Edit tour

Windows Analysis Report
kzy8qg5lbR.exe

Overview

General Information

Sample name:	kzy8qg5lbR.exe renamed because original name is a hash value
Original sample name:	8cd8abcb282f372de8c9de1c810b3b201b74974de71166809a7db64f8e344a9b.exe
Analysis ID:	1587599
MD5:	9c3df8227bb53d5b57e8bc749442965a
SHA1:	d33afdad1eadbef7fec5c8df379e4aefabc07391
SHA256:	8cd8abcb282f372de8c9de1c810b3b201b74974de71166809a7db64f8e344a9b
Tags:	exeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

kzy8qg5lbR.exe (PID: 1976 cmdline: "C:\Users\user\Desktop\kzy8qg5lbR.exe" MD5: 9C3DF8227BB53D5B57E8BC749442965A)

powershell.exe (PID: 5972 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7496 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 5900 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DeQadQO.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5952 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

kzy8qg5lbR.exe (PID: 7248 cmdline: "C:\Users\user\Desktop\kzy8qg5lbR.exe" MD5: 9C3DF8227BB53D5B57E8BC749442965A)

DeQadQO.exe (PID: 7320 cmdline: C:\Users\user\AppData\Roaming\DeQadQO.exe MD5: 9C3DF8227BB53D5B57E8BC749442965A)

schtasks.exe (PID: 7612 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpEA3C.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DeQadQO.exe (PID: 7664 cmdline: "C:\Users\user\AppData\Roaming\DeQadQO.exe" MD5: 9C3DF8227BB53D5B57E8BC749442965A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.2768568384.0000000002F8E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2768942453.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2765766310.0000000000435000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2765766310.0000000000435000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.2768568384.0000000002F41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.2768568384.0000000002F41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1536440135.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1536440135.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2768942453.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2768942453.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: kzy8qg5lbR.exe PID: 1976	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: kzy8qg5lbR.exe PID: 1976	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: kzy8qg5lbR.exe PID: 1976	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: kzy8qg5lbR.exe PID: 7248	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: kzy8qg5lbR.exe PID: 7248	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DeQadQO.exe PID: 7320	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DeQadQO.exe PID: 7664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DeQadQO.exe PID: 7664	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.kzy8qg5lbR.exe.3f24390.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.kzy8qg5lbR.exe.3f24390.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.kzy8qg5lbR.exe.3f24390.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3173d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31859:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31935:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a5b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.kzy8qg5lbR.exe.3ee9970.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.kzy8qg5lbR.exe.3ee9970.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.kzy8qg5lbR.exe.3ee9970.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3173d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31859:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31935:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a5b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.kzy8qg5lbR.exe.3f24390.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.kzy8qg5lbR.exe.3f24390.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.kzy8qg5lbR.exe.3f24390.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.kzy8qg5lbR.exe.3f24390.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dceb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dde7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de79:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6dee3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df55:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6dfeb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e07b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.kzy8qg5lbR.exe.3ee9970.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.kzy8qg5lbR.exe.3ee9970.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.kzy8qg5lbR.exe.3ee9970.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.kzy8qg5lbR.exe.3ee9970.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa870b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3353d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa877d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8807:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33659:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8899:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8903:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33735:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8975:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a0b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 9 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\kzy8qg5lbR.exe", ParentImage: C:\Users\user\Desktop\kzy8qg5lbR.exe, ParentProcessId: 1976, ParentProcessName: kzy8qg5lbR.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe", ProcessId: 5972, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpEA3C.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpEA3C.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\DeQadQO.exe, ParentImage: C:\Users\user\AppData\Roaming\DeQadQO.exe, ParentProcessId: 7320, ParentProcessName: DeQadQO.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpEA3C.tmp", ProcessId: 7612, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Users\user\Desktop\kzy8qg5lbR.exe, Initiated: true, ProcessId: 7248, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49709

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\kzy8qg5lbR.exe", ParentImage: C:\Users\user\Desktop\kzy8qg5lbR.exe, ParentProcessId: 1976, ParentProcessName: kzy8qg5lbR.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp", ProcessId: 5952, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\kzy8qg5lbR.exe", ParentImage: C:\Users\user\Desktop\kzy8qg5lbR.exe, ParentProcessId: 1976, ParentProcessName: kzy8qg5lbR.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe", ProcessId: 5972, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\kzy8qg5lbR.exe", ParentImage: C:\Users\user\Desktop\kzy8qg5lbR.exe, ParentProcessId: 1976, ParentProcessName: kzy8qg5lbR.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp", ProcessId: 5952, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: kzy8qg5lbR.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://mail.iaa-airferight.com

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\DeQadQO.exe

Avira: detection malicious, Label: TR/AD.GenSteal.oilgp

Found malware configuration

Source: 0.2.kzy8qg5lbR.exe.3f24390.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\DeQadQO.exe

ReversingLabs: Detection: 87%

Multi AV Scanner detection for submitted file

Source: kzy8qg5lbR.exe	Virustotal: Detection: 80%			Perma Link
Source: kzy8qg5lbR.exe	ReversingLabs: Detection: 87%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\DeQadQO.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: kzy8qg5lbR.exe

Joe Sandbox ML: detected

Source: kzy8qg5lbR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: kzy8qg5lbR.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3f24390.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3ee9970.2.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View

