Service\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Recovery\csrss.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Program Files (x86)\WindowsPowerShell\Registry.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\Temp\audiodg.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Windows\Temp\audiodg.exeJump to dropped file

        Boot Survival

        barindex
        Creates an autostart registry key pointing to binary in C:\Windows
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run audiodgJump to behavior
        Creates an undocumented autostart registry key
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ShellJump to behavior
        Creates autostart registry keys with suspicious values (likely registry only malware)
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry "C:\Program Files (x86)\windowspowershell\Registry.exe"Jump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry "C:\Program Files (x86)\windowspowershell\Registry.exe"Jump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"Jump to behavior
        Creates multiple autostart registry keys
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSEJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RegistryJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrssJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run audiodgJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRunJump to behavior
        Drops PE files to the user root directory
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile created: C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exeJump to dropped file
        Uses schtasks.exe or at.exe to add and modify task schedules
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exe'" /f
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSEJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSEJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RegistryJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RegistryJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RegistryJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RegistryJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrssJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrssJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrssJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrssJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRunJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRunJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run audiodgJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run audiodgJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjtJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeMemory allocated: 17E0000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeMemory allocated: 1B150000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWindow / User API: threadDelayed 1036Jump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeWindow / User API: threadDelayed 1124Jump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe TID: 2000Thread sleep count: 1036 > 30Jump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe TID: 2000Thread sleep count: 1124 > 30Jump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe TID: 6180Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, 00000000.00000002.2066178016.000000001C50A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
        Source: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, 00000000.00000002.2064405638.000000001C066000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeMemory allocated: page read and write | page guardJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /fJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeQueries volume information: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

        Stealing of Sensitive Information

        barindex
        Yara detected DCRat
        Source: Yara matchFile source: 00000000.00000002.2062107630.000000000363A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.2062107630.0000000003151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe PID: 6008, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Yara detected DCRat
        Source: Yara matchFile source: 00000000.00000002.2062107630.000000000363A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.2062107630.0000000003151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe PID: 6008, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
        Windows Management Instrumentation        		1
        Scheduled Task/Job        		11
        Process Injection        		233
        Masquerading        		OS Credential Dumping11
        Security Software Discovery        		Remote Services1
        Archive Collected Data        		1
        Web Service        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts1
        Scheduled Task/Job        		41
        Registry Run Keys / Startup Folder        		1
        Scheduled Task/Job        		1
        Disable or Modify Tools        		LSASS Memory1
        Process Discovery        		Remote Desktop ProtocolData from Removable Media1
        Encrypted Channel        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAt1
        DLL Side-Loading        		41
        Registry Run Keys / Startup Folder        		31
        Virtualization/Sandbox Evasion        		Security Account Manager31
        Virtualization/Sandbox Evasion        		SMB/Windows Admin SharesData from Network Shared Drive1
        Non-Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
        DLL Side-Loading        		11
        Process Injection        		NTDS1
        Application Window Discovery        		Distributed Component Object ModelInput Capture1
        Application Layer Protocol        		Traffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
        Obfuscated Files or Information        		LSA Secrets1
        File and Directory Discovery        		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
        DLL Side-Loading        		Cached Domain Credentials14
        System Information Discovery        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe69%VirustotalBrowse
        18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe100%AviraHEUR/AGEN.1323984
        18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe100%Joe Sandbox ML

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%AviraHEUR/AGEN.1323984
        C:\Windows\Temp\audiodg.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files (x86)\WindowsPowerShell\Registry.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%AviraHEUR/AGEN.1323984
        C:\Recovery\csrss.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%AviraHEUR/AGEN.1323984
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%Joe Sandbox ML
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%Joe Sandbox ML
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%Joe Sandbox ML
        C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe100%Joe Sandbox ML
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%Joe Sandbox ML
        C:\Windows\Temp\audiodg.exe100%Joe Sandbox ML
        C:\Program Files (x86)\WindowsPowerShell\Registry.exe100%Joe Sandbox ML
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%Joe Sandbox ML
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%Joe Sandbox ML
        C:\Recovery\csrss.exe100%Joe Sandbox ML
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%Joe Sandbox ML
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%Joe Sandbox ML
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%Joe Sandbox ML
        C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe100%Joe Sandbox ML
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe100%Joe Sandbox ML
        C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Program Files (x86)\Mozilla Maintenance Service\KryJcojekJhJNSUQWyfsXjt.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Program Files (x86)\WindowsPowerShell\Registry.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Recovery\csrss.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Users\Default\Music\KryJcojekJhJNSUQWyfsXjt.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Windows\Temp\audiodg.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe76%ReversingLabsByteCode-MSIL.Backdoor.DCRat

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        ⊘No Antivirus matches

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        a1066647.xsph.ru
        		141.8.192.164
        		truefalse
          		unknown
          pastebin.com
          		104.20.3.235
          		truefalse
            		high

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, 00000000.00000002.2062107630.000000000363A000.00000004.00000800.00020000.00000000.sdmpfalse
              		high

              World Map of Contacted IPs

              ⊘No contacted IP infos

              General Information

              Joe Sandbox version:42.0.0 Malachite
              Analysis ID:1587304
              Start date and time:2025-01-10 05:26:06 +01:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:0h 6m 25s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:40
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample name:18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              Detection:MAL
              Classification:mal100.troj.evad.winEXE@37/46@2/0
              EGA Information:Failed
              HCA Information:Failed
              Cookbook Comments:
              • Found application associated with file extension: .exe

              Warnings

              • Exclude process from analysis (whitelisted): dllhost.exe
              • Excluded IPs from analysis (whitelisted): 20.109.210.53, 23.1.237.91, 13.107.246.45
              • Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
              • Execution Graph export aborted for target 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe, PID 6008 because it is empty
              • Report size exceeded maximum capacity and may have missing behavior information.
              • Report size getting too big, too many NtOpenKeyEx calls found.
              • Report size getting too big, too many NtQueryValueKey calls found.

              Simulations

              Behavior and APIs

              TimeTypeDescription
              05:27:01Task SchedulerRun new task: audiodg path: "C:\Windows\Temp\audiodg.exe"
              05:27:01Task SchedulerRun new task: audiodga path: "C:\Windows\Temp\audiodg.exe"
              05:27:01Task SchedulerRun new task: csrss path: "C:\Recovery\csrss.exe"
              05:27:01Task SchedulerRun new task: csrssc path: "C:\Recovery\csrss.exe"
              05:27:01Task SchedulerRun new task: KryJcojekJhJNSUQWyfsXjt path: "C:\Program Files (x86)\java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe"
              05:27:01Task SchedulerRun new task: KryJcojekJhJNSUQWyfsXjtK path: "C:\Program Files (x86)\java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe"
              05:27:01Task SchedulerRun new task: OfficeClickToRun path: "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"
              05:27:01Task SchedulerRun new task: OfficeClickToRunO path: "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"
              05:27:01Task SchedulerRun new task: Registry path: "C:\Program Files (x86)\windowspowershell\Registry.exe"
              05:27:01Task SchedulerRun new task: RegistryR path: "C:\Program Files (x86)\windowspowershell\Registry.exe"
              05:27:01Task SchedulerRun new task: WmiPrvSE path: "C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe"
              05:27:01Task SchedulerRun new task: WmiPrvSEW path: "C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe"
              05:27:03AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjt "C:\Program Files (x86)\java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe"
              05:27:11AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WmiPrvSE "C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe"
              05:27:19AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry "C:\Program Files (x86)\windowspowershell\Registry.exe"
              05:27:28AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Recovery\csrss.exe"
              05:27:36AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"
              05:27:44AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run audiodg "C:\Windows\Temp\audiodg.exe"
              05:27:52AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjt "C:\Program Files (x86)\java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe"
              05:28:00AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WmiPrvSE "C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe"
              05:28:08AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Registry "C:\Program Files (x86)\windowspowershell\Registry.exe"
              05:28:16AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Recovery\csrss.exe"
              05:28:24AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"
              05:28:32AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run audiodg "C:\Windows\Temp\audiodg.exe"
              05:28:40AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run KryJcojekJhJNSUQWyfsXjt "C:\Program Files (x86)\java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe"
              05:28:48AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run WmiPrvSE "C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe"
              05:28:56AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run Registry "C:\Program Files (x86)\windowspowershell\Registry.exe"
              05:29:05AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Recovery\csrss.exe"

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              pastebin.comSolara_v3.exeGet hashmaliciousUnknownBrowse
              • 104.20.4.235
              Solara_v3.exeGet hashmaliciousUnknownBrowse
              • 104.20.3.235
              Drivespan.dllGet hashmaliciousUnknownBrowse
              • 104.20.3.235
              XClient.exeGet hashmaliciousXWormBrowse
              • 172.67.19.24
              ogVinh0jhq.exeGet hashmaliciousDCRatBrowse
              • 104.20.4.235
              hiwA7Blv7C.exeGet hashmaliciousXmrigBrowse
              • 172.67.19.24
              CRf9KBk4ra.exeGet hashmaliciousDCRatBrowse
              • 172.67.19.24
              dF66DKQP7u.exeGet hashmaliciousXWormBrowse
              • 104.20.3.235
              2QaN4hOyJs.exeGet hashmaliciousXWormBrowse
              • 104.20.3.235
              bad.txtGet hashmaliciousAsyncRATBrowse
              • 104.20.3.235

              ASNs

              ⊘No context

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Program Files (x86)\Java\jre-1.8\KryJcojekJhJNSUQWyfsXjt.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:true
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Program Files (x86)\Java\jre-1.8\fc3ef8bff8a8fa

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):109
              Entropy (8bit):5.429529251398624
              Encrypted:false
              SSDEEP:3:xYBLTBXDg2b7w2DfbDVA0Kms3fS3KAxrMPn:K5hDL7fmzms3fOC
              MD5:98FE65D890D4AECCCB8B5E703522A1AE
              SHA1:6BBAA3CAE2245344E15A414BA4103A4A374EE6C9
              SHA-256:1D34A093719662CCF2404FE7CF92B60DA6A939805225FE110199CD03A5B0702E
              SHA-512:16A8574D217C07D5C88DF0DFE4ADB24EE1B540ECEEC5A9CBFE2B9FFCE276006EAC267AAC4F414E58D3AD67FCAB186222D78EAE5D5B02E6E66DB991AF742EEC7A
              Malicious:false
              Preview:uJVyIagHopepdj53Ga6dBSULWFduDSKEKgV20bvy2NU9ssGcWBK2PJEczJcC6wDWeZe6OCCopHky7Udo8BXCIRzAc2Dr9s2GJ7eTNKNT8fNHj