IP Address: 46.175.148.58 46.175.148.58

Source: global traffic

TCP traffic: 192.168.2.8:49709 -> 46.175.148.58:25

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.iaa-airferight.com

Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: kzy8qg5lbR.exe, 00000009.00000002.2768942453.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, DeQadQO.exe, 0000000E.00000002.2768568384.0000000002F96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: kzy8qg5lbR.exe, 00000000.00000002.1535336276.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp, DeQadQO.exe, 0000000A.00000002.1581908816.0000000002FBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: kzy8qg5lbR.exe, DeQadQO.exe.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: kzy8qg5lbR.exe, 00000000.00000002.1536440135.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp, kzy8qg5lbR.exe, 00000009.00000002.2765766310.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.kzy8qg5lbR.exe.3f24390.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.kzy8qg5lbR.exe.3ee9970.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.kzy8qg5lbR.exe.3f24390.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.kzy8qg5lbR.exe.3ee9970.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 0_2_0151D304	0_2_0151D304
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 0_2_07270E68	0_2_07270E68
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 0_2_07274628	0_2_07274628
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 0_2_07274618	0_2_07274618
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 0_2_0727C678	0_2_0727C678
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 0_2_07276160	0_2_07276160
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 0_2_07276170	0_2_07276170
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 0_2_072741F0	0_2_072741F0
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 0_2_07270E59	0_2_07270E59
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 0_2_07273DB8	0_2_07273DB8
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 0_2_07273980	0_2_07273980
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_013B41C8	9_2_013B41C8
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_013B9364	9_2_013B9364
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_013B96E0	9_2_013B96E0
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_013B9B38	9_2_013B9B38
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_013B4A98	9_2_013B4A98
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_013BCDB0	9_2_013BCDB0
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_013B3E80	9_2_013B3E80
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_063A56D8	9_2_063A56D8
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_063A2F00	9_2_063A2F00
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_063A3F48	9_2_063A3F48
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_063ABD00	9_2_063ABD00
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_063ADD00	9_2_063ADD00
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_063A9AE0	9_2_063A9AE0
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_063A8B88	9_2_063A8B88
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_063A0040	9_2_063A0040
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_063A363B	9_2_063A363B
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_063A4FF8	9_2_063A4FF8
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_0156D304	10_2_0156D304
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_070F6108	10_2_070F6108
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_070F2E90	10_2_070F2E90
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_070F35F8	10_2_070F35F8
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_070FAE97	10_2_070FAE97
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_070FAEA8	10_2_070FAEA8
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_071F0E68	10_2_071F0E68
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_071F4618	10_2_071F4618
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_071F4628	10_2_071F4628
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_071F0E59	10_2_071F0E59
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_071F3DB8	10_2_071F3DB8
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_071F6170	10_2_071F6170
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_071FB960	10_2_071FB960
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_071F6160	10_2_071F6160
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_071F3980	10_2_071F3980
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_071F41F0	10_2_071F41F0
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_02DA9378	14_2_02DA9378
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_02DA4A98	14_2_02DA4A98
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_02DA9B38	14_2_02DA9B38
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_02DA3E80	14_2_02DA3E80
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_02DACDB0	14_2_02DACDB0
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_02DA41C8	14_2_02DA41C8
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_064C56D8	14_2_064C56D8
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_064C3F48	14_2_064C3F48
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_064C2F00	14_2_064C2F00
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_064CBD00	14_2_064CBD00
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_064CDD00	14_2_064CDD00
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_064C9AE0	14_2_064C9AE0
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_064C8B98	14_2_064C8B98
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_064C0040	14_2_064C0040
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_064C3650	14_2_064C3650
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_064C4FF8	14_2_064C4FF8

Source: kzy8qg5lbR.exe

Static PE information: invalid certificate

Source: kzy8qg5lbR.exe, 00000000.00000002.1536440135.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs kzy8qg5lbR.exe
Source: kzy8qg5lbR.exe, 00000000.00000002.1536440135.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs kzy8qg5lbR.exe
Source: kzy8qg5lbR.exe, 00000000.00000002.1535336276.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs kzy8qg5lbR.exe
Source: kzy8qg5lbR.exe, 00000000.00000002.1554263865.00000000075A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs kzy8qg5lbR.exe
Source: kzy8qg5lbR.exe, 00000000.00000002.1555129254.0000000007C07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs kzy8qg5lbR.exe
Source: kzy8qg5lbR.exe, 00000000.00000002.1533286322.000000000120E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs kzy8qg5lbR.exe
Source: kzy8qg5lbR.exe, 00000000.00000000.1502490443.0000000000AF2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamerBRD.exe@ vs kzy8qg5lbR.exe
Source: kzy8qg5lbR.exe, 00000009.00000002.2765766310.0000000000435000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs kzy8qg5lbR.exe
Source: kzy8qg5lbR.exe, 00000009.00000002.2766239592.00000000010F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs kzy8qg5lbR.exe
Source: kzy8qg5lbR.exe	Binary or memory string: OriginalFilenamerBRD.exe@ vs kzy8qg5lbR.exe

Source: kzy8qg5lbR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.kzy8qg5lbR.exe.3f24390.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.kzy8qg5lbR.exe.3ee9970.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.kzy8qg5lbR.exe.3f24390.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.kzy8qg5lbR.exe.3ee9970.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: kzy8qg5lbR.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: DeQadQO.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@1/1

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe

File created: C:\Users\user\AppData\Roaming\DeQadQO.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6372:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6080:120:WilError_03

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe

File created: C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp

Jump to behavior

Source: kzy8qg5lbR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: kzy8qg5lbR.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kzy8qg5lbR.exe	Virustotal: Detection: 80%
Source: kzy8qg5lbR.exe	ReversingLabs: Detection: 87%

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe

File read: C:\Users\user\Desktop\kzy8qg5lbR.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\kzy8qg5lbR.exe "C:\Users\user\Desktop\kzy8qg5lbR.exe"
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DeQadQO.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Users\user\Desktop\kzy8qg5lbR.exe "C:\Users\user\Desktop\kzy8qg5lbR.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\DeQadQO.exe C:\Users\user\AppData\Roaming\DeQadQO.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpEA3C.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process created: C:\Users\user\AppData\Roaming\DeQadQO.exe "C:\Users\user\AppData\Roaming\DeQadQO.exe"
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DeQadQO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Users\user\Desktop\kzy8qg5lbR.exe "C:\Users\user\Desktop\kzy8qg5lbR.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpEA3C.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process created: C:\Users\user\AppData\Roaming\DeQadQO.exe "C:\Users\user\AppData\Roaming\DeQadQO.exe"	Jump to behavior

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: kzy8qg5lbR.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: kzy8qg5lbR.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 0_2_072751B2 pushad ; ret	0_2_072751D1
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Code function: 9_2_013B0BCD pushfd ; iretd	9_2_013B0BD2
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_0156F498 pushad ; iretd	10_2_0156F499
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_070FC287 pushad ; ret	10_2_070FC28A
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_070FB3E0 pushfd ; iretd	10_2_070FB3E9
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 10_2_071F51B3 pushad ; ret	10_2_071F51D1
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Code function: 14_2_02DA0BCD pushfd ; iretd	14_2_02DA0BD2

Source: kzy8qg5lbR.exe	Static PE information: section name: .text entropy: 7.904066013657937
Source: DeQadQO.exe.0.dr	Static PE information: section name: .text entropy: 7.904066013657937

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe

File created: C:\Users\user\AppData\Roaming\DeQadQO.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp"

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (129).png

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: kzy8qg5lbR.exe PID: 1976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DeQadQO.exe PID: 7320, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Memory allocated: 1510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Memory allocated: 2EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Memory allocated: 4EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Memory allocated: 8F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Memory allocated: 9F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Memory allocated: A140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Memory allocated: B140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Memory allocated: 13B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Memory allocated: 2E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Memory allocated: 4E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Memory allocated: 14C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Memory allocated: 2F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Memory allocated: 14C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Memory allocated: 89D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Memory allocated: 99D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Memory allocated: 9BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Memory allocated: ABB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Memory allocated: 2DA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Memory allocated: 2F40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Memory allocated: 4F40000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6238	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7076	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Window / User API: threadDelayed 5573	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Window / User API: threadDelayed 4242	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Window / User API: threadDelayed 2511
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Window / User API: threadDelayed 7335

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 4152	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7340	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7276	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7336	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7284	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7412	Thread sleep count: 5573 > 30	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -99860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -99741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -99625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -99513s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -99372s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -99247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -99139s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -99027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -98907s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7412	Thread sleep count: 4242 > 30	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -98782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -98657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -98532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -98407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -98282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -98163s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -98047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -97938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -97825s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -97716s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -97577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -97469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -96985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -96860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -96735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -96360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -96228s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -96110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -95985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -95855s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -95735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -95532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -95410s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -95282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -95171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -95063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -94938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -94813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -94688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -94563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -94453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -94344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -94219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -94109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -94000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -93891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -93781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe TID: 7396	Thread sleep time: -93672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7408	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -35971150943733603s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7748	Thread sleep count: 2511 > 30
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -99891s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -99781s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7748	Thread sleep count: 7335 > 30
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -99672s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -99563s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -99452s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -99344s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -99234s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -99118s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -99011s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -98883s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -98570s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -98439s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -98313s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -98203s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -98094s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -97984s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -97875s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -97764s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -97641s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -97531s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -97422s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -97313s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -97203s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -97093s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -96984s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -96875s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -96766s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -96656s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -96547s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -96436s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -96328s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -96217s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -96107s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -95809s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -95703s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -95594s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -95469s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -95356s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -95250s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -95138s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -95031s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -94922s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -94812s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -94703s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -94594s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -94484s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -94375s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -94265s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -94156s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -94047s >= -30000s
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe TID: 7740	Thread sleep time: -93937s >= -30000s

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 99860	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 99741	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 99625	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 99513	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 99372	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 99247	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 99139	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 99027	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 98907	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 98782	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 98657	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 98532	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 98407	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 98282	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 98163	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 98047	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 97938	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 97825	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 97716	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 97577	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 96228	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 95855	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 95735	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 95532	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 95410	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 95282	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 95171	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 95063	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 94938	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 94813	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 94688	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 94563	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 94453	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 94344	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 94219	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 94109	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 94000	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 93891	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 93781	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Thread delayed: delay time: 93672	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 99891
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 99781
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 99672
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 99563
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 99452
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 99344
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 99234
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 99118
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 99011
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 98883
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 98570
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 98439
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 98313
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 98203
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 98094
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 97984
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 97875
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 97764
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 97641
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 97531
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 97422
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 97313
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 97203
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 97093
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 96984
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 96875
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 96766
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 96656
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 96547
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 96436
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 96328
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 96217
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 96107
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 95809
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 95703
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 95594
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 95469
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 95356
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 95250
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 95138
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 95031
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 94922
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 94812
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 94703
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 94594
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 94484
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 94375
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 94265
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 94156
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 94047
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Thread delayed: delay time: 93937

Source: kzy8qg5lbR.exe, 00000009.00000002.2766296086.000000000120D000.00000004.00000020.00020000.00000000.sdmp, DeQadQO.exe, 0000000E.00000002.2766375420.00000000012D0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe"
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DeQadQO.exe"
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DeQadQO.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Memory written: C:\Users\user\Desktop\kzy8qg5lbR.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Memory written: C:\Users\user\AppData\Roaming\DeQadQO.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DeQadQO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Process created: C:\Users\user\Desktop\kzy8qg5lbR.exe "C:\Users\user\Desktop\kzy8qg5lbR.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpEA3C.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Process created: C:\Users\user\AppData\Roaming\DeQadQO.exe "C:\Users\user\AppData\Roaming\DeQadQO.exe"	Jump to behavior

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Queries volume information: C:\Users\user\Desktop\kzy8qg5lbR.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Queries volume information: C:\Users\user\Desktop\kzy8qg5lbR.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Queries volume information: C:\Users\user\AppData\Roaming\DeQadQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Queries volume information: C:\Users\user\AppData\Roaming\DeQadQO.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3f24390.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3ee9970.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3f24390.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3ee9970.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2768568384.0000000002F8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2768942453.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2765766310.0000000000435000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2768568384.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1536440135.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2768942453.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kzy8qg5lbR.exe PID: 1976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kzy8qg5lbR.exe PID: 7248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DeQadQO.exe PID: 7664, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\DeQadQO.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\kzy8qg5lbR.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\DeQadQO.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3f24390.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3ee9970.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3f24390.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3ee9970.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2765766310.0000000000435000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2768568384.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1536440135.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2768942453.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kzy8qg5lbR.exe PID: 1976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kzy8qg5lbR.exe PID: 7248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DeQadQO.exe PID: 7664, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3f24390.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3ee9970.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3f24390.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kzy8qg5lbR.exe.3ee9970.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2768568384.0000000002F8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2768942453.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2765766310.0000000000435000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2768568384.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1536440135.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2768942453.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kzy8qg5lbR.exe PID: 1976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kzy8qg5lbR.exe PID: 7248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DeQadQO.exe PID: 7664, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	11 Masquerading	2 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
kzy8qg5lbR.exe	80%	Virustotal		Browse
kzy8qg5lbR.exe	88%	ReversingLabs	Win32.Spyware.Negasteal
kzy8qg5lbR.exe	100%	Avira	TR/AD.GenSteal.oilgp
kzy8qg5lbR.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\DeQadQO.exe	100%	Avira	TR/AD.GenSteal.oilgp
C:\Users\user\AppData\Roaming\DeQadQO.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\DeQadQO.exe	88%	ReversingLabs	Win32.Spyware.Negasteal