              C:\Program Files (x86)\Mozilla Maintenance Service\KryJcojekJhJNSUQWyfsXjt.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Program Files (x86)\Mozilla Maintenance Service\KryJcojekJhJNSUQWyfsXjt.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:false
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Program Files (x86)\Mozilla Maintenance Service\fc3ef8bff8a8fa

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):175
              Entropy (8bit):5.654451632442291
              Encrypted:false
              SSDEEP:3:6gUZyMhJ9ZzdmBW4OdwRLBaQklXV5jIiVtiWNET/nukwUNxkYO8CdJW3bLYGwlA:6gUdh1ABW5wtBiV9lHqPukvq8C3W3vYC
              MD5:88DA6A83F9064A23798A260CA31F3789
              SHA1:0FACC33FA4E3624A9D1FAE73749C2ED09F2E20A4
              SHA-256:50E671B011E5AFA6ED5B75177053141FEF53E5495A00DEB9E88089827C30012B
              SHA-512:3DC247DFDBCDBC88F033D863C9887C97F4A8B913374CA23DD428C14B6BAAA688C8FEF68DB5D3B4DFEF028CBC5E293BD55884DD7B64DB96A7722BDA3E931A8E2C
              Malicious:false
              Preview:7CiJ2E1U5GqWg2Ff474gJya5cjFXOGCU6CqDu4e8odsdnXWn8k0RS2BJlnqT9dGzEVaeMBuAd62pF7SFMcYoQuCEBhbHOK8KX3YR72a6z0xVAVDoVlGhFcjUSVcpknvT7rSLiAHUBbyZ6qDpdxvmEaE4UE9lZvWLEeXSD2FUdvgnnJX

              C:\Program Files (x86)\WindowsPowerShell\Registry.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Program Files (x86)\WindowsPowerShell\Registry.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:true
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Program Files (x86)\WindowsPowerShell\ee2ad38f3d4382

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (990), with no line terminators
              Category:dropped
              Size (bytes):990
              Entropy (8bit):5.8980366075010755
              Encrypted:false
              SSDEEP:24:Rcq4RxtbUZMhSXpJCW5Om/xHm5hX01fu/gWHC8w9k:iq4R/UZ+8QeK10E/hB
              MD5:F1DED456E92A03D1F4B8D17150719A8B
              SHA1:52E9C336C5311E8A38B9152B8A75B49FD0CA4FB7
              SHA-256:4B63CE956C8E112179694F265F2A4B20E5435068A22986435EC0A80DBE02D089
              SHA-512:BC10593E19A6D7B94F64060BD4613A025AF8ABC198446D2F80BFA6779766BC1A72E2F7FFA15361E4D1E02E7677646EE942510C19851416F69BC1F05E32DA11CB
              Malicious:false
              Preview:88eyRBWSYu9mLAlbZHElKxLmt2YiMjFVEZENVN9wNQ0D1KiuymXJHVyLx2FYmxFzonhw5XGMIRX37HuiUoukL5Otk3adIlJaLAYNnwyafLBz75NpHgE8CfntZyMC7nEgH7s6sh5h0TEA4ZvopvVmhLYpXpyykwd2HerAMR6jkgIsbny9ChXLRc96iDjDtH7D0L3ZsvbXywBADpOu0yvCYRkpfubJs3zdiE2PtYRRF9Xfa832zyM5V4pikO47TSp46hb9x8Abgd7Z4FOg1iU3r4HoZTofeU8xUci2g3F0yuY16Pof9YFu7vNBaxjeTe7MfKFbgV97deE7gPrJpJfFPN0iPhctUlgTwMWwKM8oZHRcrPfKGayJ927RUgM93Qn27vLU348cL1qH6X19CSm3wWU3OEcnA8vJdZf6ELRLbW8HMzV7pM7kntFkaRFycUcMGhoh1550BacaYNrZte8xBKftT4fxGctG3vBoLyFuRGjMRpMNjpF7WpK6B4N7ZHuirVgmLDO4ZNf5kTcnsSOaWvuOlFnQkIVJVBf5JjBgbKiIJPVrckOG3UM5lRBGZ7UR2VjjygeIRs8LNlEVt6yA3OQByjU1i4Ge0QPxqw35FGzLWAsANpXcIUYoFiuPMnkXleV6VRp6C24xYFox0Uo2goVf2lsHCntcfck2pwo5AbaQalPA36Y18r07I0Dtjh3YIbR6ewIEps2FNEERVrOGO2dylntys4WchBI8TSfHxUMQyvtDvwY1TxJQ7cV1CTVuVahM6G7CMHS4pNA03pD5gfIu11A17nEe9c4XNgHpzVpMfPkucf7XQaN0SxVEFGEiCy4NTmmXiYGLz5PlQQYcqrNjODEZLCksQHJqUXb02ky2TCAXityyrm1VkV8PhMMgxX4sviQ3zikG2VPMCr1bOvBoPyG8ZLSpYRE5HSmAc49JBvdOGvMzVuSCWQd7cRdnP4rlRUEuF18Tv2mdV12n9cUn8Bj1yp

              C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:false
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Program Files\Windows Defender\fc3ef8bff8a8fa

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (681), with no line terminators
              Category:dropped
              Size (bytes):681
              Entropy (8bit):5.88253000602819
              Encrypted:false
              SSDEEP:12:ZfL8pix45pQRky1FFkFohjFEApDxsH6YarsaQPfMZiUQpTB2A9YRUjXt0V1gRRn:hx45p7wGQjFpHq6RsDfJTD9YRKtsi/
              MD5:A8061AB0C524895F461447C2DC894E0B
              SHA1:D46502A7313FC0D5B737FACA2A520FBB960B9646
              SHA-256:55B1E3618A26A48CB2F892871C9C4FBA27B91671144EDB625E3A1FF84ADDFB2A
              SHA-512:9BF530CC87FB20026DD78A55EA2457EA5D51784E2DE8AAFF5E025F6FD0B50248DAE1A9D138D0B7278EFC102ECF35632E8413F9F59535A7136B9E5243BDDD3492
              Malicious:false
              Preview:j8tV3CJOtFOZGnvlc6wQpYY11CsfAW7MSmE1QKKd35YQtcTgB2lOZOALj2e0ToNWIBHej3VSwSWuAIHYtMdHusxDl3SXqTJOrBHrVz7HgTcG2QLavFHGKFmaOD2pl8lcIHC8AaD4PWlaPqLUs1mkLDElZrcR6Rfis97uOMaUCM1xeLKi2h7tWBRFDajS7v771CsQsaGfbRh9LQHNh3YYUvMrs2qxmHWQO36bd40babSEdS3xTWuEWjnF0BhzuT2T4QuSTptnD772dHNa83dQWS4pQ1lbWArHi9JMhleomHBZlumsxG11zm6mWEBbDRRCQ0Te8B2WYznPReDfP2oPJ0R6ChzdjCkU08JvbHuwOecA8rU2AfMLnB2aiXbaLZwWOSYSVSEHI2BpXQ7UN7cDzZryGtMEqTkyrFwpSBgsbFCvANCSZGNO6thzlkMlFAbzRM7SeSCLatmuW5y3r4ojFW28i7Dsz5nanNeyPtxGECxNGwcqvT4KV2t5U9uhOUVfFLGJbAn7HieDio1veX6gAdFvdidQ8Q2uqSH4qSOvp6DxXqWpH9C0XzemGUp2gX81puWQh6EMJL0DZRXxMyI9NBX1xeyVmVOR7MHnTGIK40rL8aMy72qsP9nnWfcCItjx6jFNJudGp7EXUL2WR9YupgC8ieQynFCLQ3PZU9pMY

              C:\Program Files\Windows Multimedia Platform\24dbde2999530e

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (680), with no line terminators
              Category:dropped
              Size (bytes):680
              Entropy (8bit):5.862168374578988
              Encrypted:false
              SSDEEP:12:2/n/2UlLf6FHeGzunAbXOnKPHKQhQgfTLyD4uFEuJAVgM87yTykAaSj:AnOUl0QAzOWqQWCLOQVTLTykA3
              MD5:77B961EC253C98CDE12469F0C6763F76
              SHA1:ED769BFEE44F27DB36AA81ED90060EF43327E7DC
              SHA-256:8A36CB776A1AB16B7C5139758DC6D5CD56F225EFB64A3E946CB910C9BEE773DC
              SHA-512:937878631C7A5DA68C303C89D40AD6C48AE21A8384BEE751E3A43E4CC4588B2A58E17858ECE38820FE731B57880B2C402D27804B73C2C50319CFEEEC87528F25
              Malicious:false
              Preview:Pfr65YMBMrEBZIk8fBivgT6AeqHhiYm9VAZuF8Uirv9cG0Bfzuq7IiJ5ircOQpcyEEqYs03hqADuUe3oomsyro1x0eLXfGSCSLXCJnw81JQIeYkDyyjn6oHaN2hOofBkrBbJH1eBzt6hXtTc3IirgoFoE6yRFiUVIqac7b67UiyNsjCdjFVg6TED6xFKCN6RZkZrT0fcMlX8025e4Ur9NxYymWgJVv4HlgxHKVKtk2UV6FND1lQrf6ElMkE6TVGarQWTEyTiK7YUdD2gIcRueMlpbM5kQNZOv3nqt38DRrhiiuHIsix0EW6epr122tS6iJikZLxPeNcwpDGrEx1rZiKZ6JBCCGKhZl9YLgsgviW03JzlkJxF2kg99JnQKvMXD5XDDsghEU60LTfxTZb2SEpyE9YB2bV9V8x8vvi1nPBhnpyqo07vTUF8Pj9DTfom96eMfgBh0kOCDIKYLsXCekqB3ztMwehIkZhrKlKHzZ5tFC5GZl2lImIYQdTqxzvVCGbokdNkiPMEp7514mxLm6A8QJarSeTAojq8kRg5XRC2ZDtSibvLBktFGdXbCgSD5MaGQ6QnG1xV3HiNZII0sI8E0k2H3E30986NnnClLIFKwXM95JB4XcVxOWPpEJtB77V4KVkwGhokDyRcY2LuC9chnJ9RXWhCYDMzCRyk

              C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:true
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:true
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Program Files\WindowsPowerShell\e6c9b481da804f