Source	Detection	Scanner	Label	Link
http://mail.iaa-airferight.com	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.iaa-airferight.com	46.175.148.58	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.dyn.com/	kzy8qg5lbR.exe, 00000000.00000002.1536440135.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp, kzy8qg5lbR.exe, 00000009.00000002.2765766310.0000000000435000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	kzy8qg5lbR.exe, 00000000.00000002.1535336276.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp, DeQadQO.exe, 0000000A.00000002.1581908816.0000000002FBE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	kzy8qg5lbR.exe, DeQadQO.exe.0.dr	false		high
http://www.symauth.com/rpa00	kzy8qg5lbR.exe, DeQadQO.exe.0.dr	false		high
http://mail.iaa-airferight.com	kzy8qg5lbR.exe, 00000009.00000002.2768942453.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, DeQadQO.exe, 0000000E.00000002.2768568384.0000000002F96000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587599
Start date and time:	2025-01-10 15:24:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kzy8qg5lbR.exe renamed because original name is a hash value
Original Sample Name:	8cd8abcb282f372de8c9de1c810b3b201b74974de71166809a7db64f8e344a9b.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 235 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 20.109.210.53, 13.107.253.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:25:19	API Interceptor	177x Sleep call for process: kzy8qg5lbR.exe modified
09:25:22	API Interceptor	38x Sleep call for process: powershell.exe modified
09:25:25	API Interceptor	173x Sleep call for process: DeQadQO.exe modified
15:25:22	Task Scheduler	Run new task: DeQadQO path: C:\Users\user\AppData\Roaming\DeQadQO.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
46.175.148.58	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse
	PO for fabric forecast.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse
	lC7L7oBBMC.exe	Get hash	malicious	AgentTesla	Browse
	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	RFQ ENQ186 OI REQUIRE RATE.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO for fabric forecast.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	46.175.148.58
	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	lC7L7oBBMC.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	46.175.148.58
	RFQ ENQ186 OI REQUIRE RATE.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLAGIDKOM-NETUA	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO for fabric forecast.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	46.175.148.58
	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	lC7L7oBBMC.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	46.175.148.58
	RFQ ENQ186 OI REQUIRE RATE.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58

Process:	C:\Users\user\AppData\Roaming\DeQadQO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kzy8qg5lbR.exe.log

Download File

Process:	C:\Users\user\Desktop\kzy8qg5lbR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380134126512796
Encrypted:	false
SSDEEP:	48:+WSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//8PUyus:+LHxvIIwLgZ2KRHWLOug8s
MD5:	F37AEC77E01BBB962825154484185140
SHA1:	4EB2AF977817681D7A1EB59060C0DD62A166C7D4
SHA-256:	CB443439A2777B9803D5D93B8FD4DCA1F2544148EF27123006E92C8ADF05DD6F
SHA-512:	371FBFCB6FAB236D5C88B2BB6E3322A1A265AF88BD4238319C56569F93163CA10CDE73D1E92DD550C9F7040769DE7DD28A9BACB48763749173CFC2372B40B72F
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0dtkcpd3.ng5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ij2knqz.hv0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_natx4uak.srn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qgf4bzj2.xku.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tb50xwy3.kyy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x0phvmhg.2r1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xj3i4fdi.5m0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ywwo2mux.s2h.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp

Download File

Process:	C:\Users\user\Desktop\kzy8qg5lbR.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.107503534031619
Encrypted:	false
SSDEEP:	24:2di4+S2qhtJ12iy1mcrUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt8xvn:cgeLAYrFdOFzOzN33ODOiDdKrsuT8v
MD5:	F6ADC61430E97690F88F8E7AEFE4407B
SHA1:	670B31341F7E549EF77FE7B187B90066922402D0
SHA-256:	4F1B16E73CF16BC2E2526244E7F4549977806E9CDC090882BF64C1A84414A3CA
SHA-512:	69454DDC11AEE7D9943E0C429D1E36E08A478C237EA6F6DB3C7818466A2889874AA1C7B7E934AEA97D0CA34167FAED477164F146A19BDA01E887317B7A566D97
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmpEA3C.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\DeQadQO.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.107503534031619
Encrypted:	false
SSDEEP:	24:2di4+S2qhtJ12iy1mcrUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt8xvn:cgeLAYrFdOFzOzN33ODOiDdKrsuT8v
MD5:	F6ADC61430E97690F88F8E7AEFE4407B
SHA1:	670B31341F7E549EF77FE7B187B90066922402D0
SHA-256:	4F1B16E73CF16BC2E2526244E7F4549977806E9CDC090882BF64C1A84414A3CA
SHA-512:	69454DDC11AEE7D9943E0C429D1E36E08A478C237EA6F6DB3C7818466A2889874AA1C7B7E934AEA97D0CA34167FAED477164F146A19BDA01E887317B7A566D97
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\DeQadQO.exe

Download File

Process:	C:\Users\user\Desktop\kzy8qg5lbR.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	942184
Entropy (8bit):	7.432549101406065
Encrypted:	false
SSDEEP:	12288:MykR5mU+8qeqbEcWsCjF3eSNgAQkhZlZChdHzFdqpHY273XFQvXP7r9r/+pppppv:ZkRxuhWsaHNTQ0K2731QvX1q
MD5:	9C3DF8227BB53D5B57E8BC749442965A
SHA1:	D33AFDAD1EADBEF7FEC5C8DF379E4AEFABC07391
SHA-256:	8CD8ABCB282F372DE8C9DE1C810B3B201B74974DE71166809A7DB64F8E344A9B
SHA-512:	E70C6B0339FB643FE0D32299136DE7A2015F266523805E73C695893EF9E9F46BB2519589181E2CE239D9872C9F2A20C8E3AB81B4ECB5DE591E25F37EC7540D8B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~F.g..............0......P......".... ........@.. ....................................@.....................................O........M...........,..h4...`....................................................... ............... ..H............text...(.... ...................... ..`.rsrc....M.......N..................@..@.reloc.......`.....................@..B........................H.......................f................................................r...p}.....r...p}......}.....(%......(...........0...........(......s7....sA....sC.....{......s....s)...o&.....s....%..js....o.....%r!..po.....%.o.....oB.....s....%..js....o.....%r-..po.....oB.....s....%..js....o.....%..s'...(....o.....%rA..po.....oB......0...........rY..p..sd.....oe......+....0..]..........((...r...p().....(.....,,.(+....r...p(,....rl..p(,....(+......(-......sp.....ok......+..*".(

C:\Users\user\AppData\Roaming\DeQadQO.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\kzy8qg5lbR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.432549101406065
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	kzy8qg5lbR.exe
File size:	942'184 bytes
MD5:	9c3df8227bb53d5b57e8bc749442965a
SHA1:	d33afdad1eadbef7fec5c8df379e4aefabc07391
SHA256:	8cd8abcb282f372de8c9de1c810b3b201b74974de71166809a7db64f8e344a9b
SHA512:	e70c6b0339fb643fe0d32299136de7a2015f266523805e73c695893ef9e9f46bb2519589181e2ce239d9872c9f2a20c8e3ab81b4ecb5de591e25f37ec7540d8b
SSDEEP:	12288:MykR5mU+8qeqbEcWsCjF3eSNgAQkhZlZChdHzFdqpHY273XFQvXP7r9r/+pppppv:ZkRxuhWsaHNTQ0K2731QvX1q
TLSH:	C615CE81E5845AA0DD6D9B706936CC3543337EBDA834E81D29DD3D6B3BFB7825022227
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~F.g..............0......P......".... ........@.. ....................................@................................