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (527), with no line terminators
              Category:dropped
              Size (bytes):527
              Entropy (8bit):5.881830834679637
              Encrypted:false
              SSDEEP:12:rB5mjG8Trnx32V3Kgle3U6Aw5PfI/WpPsx1qOhh:rB5X8T13u6b3U7w5pwVL
              MD5:CAD2F685D199E8891958D3A86C344334
              SHA1:254D516CD655602154C16384A0076CDAAB585EBB
              SHA-256:43B442128ABA8F5E4CEC35614E2A744AC5A68704F7B2241EC4571B929581B7D3
              SHA-512:6B7171E156AAF53DE64C4468DD50F2C7FD39ED4450AC71B801E23B4F3CE15C254DE5FAE09401CA643D6D60FF7917B3CCC76E48984907758D381492DD8E1D99A4
              Malicious:false
              Preview:lKzX2avRLpSmFvSmUDWgQxQkBLRwFiXfqG4yvqRsfAyapoVdXk39ocQy4PVrI9MnRx580d0ovnBP804X0yYeoY0O0F3gUkkfxLI1sWn3tPNBbAzEU80Uks836rIukUUKCfbxsCoeKfuZKzwzPzLVuQ5FMO5BO2TZ5D86iCWRUWJF7jsH4SfuJ8awjWldHmQSLVeH00RNd4BYH0InfxG5XjP6mMWMb2JrF03lFlQDBRRO7BotN78TfU5mGheoeEwkuTSQ6hi4hD4FRA9lhn8d40Mv5RfiGlj6eqeotYwqZEwcazUFh3H1GTq4GhVpB9x5d7klgV1J0RD0DtUF7aANes0L9khMCHoZQ08dOsiMB7AyQ00XMPsl9jbvGZl5xpGtmnjNu11O1yLhrC5JuKAxYDaqYNWzHnYW0RLmRmmUYduLY4EEdbLnpTUjM2yheBGOZyqZ0S2HipY5SPSeISVpburh7lZYxE0WWgvjNoOLjDF94ZR7jUZMqbwpHIcO2dUdzCiwdsQeDKGXorm

              C:\Recovery\886983d96e3d3e

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (858), with no line terminators
              Category:dropped
              Size (bytes):858
              Entropy (8bit):5.91489185683446
              Encrypted:false
              SSDEEP:24:oOYd5N2dFpdNip6n/Mv2VOJOjl+qnZPsJH:oR5NWFpa4n/Mv2V7l+qnZkJH
              MD5:59D57A657A98BD9D0E68845CD630263F
              SHA1:6A799005885D5F98CABDB8DAC4F7F632359C71E8
              SHA-256:BCBFCEA1B6CB6F3C091D0F9468BE3BDD5727CC1DF8F2B75CAB66A18C5585335D
              SHA-512:AE740B73D86D31826D78670582349A516B3734055160D8CC455E7F3BB8C1133C1B68701CD5716052ED6DE293E1FB41D82144D90819C62EB21A360EA04DF1F94F
              Malicious:false
              Preview:MmWU68sk4yeFSr8QSsMMW19lT2isq0MQc8xe8eRm2TbzVdOfQ2huwveUmuBEZ93DlNnU3eRxajTCZKQznDcySbdrdd1NdNN2aYNH03lwltTNbc5beLaVhFvKu61amEUNWbmB7I8ucpMiHQPBhasRw2UVmCX4BLJhZG0Az4eVMq312MCdq02MVCbeGRY4vEsQgpJBZPLn5WFF8ccaA3NLS7LXpW3hfjkI8mVMCBDboPQ87Vfny7420g7jewVDVoHVw6HVHQX8zwhDqNZU0QshpsRbpwrQpAFAH5LANJghj5CE942RWBMF5jqEppqUiHTzrg5uBYGrtK8upNcu3a3ny9EhPHVidM9cmNWc8IP85fVul5YbN5aINpBrcXf3CiNhLfHc09wvK5sSoT6Ts4Vhw1O6LpAkmW5XRyjFx6kNJo7S7sDIbMLIMquURKQL9LJy9VBzu0fwTIXH359dm1IaKwKlDOxnpZN8eISlrNXkqYzESmaVKxiHCtnNKZvgD2G34ZnvnYvYditw7FSaxcc11F5veFbRc1hyR5K39oswCKoe91PEHUskaPCyd1Rh6d5lA5eB5YaItpzqbbvmzWJHJ6YC3VZIXK0iOCdEXNJt3j0uaVXCFosjUxcDgbIk8SvjyQcZ7rPmNaOkFnmh8XDtcQOajZh6FiulyR5J38FYZGW3j273ylmlPCHiCBzhJShopmwyrdo9SpTW4U0rcnHd6JWvKXG1JhOGjrO6GJMV7mTksuosKHFgLDsfQAoTWw0uaMxNG4lSbwgU0vDZtYqBcs5f9spGf28KwiJg7blQgwEZgXpf7Ok8FySsRRNXOfxixViRmgcSwafpng9lDKJRSAF7Qa

              C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:false
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Recovery\csrss.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Recovery\csrss.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:true
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Recovery\fc3ef8bff8a8fa

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (677), with no line terminators
              Category:dropped
              Size (bytes):677
              Entropy (8bit):5.9079363863772905
              Encrypted:false
              SSDEEP:12:ErIhl53tTq5odMGyZ6oFPGBRKYB29cvsaRpeZHuOjTu37dgKw4Cy1:ErIhl+58MGlo1GrBB2+vrRp6Hnj637dL
              MD5:FA05A75C4CB019D1C64BA5478FCC8EB3
              SHA1:EFEC86334B7F2D5EDC79357E7454DCE77BE442F8
              SHA-256:CB804C2B8563BD878C72C1AC6C7CE1FF73E28A76808E2D9ADB6B091549B34F95
              SHA-512:0F6325E2A742FE90B6532E7E70E0B89C0884A210794E7CB3EB6EF7E667AD00716C6CD037EC893140C9DB324F2362AB5F5262C1FBD228718167F964819E031884
              Malicious:false
              Preview:5tGcFL9SFtlK21fd1D4IgVYAZg43ao0yLWmCXQLSD1AoCguqz87aueJkVGCiQG1a2x9fOdGk1mFoUu73vOEcqaDrNCrQOmB7AjvPhObW1XiHZePkJIxCBYtctRSMwzVOlHov9rVhwskT15SswGHFz86lzSfP6PkBBUgS0ekbxQQTyaky9jZpsQYmKC5qMFlhIjRgZ92SfqSjsnxZrrQWz4Tv64Hyj3PrpsLOJEY9rHJC7y3hOg8ezOrNQgke2Eslbl49bjQnSQorvRxHAjjC5u1aB88md4HnYhkW43GpQVMik9c9sdeTeqqqte8dknKYJBSNqaMGd3wjhS0Bg949axIs03na4mFnKyZirOTRQXzl3HJao77lsK8V2jWwxwL0yJZt3RTRqmtC8hztuMv7od4AzDqH1gdeL8wtsZhXnq5Gb5XUumBlBOMUPY3zkMZJIP19uFBVoYT8ixj4qVWOf2d7wbeTfswaQw7MEYkplp6m4Nwbz9JO0KnQw4MSksz6l3svzWzSvrnz60CipCdfjikFIraKLRE209ABfAmcJ1dJhyT51nniOTXDSnnI6pGemv96zADoaAWsEbiTXeShngngm7t2Xdgdu9gwzXF0j9HN7p81ETucXi0GHdU2RLQ6e27F4weAYb7oYai681xDtDGLIZoWDNiYtLsEr

              C:\Users\Default\Music\KryJcojekJhJNSUQWyfsXjt.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\Default\Music\KryJcojekJhJNSUQWyfsXjt.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:false
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Users\Default\Music\fc3ef8bff8a8fa

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (312), with no line terminators
              Category:dropped
              Size (bytes):312
              Entropy (8bit):5.846672251408959
              Encrypted:false
              SSDEEP:6:quxeyuEh+0ruAvol0MCb9cCnTXWVLkVPwfpBdIj/7vGGKXubgXPTLAE:q+eyuC+ZAwtecCnTXWVLkNw1IL7vtKX1
              MD5:52BBC743712DF62D1792DBB323833327
              SHA1:EB4541EBBDAAE78CC2B3322D8B4EA2880B19784B
              SHA-256:B7F9F77252A331524DC5DEA6C7552CC6F593559134561CDDAE2048CE5893EB23
              SHA-512:25C64BF881296F936F2030C32AC65CFC7F9B93A8513BCAFBC69882196656D77861BBDB9C9CD748AD912F36B9AE3F2EB97660E1C40C6A8982CF5C8FB23617904A
              Malicious:false
              Preview:3bQLrWTmjjT5Q0ppAmT8zRjAy5TgLkFb95nLGqwoMTpfTZLcF6kFHKcm2QWvDwa8e26UMeiUzpvglDrYu1bOAAUycBT0TAlZ2rBad1PkXQPcY6Byi8BLUM8diH1LKsByDWn3CR52m00uu1Zg9fSV9aEqth2W9EapOaYCSHvRCIjdVNtqrVLpZqznS7KfZj3haLfTdXN2tBS00kUfxLon2uQilvuU7Q2dOBDKsZNUIT5YX8wrnprN4Qpp46ssn34dJylzhJxY8Ufjz1Km8CqSjoi8WXPvrfqOYcPjX7Kd1TPkuG0DvFtkMm4e

              C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:false
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Users\Public\fc3ef8bff8a8fa

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (597), with no line terminators
              Category:dropped
              Size (bytes):597
              Entropy (8bit):5.879227777115892
              Encrypted:false
              SSDEEP:12:doe7Dsq7/yHnITqBwvxJKJppmtHcPRVyHm21poiGPB1AOJXK:qeEq7/oITaCx4JpsJcT+p1pahhK
              MD5:EE8AE6B05237602A2878854B96618663
              SHA1:F50EE75DD030A81E8CFBBDBF0A555C1B2BBFDCA5
              SHA-256:60D9D313C2A7DB59F72EB03C95FAFD4389270879E855A9656FC9BC96988675B0
              SHA-512:ADC84BBC657FBCD47002C4D7BE7191E550C9CDB45809F5E89FCF5845F505E960B4E3D99079AB76AE6117A26E198CFD738E666309E0FB962B737A3DCFA0C05601
              Malicious:false
              Preview:Msq4X3aYMNbwv7fHI7K2j5NrdOG5eO9AKk6r7bpUI9g8RS65bLqw2DBRf9aJxe48NamKAxJqS0tjYPZLSKeSiMHHjpM8BggoFhu0qv4nC9eBTb2QjP0nAlZATflVlKpwUFe1ejehP0QjsGxIx5Zwp3oeIthLKjB1TsrO7BvAuTXJU0SNrcipv3Gbb9tuBTWpyZP9ZjLwJYCVgeJRbUdrBVFalQw7SB9a6rU5lSyIRvgX0v460bSqzoocTyXIwOeIZlYyJOqJgVaPzsj0VzG0sSlSD1lw4pVCRX7PXGxmvJJdOYnlPhx6HnaGAGuSm3O19X7cuUdOCeEiIHDpOAhW1Z5o70PQVf925Se0aL05Ej4mj183CFDmW1AkcTf4EM2hfMn0nNPDKmSReSFF2WOQbXfDR3YGp501qWHWOHQz0ActjsFJOaCs8mFHqjitzIXOwakIKs0uGYab5weixO1P3H3ER9ppjg9rmN7IH78fjRmjMoM4F95kQHUphg0LDLLjYsyryVa0PVqleT2nxujjkZae2SklGxcYGDKdzeGtjFV5btKOnNYSlm89RTygvztb3RfbIYxSo0AfDfDJHW82Z