File Icon


Icon Hash:	c5a484988c94a04b

Static PE Info

General

Entrypoint:	0x4af922
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6704467E [Mon Oct 7 20:37:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	11/11/2021 01:00:00 14/11/2024 00:59:59
Subject Chain	CN="NetEase Youdao Information Technology (Beijing) Co.,Ltd.", O="NetEase Youdao Information Technology (Beijing) Co.,Ltd.", S=Beijing, C=CN
Version:	3
Thumbprint MD5:	4F5FEC748CD450F88841E761105381F9
Thumbprint SHA-1:	4969233BC110419F015F688CF21C19254B1B0BAA
Thumbprint SHA-256:	1CC254B81F32E63E63AD35958D2E738ADAA491167E1EA91199DEF66274175909
Serial:	01CC0C6632D0CA3E68F19D8028508E91

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaf8d0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x34dec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xe2c00	0x3468
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xad928	0xada00	60aae9cb99dee0ae144ee223ccfaf57d	False	0.9286680503059755	data	7.904066013657937	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x34dec	0x34e00	e02b27bcf0fd575e1affb649dec3099b	False	0.20937684692671396	data	4.429835259806629	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe6000	0xc	0x200	42c849c5c948809377f30fdc1a160737	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb0448	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	0.3225609756097561
RT_ICON	0xb0ab0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	0.43951612903225806
RT_ICON	0xb0d98	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	0.4016393442622951
RT_ICON	0xb0f80	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	0.4831081081081081
RT_ICON	0xb10a8	0x35e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9907192575406032
RT_ICON	0xb4688	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.4584221748400853
RT_ICON	0xb5530	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.47382671480144406
RT_ICON	0xb5dd8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.45564516129032256
RT_ICON	0xb64a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.3504335260115607
RT_ICON	0xb6a08	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.07868508221933042
RT_ICON	0xc7230	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.15114568005045195
RT_ICON	0xd06d8	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	0.1543233082706767
RT_ICON	0xd6ec0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.175184842883549
RT_ICON	0xdc348	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.15948275862068967
RT_ICON	0xe0570	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.24107883817427386
RT_ICON	0xe2b18	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.2678236397748593
RT_ICON	0xe3bc0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.37459016393442623
RT_ICON	0xe4548	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.42819148936170215
RT_GROUP_ICON	0xe49b0	0x102	data	0.5775193798449613
RT_GROUP_ICON	0xe4ab4	0x14	data	1.05
RT_VERSION	0xe4ac8	0x324	data	0.43034825870646765

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:25:24.655965090 CET	49709	25	192.168.2.8	46.175.148.58
Jan 10, 2025 15:25:25.715534925 CET	49709	25	192.168.2.8	46.175.148.58
Jan 10, 2025 15:25:27.661638975 CET	49712	25	192.168.2.8	46.175.148.58
Jan 10, 2025 15:25:27.715482950 CET	49709	25	192.168.2.8	46.175.148.58
Jan 10, 2025 15:25:28.699879885 CET	49712	25	192.168.2.8	46.175.148.58
Jan 10, 2025 15:25:30.699879885 CET	49712	25	192.168.2.8	46.175.148.58
Jan 10, 2025 15:25:31.731342077 CET	49709	25	192.168.2.8	46.175.148.58
Jan 10, 2025 15:25:34.715496063 CET	49712	25	192.168.2.8	46.175.148.58
Jan 10, 2025 15:25:39.732140064 CET	49709	25	192.168.2.8	46.175.148.58
Jan 10, 2025 15:25:42.731157064 CET	49712	25	192.168.2.8	46.175.148.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:25:24.404576063 CET	56831	53	192.168.2.8	1.1.1.1
Jan 10, 2025 15:25:24.561182022 CET	53	56831	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:25:24.404576063 CET	192.168.2.8	1.1.1.1	0x8f86	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:25:24.561182022 CET	1.1.1.1	192.168.2.8	0x8f86	No error (0)	mail.iaa-airferight.com		46.175.148.58	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	09:25:18
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\kzy8qg5lbR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kzy8qg5lbR.exe"
Imagebase:	0xaf0000
File size:	942'184 bytes
MD5 hash:	9C3DF8227BB53D5B57E8BC749442965A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1536440135.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1536440135.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:25:20
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\kzy8qg5lbR.exe"
Imagebase:	0x3d0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:25:20
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:25:21
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DeQadQO.exe"
Imagebase:	0x3d0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:25:21
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:25:21
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp"
Imagebase:	0xab0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:25:21
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:25:21
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\kzy8qg5lbR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kzy8qg5lbR.exe"
Imagebase:	0xbd0000
File size:	942'184 bytes
MD5 hash:	9C3DF8227BB53D5B57E8BC749442965A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2768942453.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2765766310.0000000000435000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2765766310.0000000000435000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2768942453.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2768942453.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	09:25:22
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\DeQadQO.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\DeQadQO.exe
Imagebase:	0xa60000
File size:	942'184 bytes
MD5 hash:	9C3DF8227BB53D5B57E8BC749442965A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:25:24
Start date:	10/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff605670000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:25:25
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeQadQO" /XML "C:\Users\user\AppData\Local\Temp\tmpEA3C.tmp"
Imagebase:	0xab0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:25:25
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:25:26
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\DeQadQO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\DeQadQO.exe"
Imagebase:	0xbb0000
File size:	942'184 bytes
MD5 hash:	9C3DF8227BB53D5B57E8BC749442965A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2768568384.0000000002F8E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2768568384.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2768568384.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	224
Total number of Limit Nodes:	21

Executed Functions

Function 07270E59 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ec340e093ff69f18c52fa86da4c3b0e4ad8a8c939ab8eafe98755515194a08
Instruction ID: fc36ce63a5c29ef49e04a89aa9243e90156835f650f0e0dbb38a9fdda3e34bdf
Opcode Fuzzy Hash: c4ec340e093ff69f18c52fa86da4c3b0e4ad8a8c939ab8eafe98755515194a08
Instruction Fuzzy Hash: F821C4B1D156188BEB28CFABCA453DEBEF6AFC9300F14C06AD50876264DB740946CF90

Function 07270E68 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f131bb4d4b26249291c7a5b45323f535f7b30f0845581c1c9c7f23cdc0a673
Instruction ID: bd22a9f321f6bef0b52178fae4e30e8f20f817b0abe6489b8ad4b68af83fdc9a
Opcode Fuzzy Hash: f8f131bb4d4b26249291c7a5b45323f535f7b30f0845581c1c9c7f23cdc0a673
Instruction Fuzzy Hash: 2D21B3B1D156198BEB28CFABC9443DEFAF6AFC9300F14C06AD50876264DBB40945CFA0

Function 0151D3C9 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0151D456
GetCurrentThread.KERNEL32 ref: 0151D493
GetCurrentProcess.KERNEL32 ref: 0151D4D0
GetCurrentThreadId.KERNEL32 ref: 0151D529

Memory Dump Source

Source File: 00000000.00000002.1534599505.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1510000_kzy8qg5lbR.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 74eeb2001921244006f4ae1b51ad1228f19e53da375992e59e7b972f868a5142
Instruction ID: a86ecafe4fbeb55b6649d4e1383259b87c49792d0d3c50388e22d67cdc9e7eff
Opcode Fuzzy Hash: 74eeb2001921244006f4ae1b51ad1228f19e53da375992e59e7b972f868a5142
Instruction Fuzzy Hash: 2B5176B0900609DFEB14CFAAD548BEEBBF1BF88304F248499D409AB391D7756944CB26

Function 0151D3D8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0151D456
GetCurrentThread.KERNEL32 ref: 0151D493
GetCurrentProcess.KERNEL32 ref: 0151D4D0
GetCurrentThreadId.KERNEL32 ref: 0151D529

Memory Dump Source

Source File: 00000000.00000002.1534599505.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1510000_kzy8qg5lbR.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 747445543f0f12e6a3eee719be0aaaabc30fc58db0f7b6a5f112bf94516bb0ee
Instruction ID: c0ddbc00956e9502365b8dc425c9c8ed9d29a69efc92d64c24002bc2537c06f0
Opcode Fuzzy Hash: 747445543f0f12e6a3eee719be0aaaabc30fc58db0f7b6a5f112bf94516bb0ee
Instruction Fuzzy Hash: D15165B0900709DFEB14CFAAD548BDEBBF1BF88304F248459D409AB3A1D7756984CB66

Function 072769BC Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07276BFE

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 515d475ed36e84f8fb76038799d51230240d0a13a7923c3a5dc3455d93fdd60b
Instruction ID: 349335b722c4eff04e67e6658870ec8e3be155dc4cf04a067528cce3e498ad46
Opcode Fuzzy Hash: 515d475ed36e84f8fb76038799d51230240d0a13a7923c3a5dc3455d93fdd60b
Instruction Fuzzy Hash: 89914AB1D1062ACFEB20CFA8C9417EEBBB2FF49310F148569D858A7240DB759985CF91

Function 072769C8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07276BFE

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 8db98b4429219ca9a101c475846937bff2ccff260b8a6dc5f1e8d8d278c12df1
Instruction ID: 5f1d1694cc30cc19b9b6c9eab2c266279dc1c621e567b2a6ad38f24df93a662f
Opcode Fuzzy Hash: 8db98b4429219ca9a101c475846937bff2ccff260b8a6dc5f1e8d8d278c12df1
Instruction Fuzzy Hash: A5914AB1D1061ACFEB20CFA9C9417DEBBB2FF45310F148569D808A7240DB759985CF91

Function 0151AD48 Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0151AF9E

Memory Dump Source

Source File: 00000000.00000002.1534599505.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1510000_kzy8qg5lbR.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 62df8e720abdb7c07c42d0191c2b228fad59f575bab7b912c69e33659715cace
Instruction ID: a6685376e64aa36d3ba206b29c5e33aa2809c78639b0589b27b65e936539144e
Opcode Fuzzy Hash: 62df8e720abdb7c07c42d0191c2b228fad59f575bab7b912c69e33659715cace
Instruction Fuzzy Hash: C8816970A01B458FE726DF6AD04479ABBF1FF88304F008A2DD44ADBA54D775E846CB90

Function 015144E4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015159C9

Memory Dump Source

Source File: 00000000.00000002.1534599505.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1510000_kzy8qg5lbR.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7381c721664a25e54988e85aae0233c16161610fd2ef83b482f2a90f8944bc91
Instruction ID: 6419068fa68a42caa5608ff15ada011cd04f744c96289229369c1d7fd0093324
Opcode Fuzzy Hash: 7381c721664a25e54988e85aae0233c16161610fd2ef83b482f2a90f8944bc91
Instruction Fuzzy Hash: 0641E370C00719CFEB25CFAAC844B8EBBF5BF86704F24846AD408AB255DB716945CF50

Function 07276738 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 072767D0

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5535455e4b80edcbe7cacd252a08bc778ca3a5400a9721d985ac811312a4c72e
Instruction ID: f1f52db0436a14f6054de672a81d0cf25037da0d2c400c34154362dd3a1da5a6
Opcode Fuzzy Hash: 5535455e4b80edcbe7cacd252a08bc778ca3a5400a9721d985ac811312a4c72e
Instruction Fuzzy Hash: 1F2135B6D103099FDB10CFA9C981BEEBBF4FF48310F14882AE918A7241C7789551CBA0

Function 07276740 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 072767D0

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3bf7f8b87cf97b4224c8f5c2c61a769f2930a82e5f741c1a2ae3a9f5908b2156
Instruction ID: 92dffe95ff483f8ed9fa12cd10642355689c9aae756e2b2dcb26aa7500ea6781
Opcode Fuzzy Hash: 3bf7f8b87cf97b4224c8f5c2c61a769f2930a82e5f741c1a2ae3a9f5908b2156
Instruction Fuzzy Hash: 022125B5900359DFDB10CFAAC981BDEBBF5FF48310F14882AE918A7240C7789955CBA4