              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe.log

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:CSV text
              Category:dropped
              Size (bytes):1740
              Entropy (8bit):5.36827240602657
              Encrypted:false
              SSDEEP:48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpaHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpaqZ4x
              MD5:B28E0CCD25623D173B2EB29F3A99B9DD
              SHA1:070E4C4A7F903505259E41AFDF7873C31F90D591
              SHA-256:3A108902F93EF9E952D9E748207778718A2CBAEB0AB39C41BD37E9BB0B85BF3A
              SHA-512:17F5FBF18EE0058F928A4D7C53AA4B1191BA3110EDF8E853F145D720381FCEA650A3C997E3D56597150149771E14C529F1BDFDC4A2BBD3719336259C4DD8B342
              Malicious:true
              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

              C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:false
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Users\user\OneDrive\fc3ef8bff8a8fa

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (370), with no line terminators
              Category:dropped
              Size (bytes):370
              Entropy (8bit):5.83777531069147
              Encrypted:false
              SSDEEP:6:QXk7cOdtkdpBI7bfDAgDUtDbYNueiUy1zultCjPhcqV4fQDAvSm3YTqBT75mwRoD:QXkZcG71uY8Vhz+4KnMm3Y+BT76ltCxS
              MD5:4E3D32E3B1F313EA42564851A8C77BBB
              SHA1:73F86EE37E7620ABD90683AB2FC8B229BB7E14B8
              SHA-256:61A3594FD73A8924A5F3192060BC84FC1977907D9AE5CCAB6A192A6ABDF11C90
              SHA-512:C3EEF77258C239EC8FA851E94E9C3F7E84A022E2D21467555FBE8D62732292D1267BD7006B9E86774E5108215871ED7D005A4B9ECF086EA343F3A7F6CADA7401
              Malicious:false
              Preview:VcNWZS2udBTlrlbggziYIF0DOnSiypoIW2rdRoS8KGAYns2sTP8SEgNPmKHw9T5xWLOz37P2gkOCFbZgvkPjrWE0oc1Hgg80LMCcdCyV9GvdSLJKulAZEVG9HYKbFIVAlX12Y7Dsv3kklkidSqW5gjvzGCVE1WP1uu24TRwxhRnLvgYg0rJZvaeCmCwVl81Znsz0snJA4jXO5kDjoyOKM0GUQzSRfaLjaOhDqiyMiIeLCPGB9MrxuqMwmej2V1feYyyrC93G9CmEW4SBtQSStXytCuaM860qnAxOaY89TlxsEIarMhIFjNuA9EpSjrHDL6aVHDkURT9HjGp3Ut9bxvGaPwOWtqZmeugIrEkI7xxPOna3Zv

              C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:false
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Windows\LiveKernelReports\fc3ef8bff8a8fa

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (433), with no line terminators
              Category:dropped
              Size (bytes):433
              Entropy (8bit):5.819391086179873
              Encrypted:false
              SSDEEP:12:wygaiNfa915o3NOhmcagxFBfktF68f0kq3:dB+fmC3iragxTkjY
              MD5:831C08CBB5D027D4ECBC1FD29D433D27
              SHA1:EA6A19B7AB3586B565D3B407E5E1B76E398A01B6
              SHA-256:603D9634770E2CC2A5D17C9A99ADD711345DB2D41930E1E3762BA991095F68E4
              SHA-512:577A28A8CCBE33FA19C6B342AD9627504AD9BEE2F11CD4EDC48DD93EB29099A7880E2D463D431468227084D512D44CC6C56CDEB9BEAC6696CE85FC441BA35D45
              Malicious:false
              Preview:mrL4kxRxo3Mx4zcasPh7EwCVnIJhPzrsLEjJ6IqyCsYyCB2cvGOK2uW0p0QbouizLem0QTekis5VXNSlPrvJkhzbrteG1OKSKjmiZBLbmomJzBcbipM68YOooKIgzYtUhnKyktLOfUg64pmqRCiLCOTvU84O2pmO5SmL0n0yd7ao2St8icPw0hRTTZdmz7W0rSBmDa0nMtsExp3CO5qaazYXAS2aJN8glk6jQG4IllkGzMfofbY3Q5Z24nmuiZd8uLdMsUvHAiyyPRixwN4szFPpKEoneKjLHlVotS5LpQ3sHlmmFy7UfvIp5xCopIn08mrn54EeStCjLhijbChpMPqVdqs5QRghmCue39qLtdBvsjdXPcMnk8os6VKPLJNBNf7JxDpcVW5sN5n3MUpxE36nYBiizb9kQAiNlUkLwuROC6eBs

              C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:false
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Windows\ServiceProfiles\fc3ef8bff8a8fa

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (476), with no line terminators
              Category:dropped
              Size (bytes):476
              Entropy (8bit):5.852733063250957
              Encrypted:false
              SSDEEP:12:RATtlSNYCJZp1+zxRjzU0R5n4SsJWWrvOE86rfKMtWv0UV6UL9:+tlEj1+zT7r4ZvrFdrfKR3h9
              MD5:9C306DC62F23B5BAD68971E1DB56875B
              SHA1:9628904F181FC1220D61C061C6B668677C8D4C7F
              SHA-256:F52C7F4149B721298285A8A27475FD32402370BE17DB4D3428F1DCD089900F89
              SHA-512:B71161134561DB11D9361B6027A3E8F1F5B831ED8BE6BCB3897D5617942FB6E7AFFA13C4110F5FAE258A8220BD3797B4A52A7E60BF31DD3F98ACCC4F8CE7788B
              Malicious:false
              Preview:nQKXmlPB2NaPZ8NQhM9lvGCviuSueAjzmw6e5daK0ss8MoFRZMmrCErhNYy1Seg1nlnnBtUDvzvDXDj4pAVRX1whEYQgoi1VL1VlAcQp2i5NToKJz4MRJOdvyFimcxZN7Z1gs83NupZz6iOZOHrtVjM7Xjw53nNFJsQ3xoa1B9hdzozQ0JYVGp1YM3IIL7UHcTpNSUmkqzsWCtHsufEtP29d01r3fSpDpaAf9l7ghxoQ7eWdwaYp3k1kUMXansFYKormsltIiiMbNsfVfNHF39KEiaLwOg2ysQGTxuvKqPHUXaXlqB5al9eKdnDSa64BqXt7mMiuc6Yn20qICjGMlbNsv6zKqcutUGnAqZ9dcK8ol1Sn65P1zsaOJAMqWYE9MoTvMqbnkmtadiH3nMNvM23mqZ0qNSHEG8c6igaQdmRN89ul3SCKKTwTvqFxzvaRfpTfGLVHv7RklqoqoPx4P64xLJL1

              C:\Windows\Temp\42af1c969fbb7b

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (399), with no line terminators
              Category:dropped
              Size (bytes):399
              Entropy (8bit):5.8295918074258894
              Encrypted:false
              SSDEEP:6:w9OJfwCtHCXJH2MdK1cKrcb1JTxHMt3SusTJcTykROLiUPyrCdSc3PuOpg:Vf1HCZNK1c2chvHM4usKJoLUJGWAg
              MD5:748E52B979EC55B0E6D2B1709CA81E37
              SHA1:AE9D3A6923CB8156665AB4B54EB7B9B93C6CB504
              SHA-256:3112BEDE4DADBD807EF6385DACE3BBA4969E18A8FF4721315E6E84E42F4FE928
              SHA-512:F1D52A3CE4CF72FC5F0A0ECE3DEDD2D8755ADFDF6532AEB46A798039CDB5D4C17EC734546E2CA4C56D8ABDFFD6A4EEE7A6EA6E6166D97F66096B4FBD7DA50BD2
              Malicious:false
              Preview:BONjddW9Vo6Peo90KayxEDmErbMXiBLo6rItRttq1Tm0R2ElfofXQIT7lI1CR8bUdSSwgQiarH5ubvwzWk23fxYyXKHI2rY22SW9jSFOGFqIMjg0VBprGiyq3eYWJaiAsD2IZxQEfnxZGPmynRw0BrwUdqFF3sFphqZJqXaivlMcuYjn1ks1nr8BQipsrLLwiH2a0dHP0OEafTjEHcNS9NCzrY2Iss0jZZ4ngIxYcdBZmif69llP82wUFCsbk9hHXeAFZ6h8oy0gMnMJ25JHHklhnjidaVxd63BIiahCDmlJCPIb0jjpzaAx3cczYEiTBWkSlEkcYGDe9cfXbGn0wInf2NOF8ro9ESHppzzv8GRtWgya7FYRasg3tEZYzfeqbEZqV0rlQ21p14J

              C:\Windows\Temp\audiodg.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: Avira, Detection: 100%
              • Antivirus: Joe Sandbox ML, Detection: 100%
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Windows\Temp\audiodg.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:true
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Category:dropped
              Size (bytes):846848
              Entropy (8bit):6.074943837486376
              Encrypted:false
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              MD5:C847A23633E81D799FBA45BDE7CC9951
              SHA1:090035126CABB2FB574175C271097042025202DE
              SHA-256:18E568EB4CA89F8A3E4F04B1EB15472B55B4548F4D15367377A7B942C259319C
              SHA-512:6B057E15133FE58BC1D105A90B761D2F3558E8A8D3A901D9892905DD75F6BE569A4BFF4A02D919623305C4D524D96B7F902EF3DDED6782CC237B1A47807F34BB
              Malicious:true
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 76%
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......^.... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe:Zone.Identifier

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):26
              Entropy (8bit):3.95006375643621
              Encrypted:false
              SSDEEP:3:ggPYV:rPYV
              MD5:187F488E27DB4AF347237FE461A079AD
              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
              Malicious:false
              Preview:[ZoneTransfer]....ZoneId=0

              C:\Windows\bcastdvr\fc3ef8bff8a8fa

              Download File
              Process:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File Type:ASCII text, with very long lines (864), with no line terminators
              Category:dropped
              Size (bytes):864
              Entropy (8bit):5.8968769454184855
              Encrypted:false
              SSDEEP:24:IqFsxTYTIQgBagK4RtQl/IvHcbYH/2qQ+3mcX8:LixMHgsIEbYH/2q1Wa8
              MD5:F76A704D4BB411921F994C4F1D5A573F
              SHA1:24B268FCBA14E7CA17702843BF8BCCED0F0ECE0C
              SHA-256:ECB7E2BB3C778C6E5D445B08E21C534C54508754AB608A1475B28B0101D6F1AC
              SHA-512:5EFCADC574194B1B9D8BE9EDCA02282909A1A973727DD6CA2A28BB92655AA2980F9AAE2C636A3F418087C55EAF301208C67624E774447FC763BF4BC8D5D5E836
              Malicious:false
              Preview:6wrbudv9Qdo9mkY0nwkDmQuN5aTx2Z8fZd4G6hs029uFNyC6wksHhAOqBdfUK7G1fJkIqR4GEtLnfpAHXWBSr17ZOOFcBXq423kEO4QeplCxylKWdY7x6yKnLL3cMbEqDRvmE62cGhmFyJknDs9ma28Dt62DAyRNhWuhziRgferZLFzBkPZdcbQKTr3IDzcSPYicYDyebcG5Li1oH1cuYyvFFkOIpJdqCYJxhWmgb4CAUU8uzOBMWr3bncXyzpzS9a3xZEHvO6SevvuuleSaIQUUfsJE9yrvEuB4bLUvHQ8aYYp2smMVXZKsGiRr5CvZOgZBu0SaJhS1S35GCRWWlWYpkSx33nzFeiL18oI2TwM0GSZMmLooqZy2IubbCZgfrNXurDHYIeCzKijS3lQs8LYEuTtOMrz4QqI24oeiDQfMW8rkKJhbJygfzTAYU2LboIjdZqXOGrosqLrvlIEDJYubJmDkoGOLFEiOZOKevTUbKyznlOxLyIRPXHUwmxj9ddnlndVX8jR0DTRVxa8aTCW6wS0R4Y18tU8qLN9I2ZNO0aLEz88MyJqbGqzUnEdjsTHtUkKka0h3yHFWHvb5ZpKjohkeYpfy6nghTcuPyYv7mxm9kdN1mhKDIiExApMvUs6LkiCpBMGA3M605k45cnMYcdYuX6OIMAn30bYCai0ZbKJ6lO2ZvQTqgisHJRRE77x3jCAdM1f3xx7SUcJJEzX5q6XStR2IQwbdWPXiNYN3vZ3skZxqIIAIk1Mnosu58WnBVd5EFl5pldJRCprTdM9IvS3eCt3fnS4Zv2XGetlhMUhGs5k9AbbwWfPDkbBVrZCTjufKRkzukc5bvwwHI3eM0ICQmUgC

              Static File Info

              General

              File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
              Entropy (8bit):6.074943837486376
              TrID:
              • Win32 Executable (generic) Net Framework (10011505/4) 49.79%
              • Win32 Executable (generic) a (10002005/4) 49.75%
              • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
              • Windows Screen Saver (13104/52) 0.07%
              • Win16/32 Executable Delphi generic (2074/23) 0.01%
              File name:18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              File size:846'848 bytes
              MD5:c847a23633e81d799fba45bde7cc9951
              SHA1:090035126cabb2fb574175c271097042025202de
              SHA256:18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c
              SHA512:6b057e15133fe58bc1d105a90b761d2f3558e8a8d3a901d9892905dd75f6be569a4bff4a02d919623305c4d524d96b7f902ef3dded6782cc237b1a47807f34bb
              SSDEEP:12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz
              TLSH:0505F801BE44CE51F0191233C2EF454847B4AD516AEAEB1B7DBA376E59123AB3C0D9CB
              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rb.....................6......^.... ........@.. .......................`............@................................

              File Icon

              Icon Hash:00928e8e8686b000

              Static PE Info

              General

              Entrypoint:0x4cd15e
              Entrypoint Section:.text
              Digitally signed:false
              Imagebase:0x400000
              Subsystem:windows gui
              Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
              Time Stamp:0x6272A3D7 [Wed May 4 16:03:35 2022 UTC]
              TLS Callbacks:
              CLR (.Net) Version:
              OS Version Major:4
              OS Version Minor:0
              File Version Major:4
              File Version Minor:0
              Subsystem Version Major:4
              Subsystem Version Minor:0
              Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

              Entrypoint Preview

              Instruction
              jmp dword ptr [00402000h]
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al

              Data Directories

              NameVirtual AddressVirtual Size Is in Section
              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IMPORT0xcd1100x4b.text
              IMAGE_DIRECTORY_ENTRY_RESOURCE0xd20000x218.rsrc
              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
              IMAGE_DIRECTORY_ENTRY_BASERELOC0xd40000xc.reloc
              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text

              Sections

              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
              .text0x20000xcb1640xcb200eac07310cc9c3c3149359cd3701f5294False0.5063942307692307data6.114881113620842IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              .sdata0xce0000x2fdf0x30004f8b5452697b28c56801fc7675a91934False0.3099772135416667data3.2409602076007977IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              .rsrc0xd20000x2180x400a0eb98cfbb72fea7cf0984384d7b3371False0.263671875data1.8371269699553323IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
              .reloc0xd40000xc0x2004f5e72608b9753d88dc8259a8859568dFalse0.044921875data0.09800417566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

              Resources

              NameRVASizeTypeLanguageCountryZLIB Complexity
              RT_VERSION0xd20580x1c0ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970EnglishUnited States0.5223214285714286

              Imports

              DLLImport
              mscoree.dll_CorExeMain

              Possible Origin

              Language of compilation systemCountry where language is spokenMap
              EnglishUnited States

              Network Behavior

              Network Port Distribution

              UDP Packets

              TimestampSource PortDest PortSource IPDest IP
              Jan 10, 2025 05:27:08.535607100 CET6493853192.168.2.51.1.1.1
              Jan 10, 2025 05:27:08.543229103 CET53649381.1.1.1192.168.2.5
              Jan 10, 2025 05:27:09.593446016 CET5491153192.168.2.51.1.1.1
              Jan 10, 2025 05:27:09.684272051 CET53549111.1.1.1192.168.2.5

              DNS Queries

              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Jan 10, 2025 05:27:08.535607100 CET192.168.2.51.1.1.10xae72Standard query (0)pastebin.comA (IP address)IN (0x0001)false
              Jan 10, 2025 05:27:09.593446016 CET192.168.2.51.1.1.10xe5f0Standard query (0)a1066647.xsph.ruA (IP address)IN (0x0001)false

              DNS Answers

              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Jan 10, 2025 05:27:08.543229103 CET1.1.1.1192.168.2.50xae72No error (0)pastebin.com104.20.3.235A (IP address)IN (0x0001)false
              Jan 10, 2025 05:27:08.543229103 CET1.1.1.1192.168.2.50xae72No error (0)pastebin.com104.20.4.235A (IP address)IN (0x0001)false
              Jan 10, 2025 05:27:08.543229103 CET1.1.1.1192.168.2.50xae72No error (0)pastebin.com172.67.19.24A (IP address)IN (0x0001)false
              Jan 10, 2025 05:27:09.684272051 CET1.1.1.1192.168.2.50xe5f0No error (0)a1066647.xsph.ru141.8.192.164A (IP address)IN (0x0001)false

              Statistics

              CPU Usage

              Click to jump to process

              Memory Usage

              Click to jump to process

              High Level Behavior Distribution

              Click to dive into process behavior distribution

              Behavior

              Click to jump to process

              System Behavior

              General

              Target ID:0
              Start time:23:26:58
              Start date:09/01/2025
              Path:C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
              Wow64 process (32bit):false
              Commandline:"C:\Users\user\Desktop\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe"
              Imagebase:0xee0000
              File size:846'848 bytes
              MD5 hash:C847A23633E81D799FBA45BDE7CC9951
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Yara matches:
              • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.2062107630.000000000363A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
              • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.2062107630.0000000003151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
              Reputation:low
              Has exited:true

              General

              Target ID:2
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:3
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:4
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\mozilla maintenance service\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:5
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Music\KryJcojekJhJNSUQWyfsXjt.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:6
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Users\Default User\Music\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:7
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Music\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:8
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:9
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:10
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 11 /tr "'C:\Windows\ServiceProfiles\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:11
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:12
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:13
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:14
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windowspowershell\Registry.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:15
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\windowspowershell\Registry.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:16
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\windowspowershell\Registry.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:17
              Start time:23:26:59
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 12 /tr "'C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:18
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:19
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 7 /tr "'C:\Windows\bcastdvr\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:20
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 7 /tr "'C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:21
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:22
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 5 /tr "'C:\Windows\LiveKernelReports\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff6d64d0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:23
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 14 /tr "'C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:24
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:25
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 13 /tr "'C:\Users\user\OneDrive\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:26
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\csrss.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:27
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\csrss.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:28
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\csrss.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:29
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:30
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:31
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:32
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 13 /tr "'C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:33
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:34
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 14 /tr "'C:\Recovery\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:35
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 6 /tr "'C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:36
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:37
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 12 /tr "'C:\Users\Public\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:38
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjtK" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exe'" /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              General

              Target ID:39
              Start time:23:27:00
              Start date:09/01/2025
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:schtasks.exe /create /tn "KryJcojekJhJNSUQWyfsXjt" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\KryJcojekJhJNSUQWyfsXjt.exe'" /rl HIGHEST /f
              Imagebase:0x7ff710ad0000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Has exited:true