Function 072765A0 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07276626

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 471420370b292fdc2654b0260e480301b207433956f8862f9e01c111f43bcc25
Instruction ID: dc0e94472df7c336250fbbbc32fad17867b4fe2f3b01c8ec33929620edaf49b6
Opcode Fuzzy Hash: 471420370b292fdc2654b0260e480301b207433956f8862f9e01c111f43bcc25
Instruction Fuzzy Hash: F72177B1D0030A8FDB10DFAAC9857EEBBF4AF48210F14882ED419A7341C7789945CFA1

Function 07276828 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 072768B0

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a5902bc03469d995c4f5040278a5b4fbbfafd445cc2c4121aad157c6b5536259
Instruction ID: 6fcd2a694235e0b60d5d0cf75528a6f21e8343301d9c25f4945e71da8218bccc
Opcode Fuzzy Hash: a5902bc03469d995c4f5040278a5b4fbbfafd445cc2c4121aad157c6b5536259
Instruction Fuzzy Hash: 252114B2C01349DFDB10CFAAC981BEEBBF5BF48310F14882AE559A7250C7399555DBA0

Function 0151D619 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0151D6A7

Memory Dump Source

Source File: 00000000.00000002.1534599505.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1510000_kzy8qg5lbR.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8510c34377e6acf17d280784dda1ca2cf1bc1044646f4d0091b39bdd719c50aa
Instruction ID: b3fc19ab212bb772b8a17272cd57e7fceb5238ff588a019e7c426c88a42fafff
Opcode Fuzzy Hash: 8510c34377e6acf17d280784dda1ca2cf1bc1044646f4d0091b39bdd719c50aa
Instruction Fuzzy Hash: A421E5B5900248DFDB10CFAAD484ADEBFF5FB48310F24841AE958A7310C3799945CF65

Function 072765A8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07276626

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 71b61b90e39b1a959927a77f5bebeb13f8cb69160f7063f2de42eef940f82b63
Instruction ID: 8238c91603e7945a326bdcfb1caa11b1abca60b92976c862d04975f2ef56180f
Opcode Fuzzy Hash: 71b61b90e39b1a959927a77f5bebeb13f8cb69160f7063f2de42eef940f82b63
Instruction Fuzzy Hash: 432135B1D003099FDB10DFAAC985BAEBBF4AF48210F54842ED419A7241CB789945CFA5

Function 07276830 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 072768B0

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: be05c5bf56db26c4d7ce55de2f516fb1593c9604fc069d10528fb724de5d5c18
Instruction ID: eed44bc2f059509eed76c410018be162cb17404745e2d71ccba52ce88ceff8ec
Opcode Fuzzy Hash: be05c5bf56db26c4d7ce55de2f516fb1593c9604fc069d10528fb724de5d5c18
Instruction Fuzzy Hash: 732105B1C003499FDB10CFAAC840AEEBBF5BF48310F14842AE518A7240C7799545CBA5

Function 0151D620 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0151D6A7

Memory Dump Source

Source File: 00000000.00000002.1534599505.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1510000_kzy8qg5lbR.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0d3fd9b77f3bd19d16e2290361ff12cd603d0d2c7d40ec7b2fc714077c6416cb
Instruction ID: 3164e43a0b94b0730d86e88623ceb524c1bf870f3c7f93d3a31a3262a8ad1b7a
Opcode Fuzzy Hash: 0d3fd9b77f3bd19d16e2290361ff12cd603d0d2c7d40ec7b2fc714077c6416cb
Instruction Fuzzy Hash: BA21C4B5900248EFDB10CFAAD884ADEFBF8FB48710F14841AE918A7350D378A954CF65

Function 07276679 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 072766EE

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c0b3ac3a612c833832e5db57c5b41ff7a7e8df653eb54079a18fd0eaa9408e58
Instruction ID: c20bd3c9be65bffa3fb5e63182aeeb1c459b1b899a184322110f8be9172d4964
Opcode Fuzzy Hash: c0b3ac3a612c833832e5db57c5b41ff7a7e8df653eb54079a18fd0eaa9408e58
Instruction Fuzzy Hash: CD1167B2800749DFDB10DFAAD945BDEBBF5EF48320F24881AD519A7250C7399901CFA0

Function 07276680 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 072766EE

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fc272feec94f982cfccca948965381368a6e3e03231450a1521213e41d60318e
Instruction ID: e600d0658f0fc38afa5870b32b390d42d562a982f024bae2e86a7075a0d0a6dd
Opcode Fuzzy Hash: fc272feec94f982cfccca948965381368a6e3e03231450a1521213e41d60318e
Instruction Fuzzy Hash: 9D112671800349DFDB10DFAAC845BDEBBF5EB48320F148819E519A7250C7759540CBA1

Function 072760B9 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07276122

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b661369fc442ca81b08cbdf392d3724109736f08b7566313b4bcf8ef664d5bee
Instruction ID: a37946e39b41178c65d88d2395e2e3805abb2607994781fa18ded6c104207153
Opcode Fuzzy Hash: b661369fc442ca81b08cbdf392d3724109736f08b7566313b4bcf8ef664d5bee
Instruction Fuzzy Hash: D31158B1D007498FDB14CFAAC54579EFBF4AB48210F24881AC419A7340C7395901CF94

Function 072760C0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07276122

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 957516e6a8fdd60562bd444c113ffeecb1376a22acd2a57047b554e954f45374
Instruction ID: a18e7bdaad5fa9eeeefacb8a0b8158429fe17a8036aceaac06229011ade94d49
Opcode Fuzzy Hash: 957516e6a8fdd60562bd444c113ffeecb1376a22acd2a57047b554e954f45374
Instruction Fuzzy Hash: 35116AB1D003498FDB20DFAAC84479FFBF4AB88210F248819C419A7340C7756500CFA4

Function 072752E0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0727A855

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6043ecff4bf43441a48814853561b9c0398fad904cf26d2e0b0c74eb564e93c6
Instruction ID: 26aee4c9a187615b16e0d5fc8a02eab435036ede223372c28f9dce7197d44737
Opcode Fuzzy Hash: 6043ecff4bf43441a48814853561b9c0398fad904cf26d2e0b0c74eb564e93c6
Instruction Fuzzy Hash: C111F2B5800749DFDB10CF9AC989BDEBBF8EB48320F108819E918A7210C375A945CFA5