              Disassembly

              Reset < >

                Executed Functions

                Function 00007FF848F3F013 Relevance: 5.2, Strings: 4, Instructions: 169COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID: -$.$>$P
                • API String ID: 0-1256985030
                • Opcode ID: 61d7a90415f580d891b34d0c16346684776845385dc12eb0d92ea6ac3ad85d68
                • Instruction ID: 1359ada9888065b33cd48891e05694d2ab8bc3370afccd31b9dd7bf3e55fa005
                • Opcode Fuzzy Hash: 61d7a90415f580d891b34d0c16346684776845385dc12eb0d92ea6ac3ad85d68
                • Instruction Fuzzy Hash: 0961F8B0D1962A8FDBA8EB14C8857A9B7B2FF54344F1041EAC00DA3292DB345EC18F45
                Function 00007FF848F3E65C Relevance: 3.8, Strings: 3, Instructions: 73COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID: <$C$}
                • API String ID: 0-539182413
                • Opcode ID: 8fe0e101fbf37a079c69ae9f5b43415a3bc9bc353be772f50a63790d24c48516
                • Instruction ID: b8852d89a25074f9c91db0e4e3f40fe28bbb38261eddc61b94d3a194b5e76aa0
                • Opcode Fuzzy Hash: 8fe0e101fbf37a079c69ae9f5b43415a3bc9bc353be772f50a63790d24c48516
                • Instruction Fuzzy Hash: DF31B270D086298FDBA9EF14C891BE9B7B6FF54351F1041EAD10EA2691DB346AC4CF84
                Function 00007FF848F3D809 Relevance: 2.9, Strings: 2, Instructions: 393COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID: NH$p\H
                • API String ID: 0-1232786254
                • Opcode ID: 012dd53444736b9b4821da820c66385ecaed196098b73589321cda414e1a3f8c
                • Instruction ID: 73b6af1f375970b431606d42138263a689a44c265f59483ce012495ff28b4c3c
                • Opcode Fuzzy Hash: 012dd53444736b9b4821da820c66385ecaed196098b73589321cda414e1a3f8c
                • Instruction Fuzzy Hash: 70E13971D1965A9FEB98EB68D8957B8B7B1FF58340F0400BAD00ED32D2CB386884CB55
                Function 00007FF848F3E4D3 Relevance: 2.5, Strings: 2, Instructions: 43COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID: 4$V
                • API String ID: 0-2948825401
                • Opcode ID: 140915b4458ee771d126afba2b4fe0b14dd97924ec937c9eeb1e34c85fc1c00d
                • Instruction ID: babb88257efb6920ea33ac0a164b6acd1c34d3979aa11683e2744205690b3d8f
                • Opcode Fuzzy Hash: 140915b4458ee771d126afba2b4fe0b14dd97924ec937c9eeb1e34c85fc1c00d
                • Instruction Fuzzy Hash: BA11C5B0D086698FDBA5EF04C844BEDB7B1EF54385F4001AAD40DE62D1DB78AA84CF19
                Function 00007FF848F30A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID: vH
                • API String ID: 0-2844672238
                • Opcode ID: 2bb0578398aeadb1ce7ed46d6b69966f80a9debf6f4b30545ef577795ce09b86
                • Instruction ID: 8ac5a10121c17735e79399b288e4c01c968b855e06429c529276e61fb4cf8d0e
                • Opcode Fuzzy Hash: 2bb0578398aeadb1ce7ed46d6b69966f80a9debf6f4b30545ef577795ce09b86
                • Instruction Fuzzy Hash: 5D116A31D0854E9FEB80FB68D8492BD7BE0FF98390F4005B7D819C6192EF38A5448700
                Function 00007FF848F3123D Relevance: 1.3, Strings: 1, Instructions: 63COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID: XyH
                • API String ID: 0-3434043539
                • Opcode ID: 58cde26aaaed0bb5d08ef176b0ae7bd8d131d9663e13603cdba4933bc61140f9
                • Instruction ID: ff85f34dffa0663f40002e5a309e1fd90f263f403b748ed44c439ba81b7914a6
                • Opcode Fuzzy Hash: 58cde26aaaed0bb5d08ef176b0ae7bd8d131d9663e13603cdba4933bc61140f9
                • Instruction Fuzzy Hash: 5811BF30D0D65E8EEB99FB6884592B97BE0FF5A341F0405BBE00AD60D2EF29A484C710
                Function 00007FF848F31250 Relevance: 1.3, Strings: 1, Instructions: 41COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID: XyH
                • API String ID: 0-3434043539
                • Opcode ID: 15acecb650dc91ab99fc6b0c4542b7c697affc9a19d0b24fd7210a6fe13206c3
                • Instruction ID: 81575af559200d3d1428336136ccb125e963bc6d7de28498d1c95acfee6febf1
                • Opcode Fuzzy Hash: 15acecb650dc91ab99fc6b0c4542b7c697affc9a19d0b24fd7210a6fe13206c3
                • Instruction Fuzzy Hash: 5EF0FF30D1D65F8EEF98BB6898082BA77E4FF56340F00067BE40DD20D1EF2850948210
                Function 00007FF848F3E8CC Relevance: 1.3, Strings: 1, Instructions: 40COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID: ;
                • API String ID: 0-1661535913
                • Opcode ID: 0ad81d192219ca08194f16c70b0606e017830d46b7fdc44a315208023998ac9e
                • Instruction ID: 4c3f8769af0edcb9dd3c02e5f6dcbf48d3f18c4510c61bcbcb1d94c4e7fb3c81
                • Opcode Fuzzy Hash: 0ad81d192219ca08194f16c70b0606e017830d46b7fdc44a315208023998ac9e
                • Instruction Fuzzy Hash: 22116370E086698FDBA9EF14C8957AAB7B2AF54341F1041AAD00EE2291DB346A818F45
                Function 00007FF848F410D1 Relevance: 1.3, Strings: 1, Instructions: 27COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID: /
                • API String ID: 0-2043925204
                • Opcode ID: acab62cd5b8f87aba51209cf7a0d58ade3ac3273e4c943a5084e90e035bb625d
                • Instruction ID: 8397fcfd711997b92a66e3411bfa02ef36af6eaa45f8d715b3c609f3e73e3f13
                • Opcode Fuzzy Hash: acab62cd5b8f87aba51209cf7a0d58ade3ac3273e4c943a5084e90e035bb625d
                • Instruction Fuzzy Hash: 3DF0DA34E086298FEB15EF94D8486ED73B1FB65741F104226D009AB2D4DB786984DF85
                Function 00007FF848F31738 Relevance: .3, Instructions: 289COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: a318ce5680553fa8a46ec1d8974191279e5e451fcdd9c3cac7eeec3769e52594
                • Instruction ID: 98f30a109232da5a4599697954adc04c539f68ec55fb31a17f92da0d13b11c75
                • Opcode Fuzzy Hash: a318ce5680553fa8a46ec1d8974191279e5e451fcdd9c3cac7eeec3769e52594
                • Instruction Fuzzy Hash: F2818D31A0CA4A8FDB58EF2898515A977E2FF99744F14467AE44DC32C6CF34AC42C785
                Function 00007FF848F3C62D Relevance: .3, Instructions: 269COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 967a3c78dfe19bd4e5031b152dcf8a00759601b91d3acd7774765f21994aecd5
                • Instruction ID: 74e9d4fc9b90ad7224d749ef3d9b10c13594d20ef1536559ba8a507ed073524b
                • Opcode Fuzzy Hash: 967a3c78dfe19bd4e5031b152dcf8a00759601b91d3acd7774765f21994aecd5
                • Instruction Fuzzy Hash: 1DB1B270D1861D8FEB98EB68C8957EDB7B1FF58340F5040AAD40DE3281DF746A858B54
                Function 00007FF848F3AD9D Relevance: .2, Instructions: 221COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: fd2f0d36ebf784620d030ad060968d6b71f083a81aa83de98faa91a77161c538
                • Instruction ID: e28158069f8e7d833e0e26e7563a138e8105b7769b8b1cc4244024054402271b
                • Opcode Fuzzy Hash: fd2f0d36ebf784620d030ad060968d6b71f083a81aa83de98faa91a77161c538
                • Instruction Fuzzy Hash: E261EC31D0DA8A9FE742EB7998581FD7BE0FF16351F0804BBD448CB1D2EB28A4958784
                Function 00007FF848F31D9D Relevance: .2, Instructions: 195COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 975a62d5412ccda324201f4490256352da4118c7c09c47f2f25ab8a0a22a6160
                • Instruction ID: 43a2ebf16be1d5fd638ee95085a0b7c4ade3e69914636c24cce59ae223e660f7
                • Opcode Fuzzy Hash: 975a62d5412ccda324201f4490256352da4118c7c09c47f2f25ab8a0a22a6160
                • Instruction Fuzzy Hash: 1651CD31A0CA5A8FDB48EF1888645BA77E2FF98754F14467EE44AC3281CF34E842C785
                Function 00007FF848F331E1 Relevance: .2, Instructions: 172COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 37c364915a9529f5377eacbcf205e735b3209b07c91f90deb6ca8acdc52924c8
                • Instruction ID: 1c7eb567ff8159b2088ad6879a4487ffe50ba7f9bf67d21f96d62f6ea1892cd8
                • Opcode Fuzzy Hash: 37c364915a9529f5377eacbcf205e735b3209b07c91f90deb6ca8acdc52924c8
                • Instruction Fuzzy Hash: 56510270D0861E8FEB54EBA8D4956EDBBB1EF58341F50803AD009E72D2DB38A944CB58
                Function 00007FF848F321B5 Relevance: .1, Instructions: 140COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 62f16f7ad4e221463e96a0a03bfced71effa05e58e28975a7f0af6054c6090a9
                • Instruction ID: 786e1fda4573c7d4510ff6fe7aee4bf2d1bf7631882aa1793a6a02624b7da2f6
                • Opcode Fuzzy Hash: 62f16f7ad4e221463e96a0a03bfced71effa05e58e28975a7f0af6054c6090a9
                • Instruction Fuzzy Hash: E8413831A0EA894FE346F77898991B9BBE0EF4A391F0401FBD44DD71D2DF28A8418365
                Function 00007FF848F3363B Relevance: .1, Instructions: 136COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: ecb61ed1b9830622eafc545adb91757f28b46165be3caf65f7d7452565e7018d
                • Instruction ID: 6def78203ff897c70bead932355de58f043258f4c4c3997d07cc23103dc51c6e
                • Opcode Fuzzy Hash: ecb61ed1b9830622eafc545adb91757f28b46165be3caf65f7d7452565e7018d
                • Instruction Fuzzy Hash: BC416D71D1D94A9FEB84EB2CE469ABDBBE0FF59340F44017AD009D72D2DF2868418B15
                Function 00007FF848F3C7AD Relevance: .1, Instructions: 104COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: f1c82161fd588c26d84d91c409abd7a0f802963ea8384014f9abc5dcb91952cb
                • Instruction ID: 979a57da2e9b5cd7a47c8c7b2a056967ac60b8626425594d7ee7ca56b6b7e390
                • Opcode Fuzzy Hash: f1c82161fd588c26d84d91c409abd7a0f802963ea8384014f9abc5dcb91952cb
                • Instruction Fuzzy Hash: D131C132A1E66B8FE7457B6CA8150FD37A0EF523A5F140277D40CCA0D3EF2C655082A9
                Function 00007FF848F3A471 Relevance: .1, Instructions: 73COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: d08794a611d95a37488ed522af9d63af4cfb96e33e86827610bd41077a31a494
                • Instruction ID: cf18a4e4b2e08de957f6ab1fd21c37e779b78d316c03bfb9d1ac01382883f982
                • Opcode Fuzzy Hash: d08794a611d95a37488ed522af9d63af4cfb96e33e86827610bd41077a31a494
                • Instruction Fuzzy Hash: 9F216F70908A4D8FDB88EF18C4996BD7BE0FF28345F0101ABE80DC72A1DB34A490CB40
                Function 00007FF848F33404 Relevance: .1, Instructions: 71COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: ecd50747da5a7df8c985f00ffb09dba735928fc3ab9978d7c01263845ecfbcc5
                • Instruction ID: 0a16dd16eb9df0a047c3aad53c0ee54d385b24df010e3307a190229c0ab1d619
                • Opcode Fuzzy Hash: ecd50747da5a7df8c985f00ffb09dba735928fc3ab9978d7c01263845ecfbcc5
                • Instruction Fuzzy Hash: CA117C3084D69A9FD743EB78D8586AA7BE4FF4A351F0504B6E049C70A2DB38A455CB10
                Function 00007FF848F33814 Relevance: .1, Instructions: 71COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 44036e4c9fecaabd76cf55f8ad987cc1d3e79644eb03a32bfaaa5e605bb26610
                • Instruction ID: 4461a9334ca91422c4d117681f113f9eecdbd43594695eca56f78976ad251fa1
                • Opcode Fuzzy Hash: 44036e4c9fecaabd76cf55f8ad987cc1d3e79644eb03a32bfaaa5e605bb26610
                • Instruction Fuzzy Hash: 26219F7190E54E8FE348EF28C8153EA7BB2EB96355F5000BEC00AD32DACBBA14558B44
                Function 00007FF848F30F5F Relevance: .1, Instructions: 71COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 8174423789f5f1a470b77e0284a3f29420a88b94a1affddcd356b2db0171ffac
                • Instruction ID: db284c7621503394e238fae011b0dc9b002889d77e88f517c5927935373e7d0c
                • Opcode Fuzzy Hash: 8174423789f5f1a470b77e0284a3f29420a88b94a1affddcd356b2db0171ffac
                • Instruction Fuzzy Hash: 0F216A31D0991E8FEB94FB14C815BEAB3A1FF84340F5042B6D40DE7196DF386A858B94
                Function 00007FF848F3C164 Relevance: .1, Instructions: 65COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 1d9a27c954fa914e7b6109c863a3581b3f699c2128ee2f7c3f1813f7bce1362b
                • Instruction ID: 0251221d604b7231bac848b03e6998b9b483a72fdabe975b67c393aadc8371e1
                • Opcode Fuzzy Hash: 1d9a27c954fa914e7b6109c863a3581b3f699c2128ee2f7c3f1813f7bce1362b
                • Instruction Fuzzy Hash: 1A118330E1C91D8EEB94FBA89495AFDB7B1EF59341F50113AD40DE32D2DF2468419B48
                Function 00007FF848F42534 Relevance: .1, Instructions: 65COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: aea00adc1fc0e1a1364889f0c08d8c53669850bfe50788a422a3d9eca3156d7e
                • Instruction ID: e1973e4e01c249b2119073be2df4b97ac5dace4167fb5a8c2f0213ebf68a3f80
                • Opcode Fuzzy Hash: aea00adc1fc0e1a1364889f0c08d8c53669850bfe50788a422a3d9eca3156d7e
                • Instruction Fuzzy Hash: F9118B3084E6C94FEB46AB6498786B9BFB0EF26311F1900FFD44ACA0D3DB295445C711
                Function 00007FF848F42EB5 Relevance: .1, Instructions: 59COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: fc6b0b38cb448a70cc799120fb52d526699d03f9a66defd685ce11c6bedcb382
                • Instruction ID: 7deaf5de3acc0074c79434a9367f6d6e28078650bb8f39461dcc27dcb50a37db
                • Opcode Fuzzy Hash: fc6b0b38cb448a70cc799120fb52d526699d03f9a66defd685ce11c6bedcb382
                • Instruction Fuzzy Hash: C211AC31D0C54A9FE791FBA888492B97AE0FF29750F4509B7D408D30A6EF38A1848715
                Function 00007FF848F3C830 Relevance: .1, Instructions: 59COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 5b6303a8309cfa22930825d2563c6f3cb44fc1c33fd3908f6a82ed6769027f26
                • Instruction ID: 13400b3ffff54d9c2dc004b066b7f7ea73f4ac6bef8b5e2a120cc7871bdc4612
                • Opcode Fuzzy Hash: 5b6303a8309cfa22930825d2563c6f3cb44fc1c33fd3908f6a82ed6769027f26
                • Instruction Fuzzy Hash: DB116D3080D78E9FEB86FB6888581B97BA0FF1A341F1504BBD409C60E2EB385650C754
                Function 00007FF848F42721 Relevance: .1, Instructions: 57COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 147028be5b750c01d8627ba343cdf54d822ff1908109eeecbbe9cf4b5ed5a076
                • Instruction ID: ee74b2db40ae2b95547ec25489190bb53d1c49f9d7b7d7956ea8a448f3ba5fd4
                • Opcode Fuzzy Hash: 147028be5b750c01d8627ba343cdf54d822ff1908109eeecbbe9cf4b5ed5a076
                • Instruction Fuzzy Hash: B111AD3080C59E9EEB82FBA8884C5F9BBE1FF29340F1448B7D408D70A2EB34A180C741
                Function 00007FF848F40C31 Relevance: .1, Instructions: 56COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 3c52d2fce8dccdfa33fc1bad5982619cdb4dc9f46272d00b41b0b702233b8e64
                • Instruction ID: e0e80fc11d14f662f5e617790794ed3476ba20a4a438dd9e8c1f5d3e55c24ca4
                • Opcode Fuzzy Hash: 3c52d2fce8dccdfa33fc1bad5982619cdb4dc9f46272d00b41b0b702233b8e64
                • Instruction Fuzzy Hash: A8115E7090DA4E9FEB95FB6484596BD7BE0FF68341F1004BBD819D7192DB35A580CB00
                Function 00007FF848F434C5 Relevance: .1, Instructions: 56COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 81e0b731297c466483c170c928289638ce74b5a8b08419fbb4d0c61f11856dc5
                • Instruction ID: 9a264bbcc12aa463a2515146c93eadbde374e464922fdb027d9654dcd7dc3d8a
                • Opcode Fuzzy Hash: 81e0b731297c466483c170c928289638ce74b5a8b08419fbb4d0c61f11856dc5
                • Instruction Fuzzy Hash: CE11A530D0E54A9EE752F7388859AB97BE0FF25740F0405B7D409D30E6EF34A5448751
                Function 00007FF848F33595 Relevance: .1, Instructions: 55COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 11d168a85e9a28d667f554299338304d6299907a1b6015c68eee019f2b8a0621
                • Instruction ID: 1873e1e527f121881db7716e9a94e5dbdfd238cc52c01f7e6c69a3eac0a2cf17
                • Opcode Fuzzy Hash: 11d168a85e9a28d667f554299338304d6299907a1b6015c68eee019f2b8a0621
                • Instruction Fuzzy Hash: C611397090864E8FEB89EF6894596BD7BA0FF18341F4405BAD41AD71D1EF35A5408704
                Function 00007FF848F3A941 Relevance: .1, Instructions: 53COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: bcd6f42670f97b09a98e97616ac110bddb4f5d3da3e3867871d97b478f5bcea4
                • Instruction ID: b80269369350d5d484d378a3fefb4c613ef3124afa539f1c774459a6e407bb5b
                • Opcode Fuzzy Hash: bcd6f42670f97b09a98e97616ac110bddb4f5d3da3e3867871d97b478f5bcea4
                • Instruction Fuzzy Hash: 7E018B3191EA8A9FE751FB24884D6B9BBE4FF59341F0604BBD408C60E2EF38E5848705
                Function 00007FF848F3AF35 Relevance: .1, Instructions: 52COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 3e36bee9aaf2b78cde8b70a742df8a11cddf218dbf2eba16ff59a973d4155181
                • Instruction ID: 0d994ae46f9a4ed6112f0d72395d84e004d9fb039a1d92d2e679f4d47b144568
                • Opcode Fuzzy Hash: 3e36bee9aaf2b78cde8b70a742df8a11cddf218dbf2eba16ff59a973d4155181
                • Instruction Fuzzy Hash: 6601487091CA4A9FE741FB7988996A9BBE0FF19381F0509B6D408C6192EF38E4948744
                Function 00007FF848F421D5 Relevance: .0, Instructions: 50COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: dc453e1d4ea385416180d969ce64ed76d6b5486d3b4e9bd6ad71992a873c1c1a
                • Instruction ID: ad444016ee4c9b8c8320e8cd5d3b22de2f677c545112192d6a4abafdb3e07e52
                • Opcode Fuzzy Hash: dc453e1d4ea385416180d969ce64ed76d6b5486d3b4e9bd6ad71992a873c1c1a
                • Instruction Fuzzy Hash: AB01FC30C4C6498FEB48EF64C8582BA7BA0FF29300F0004BBD41AD20C2EF39A640C750
                Function 00007FF848F32EF1 Relevance: .0, Instructions: 50COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 31d2bc4978c14933e488b688f427ea50dc856278da1c0ad9e12e5467a9fe9376
                • Instruction ID: c4f39f28a068a5d1cccc8180aa949a88d3cd91df43682795e3a12ee3069e201c
                • Opcode Fuzzy Hash: 31d2bc4978c14933e488b688f427ea50dc856278da1c0ad9e12e5467a9fe9376
                • Instruction Fuzzy Hash: 23018B31A1D64A8FE741FB74888D6B9BBE0FF59342F0549B7D80CCA0A6EB38E4448705
                Function 00007FF848F305D8 Relevance: .0, Instructions: 50COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: af7a89332d56c93137f589b89c1f2a849f44d5d2eae6101d14ddc750ecdee632
                • Instruction ID: fbbe7de4c4786d4d0880c05722381a26f3abe7a85aac6dd98c7bafec9a7fde2c
                • Opcode Fuzzy Hash: af7a89332d56c93137f589b89c1f2a849f44d5d2eae6101d14ddc750ecdee632
                • Instruction Fuzzy Hash: D1014830908A0E8FDB88EF24C4596BAB7A1FF6A345F50447AE40EC21D1CB35A590CB44
                Function 00007FF848F3BB1A Relevance: .0, Instructions: 49COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 72e1933a281a188876b03283a2e2ec4e94f9a65894f2d7e404336d1da8c3074e
                • Instruction ID: cc4596832ae1956d9ef3377c3e080ddd25ffa39172ed6449eed6d5c38dac30c4
                • Opcode Fuzzy Hash: 72e1933a281a188876b03283a2e2ec4e94f9a65894f2d7e404336d1da8c3074e
                • Instruction Fuzzy Hash: 7001483091894E9EEB88FF6888A92BABAE0FF18341F10047BD41AD2195DF31A550C744
                Function 00007FF848F3AD98 Relevance: .0, Instructions: 47COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 4f86f1ced166dc9b76b2d3b60bd31099f2d7615e167d0a12ebc0fcf815cc9726
                • Instruction ID: 214f4ed7de1faf9c02a67e26ebe16a55a49595d0cff6b5c7abc1cd4cc8ecb1fc
                • Opcode Fuzzy Hash: 4f86f1ced166dc9b76b2d3b60bd31099f2d7615e167d0a12ebc0fcf815cc9726
                • Instruction Fuzzy Hash: 5F01083092890E9FEB84EBB484686BAB6A0FF18345F50147AD81ED2195DB35A5508B54
                Function 00007FF848F328CD Relevance: .0, Instructions: 47COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 079a1b269c079669f0df2a8c1d64895dc2e62dd702557cd05bb6ffe263f5730d
                • Instruction ID: 09465072a647df690d6596cc9db07913af926ff328d8b06e741f486bf77776b8
                • Opcode Fuzzy Hash: 079a1b269c079669f0df2a8c1d64895dc2e62dd702557cd05bb6ffe263f5730d
                • Instruction Fuzzy Hash: D6017C3090D64D8FE751FB6484596B97BE0FF59342F0544B7D408C60A2EB34E584C745
                Function 00007FF848F3BF71 Relevance: .0, Instructions: 45COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 23f1b2a8b2383c6d5f72ee8da61cb36b01dd697a443660d8fc7373c211fb52a9
                • Instruction ID: c48645148f34057a3bffdb9a42aa56658486d8e82fa1227fa28d263ffab0b21f
                • Opcode Fuzzy Hash: 23f1b2a8b2383c6d5f72ee8da61cb36b01dd697a443660d8fc7373c211fb52a9
                • Instruction Fuzzy Hash: EAF08C7081D68E8FEB84EF7488692FEBBA0FF14211F40147BE808C21D2EB3495548B44
                Function 00007FF848F3A9B9 Relevance: .0, Instructions: 43COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 28da5f4270b9d8e06ffe4a6a77c67381d6e00c823a065c4e72f5a09733730f7a
                • Instruction ID: 20fdca29a26d02693eadbe5ffa130e4f9eaf2e326cc34d2ab5cdfcc1af5c6ace
                • Opcode Fuzzy Hash: 28da5f4270b9d8e06ffe4a6a77c67381d6e00c823a065c4e72f5a09733730f7a
                • Instruction Fuzzy Hash: 64018F3194EA899FE752FB3588595A97BE0EF19341F0608F7D408C70E2EB38A4848705
                Function 00007FF848F32F69 Relevance: .0, Instructions: 43COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 391b2c74528014aa144b380454d93fbaf2d355b61399b4629a48bb2100b2116f
                • Instruction ID: 659a6dd10d7a86b5fc9c5b7cc0c78969ee7c16561d8f31cda4599ad29fd826d9
                • Opcode Fuzzy Hash: 391b2c74528014aa144b380454d93fbaf2d355b61399b4629a48bb2100b2116f
                • Instruction Fuzzy Hash: 12018F30A0D6899FE752BB7888595A97BE0EF5A342F0604F7D408CB0EAEB38A4448711
                Function 00007FF848F4B220 Relevance: .0, Instructions: 42COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: f802daa8898da151c4da64b2d106dbc4bf8b0406bbb763411d3ccc013191d115
                • Instruction ID: 1852257810aa942db7d916b648671ab47ba76c110a05519eddc3c535fb8f9474
                • Opcode Fuzzy Hash: f802daa8898da151c4da64b2d106dbc4bf8b0406bbb763411d3ccc013191d115
                • Instruction Fuzzy Hash: 97011D3092890E9EEB81FBA8884C6BEB6E4FF28341F404976D419D31A5EB34A2948755
                Function 00007FF848F30608 Relevance: .0, Instructions: 42COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 0e425cf930f5ee305bc2907bd30d75d8214bc753283ffd9741ce781c8edc194c
                • Instruction ID: 1fa7f124502a062e5ff30bc903a25f34100580dc45df75f0b600005bed7ed043
                • Opcode Fuzzy Hash: 0e425cf930f5ee305bc2907bd30d75d8214bc753283ffd9741ce781c8edc194c
                • Instruction Fuzzy Hash: DD016930919B0E9EEB49EB6484582BA76A0FF18346F20087FE40EC21D1DF35A590C644
                Function 00007FF848F30610 Relevance: .0, Instructions: 42COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 700bf1d8bf3bafb6484ae8aa9ef4649766c40071a391949f9b256d36582a3ecc
                • Instruction ID: 0173247241b0adb28bd874087c05248266a622fc9b01f5d283f0aa5e28503eb0
                • Opcode Fuzzy Hash: 700bf1d8bf3bafb6484ae8aa9ef4649766c40071a391949f9b256d36582a3ecc
                • Instruction Fuzzy Hash: 86016930919A0E9EEB59EBA480596BDB6A0FF18346F60087FE80EC21D1DF35A590CA04
                Function 00007FF848F31D1D Relevance: .0, Instructions: 42COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 154f61d407dadf2f54f69286292cfeb204b4f4cdb016a1c4a00a1ab127545c93
                • Instruction ID: c00e972221e993b204cd022925f82d548dcf8c435d3cd79c8cf9de9d46b13962
                • Opcode Fuzzy Hash: 154f61d407dadf2f54f69286292cfeb204b4f4cdb016a1c4a00a1ab127545c93
                • Instruction Fuzzy Hash: 2F01DC3080DA8E8FDB99EF2488552B93BA1EF26300F4404BAE80CC61E2DB35D890C780
                Function 00007FF848F305D0 Relevance: .0, Instructions: 39COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: d0e901f1d27a2e0ce1c48f035ff4735f06265dbf1e604ab17566aef2ba63029c
                • Instruction ID: a522b7167b5accd599ca43b4bf4d3e4c0dca22f4e9f359a7478ee9ace92a8baf
                • Opcode Fuzzy Hash: d0e901f1d27a2e0ce1c48f035ff4735f06265dbf1e604ab17566aef2ba63029c
                • Instruction Fuzzy Hash: 2EF06D3081D64E8FEB98EF2494156FA77A4EF16348F50097AF80DC21D1DB39A590CB88
                Function 00007FF848F327E9 Relevance: .0, Instructions: 36COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: d7d89bb201920a233dfd51796873c96344474a6d10a37d445976f9d0f0ff63b9
                • Instruction ID: c666aa1d53344f44756ae20b480b09c32e42d778225ead482e6a7d7c402591d6
                • Opcode Fuzzy Hash: d7d89bb201920a233dfd51796873c96344474a6d10a37d445976f9d0f0ff63b9
                • Instruction Fuzzy Hash: 12F0623080E78D8FD75AAB7488151B93FA0FF56602F4504BBD409C61D2DB399854C741
                Function 00007FF848F3B20B Relevance: .0, Instructions: 35COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: cb6e310237986760a3f0692a74d95fe6a509dfae38693f8ed84ff32b97c015e0
                • Instruction ID: c52544d5025616864bdeca15b4a2599c74411f6ff47f10ac36caf21cf98d19c5
                • Opcode Fuzzy Hash: cb6e310237986760a3f0692a74d95fe6a509dfae38693f8ed84ff32b97c015e0
                • Instruction Fuzzy Hash: 8D01E870E1951A8FEB91EF94C444AFEB7B1EB54341F104677C409E2285DB38AA858B98
                Function 00007FF848F3285D Relevance: .0, Instructions: 34COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: fcefc8105ec58175adc16dbd646c9e9edaae732cd552a32b048ee132de9065f5
                • Instruction ID: 1a958368350f9d27982c285c2b7e8e0bcb272bcbfe236ee34aa9a084db83535b
                • Opcode Fuzzy Hash: fcefc8105ec58175adc16dbd646c9e9edaae732cd552a32b048ee132de9065f5
                • Instruction Fuzzy Hash: 23F09A3080E78ECFEB59AF6484592B93BA0FF15242F5004BBE809C61D2EB399454C700
                Function 00007FF848F40C50 Relevance: .0, Instructions: 32COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: eaed1ff17558bf9a350a170400b6a7462d0a04386583a3908a6c874f216b6421
                • Instruction ID: a1d229652efe0684f340f1a8d7ed0391b93783bba9ecc573c69cab5e2f20fd3b
                • Opcode Fuzzy Hash: eaed1ff17558bf9a350a170400b6a7462d0a04386583a3908a6c874f216b6421
                • Instruction Fuzzy Hash: F0F05830818A4E9EEB84FF6898082FE77E4FF28341F00053BEC1DD2191EB3061908B40
                Function 00007FF848F3BD06 Relevance: .0, Instructions: 19COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: d5ffa450a7569f760e696303e580840a19f81b1b26484a49c7132526981314aa
                • Instruction ID: 170d66e8460eb5a4147efc1bcf0e7525603b9c314a3ab9ef55ca7971f4221f45
                • Opcode Fuzzy Hash: d5ffa450a7569f760e696303e580840a19f81b1b26484a49c7132526981314aa
                • Instruction Fuzzy Hash: 00D04875A18A6D8EDF80EB98E8546EDB3B5FB58351F000126E51DEB285DB30A8108B44
                Function 00007FF848F38A8E Relevance: .0, Instructions: 17COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 7edb8d74da0f64e25ae69224659d65e4bec7adb4ce4fc2f5918ade90ddd7c362
                • Instruction ID: 0fc9bd341fa6360be6ddc331f11a0c7a17e420c0984612a12a22188fbd9c6064
                • Opcode Fuzzy Hash: 7edb8d74da0f64e25ae69224659d65e4bec7adb4ce4fc2f5918ade90ddd7c362
                • Instruction Fuzzy Hash: 23E0EC7095D85F9FDFA8EB048850BB963A1EB44241F1000BE801EE3691CE782A819B08

                Non-executed Functions

                Function 00007FF848F39A2F Relevance: .3, Instructions: 304COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 5d585d6755fbadc14e628712610c2ee90458609f2e05cf3f65ba95e69e35dfab
                • Instruction ID: 6063901af203eac0d30a5a53efca6eb40cf8b7a3c95b147aea48eea61a7ebe76
                • Opcode Fuzzy Hash: 5d585d6755fbadc14e628712610c2ee90458609f2e05cf3f65ba95e69e35dfab
                • Instruction Fuzzy Hash: F8C1EDA694E3C25FD3138B745CB52817FB0AE13258B1E4ADBC4C1CF4E3E2185A5AD366
                Function 00007FF848F41513 Relevance: 5.0, Strings: 4, Instructions: 41COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2068255061.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_7ff848f30000_18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.jbxd
                Similarity
                • API ID:
                • String ID: )$/$[${
                • API String ID: 0-1633938670
                • Opcode ID: 6e94f344b6ea0496b14827cdf567dc5987fbd6c1d084748484728a129f692b10
                • Instruction ID: 7fd98a8cf0e81ecd33c664954e85ca0a0fc4bd8b0eaaaec6ad8606bcc3d3af67
                • Opcode Fuzzy Hash: 6e94f344b6ea0496b14827cdf567dc5987fbd6c1d084748484728a129f692b10
                • Instruction Fuzzy Hash: 3511E830E0832E8EEB68AF55C8887BE77B1AF55741F14417AD049AA2C0DB785984DF45