Function 0151AF38 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0151AF9E

Memory Dump Source

Source File: 00000000.00000002.1534599505.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1510000_kzy8qg5lbR.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0ce5dac7e3a770bdfd45de6129d0488b6b2717aebc94898cc99bb2f22251e0e9
Instruction ID: 3d9429473fe62d89271079e147d701656188960870938ee55b56bf7bebc280a4
Opcode Fuzzy Hash: 0ce5dac7e3a770bdfd45de6129d0488b6b2717aebc94898cc99bb2f22251e0e9
Instruction Fuzzy Hash: 8E1110B5C007498FEB15CF9AD444BDEFBF4AB88324F10841AD828A7254C379A545CFA1

Function 0727A7F0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0727A855

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e1a701ccc5b01d6ee22772c21c57af811566f1f4e39b89fc19e07296d2f4174f
Instruction ID: 6326b7256bcf63c30afb98e91165dcd260a0ce36f2dc1aaa7b48cf4fd4d4a7fc
Opcode Fuzzy Hash: e1a701ccc5b01d6ee22772c21c57af811566f1f4e39b89fc19e07296d2f4174f
Instruction Fuzzy Hash: 861103B6C00749DFDB10CF9AC985BDEBBF8EB08320F14881AD518A7210C379A545CFA1

Function 0151D6E1 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0151D6A7

Memory Dump Source

Source File: 00000000.00000002.1534599505.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1510000_kzy8qg5lbR.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a6e3a08d1b22d39a4ed4f5ed0fa1952fb7ecee18b05f9f9cb640eab4d3432217
Instruction ID: 8316a01c6ee1c18daa4737a991ed6bc8dde0f6e982f468eceed09eb16353e18e
Opcode Fuzzy Hash: a6e3a08d1b22d39a4ed4f5ed0fa1952fb7ecee18b05f9f9cb640eab4d3432217
Instruction Fuzzy Hash: 56E0ED37905348CFEB129BA8E408389BBF19F84220F288853C299EB651C2399804CB92

Function 014BD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1534182816.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14bd000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19684585740139d7673bf5e4287c2f5eadd6ca75579d5f95b558632caf6cbc7e
Instruction ID: 2a8de6bc076b85798f0f8f4341554382414bbca1764ee4d3a15c0a8eac5628e0
Opcode Fuzzy Hash: 19684585740139d7673bf5e4287c2f5eadd6ca75579d5f95b558632caf6cbc7e
Instruction Fuzzy Hash: 04212871900244EFDB15DF54D9C0B67BF65FB8831CF24C5AAE8090B266C336D456CAB2

Function 014CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1534227698.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14cd000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8bcb696a191de804787e1a08237e4eededd942190e2b7200503a13a938e9d53
Instruction ID: 4288c28cc66286266d1cd843e6c1e726c645b3bc71372acb128db328e9652f68
Opcode Fuzzy Hash: e8bcb696a191de804787e1a08237e4eededd942190e2b7200503a13a938e9d53
Instruction Fuzzy Hash: 572106B9904204DFDB55DF59D880B16BB61FB84618F20C57ED80A0B366C336D407CAA2

Function 014CD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1534227698.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14cd000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa97f8106dc425c416b40517287155286b0605e3c781fda7d3c644cf4ff56d8
Instruction ID: d3efac7169cddd38bea7b687446444a14b36b596d6a7e91d6abc17725dbe26a3
Opcode Fuzzy Hash: afa97f8106dc425c416b40517287155286b0605e3c781fda7d3c644cf4ff56d8
Instruction Fuzzy Hash: 54214979904304EFDB41DF94D9C0B26BB62FB84B24F20C57EE8094B362C336D406CAA2

Function 014CD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1534227698.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14cd000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecbaa34ea22dfaf0e3393bdc5e7c8c29ba2989f6badcc92bc5cbf88a5955f13
Instruction ID: b63a58fed240242854baad0dcbee472c0921bac407a8cff31edaa5076696235d
Opcode Fuzzy Hash: cecbaa34ea22dfaf0e3393bdc5e7c8c29ba2989f6badcc92bc5cbf88a5955f13
Instruction Fuzzy Hash: C72183755093809FC712CF24D994716BF71EB46214F28C5EFD8498F667C33A980ACBA2

Function 014BD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1534182816.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14bd000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction ID: 484fe1c267e4961d1db2b8befc840dc0f7594433b1a045ef99a5ab11b4245b54
Opcode Fuzzy Hash: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction Fuzzy Hash: F611B176904280DFCB16CF54D9C4B56BF71FB84318F24C6AAD8490B667C33AD456CBA2

Function 014CD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1534227698.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14cd000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction ID: ae09bf3267b9ec27f54ff78a33081edb0a484be7b0623e332ffdbda833cb5a87
Opcode Fuzzy Hash: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction Fuzzy Hash: B411AC79904240DFCB02CF54C9C0B16BB62FB84624F24C6AED8494B766C33AD44ACB92

Function 014BD759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1534182816.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14bd000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276a556d696346d7464b88d6433214db8b675da2a2ebe1c57e486f3126656fe5
Instruction ID: c54d3b5d3de4b15dcb19db69bbb90c6e681796506529215437c789fc4931b662
Opcode Fuzzy Hash: 276a556d696346d7464b88d6433214db8b675da2a2ebe1c57e486f3126656fe5
Instruction Fuzzy Hash: BB01AC71804384ABE7104AA9DCC47D7BBD8EF41624F188597DD090A356C3799441C6B2

Function 014BD758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1534182816.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14bd000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afb28717b471bdac58ea16c5b878c27468d05fe0c9236253475be31acc6dd001
Instruction ID: 47d089af2d09b78a9fc3262ee7f50bb01a9e6ede6ac68c4951d57d4a8b674898
Opcode Fuzzy Hash: afb28717b471bdac58ea16c5b878c27468d05fe0c9236253475be31acc6dd001
Instruction Fuzzy Hash: 4AF06271404384AEE7108A5ADCC4BA3FFE8EF41734F18C59AED084A397C2799844CAB1

Non-executed Functions

Function 07276170 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

bi, xrefs: 072761CB

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID: bi
API String ID: 0-1891080015
Opcode ID: a840456eecb6dfb1cd552d209e3fdfaa22bd81665fc548bbd18f661b349e4afe
Instruction ID: 9befd85084c52a43da7ff8d73480e9a957b7bf37d8b8acc101bdb928a1e48c3a
Opcode Fuzzy Hash: a840456eecb6dfb1cd552d209e3fdfaa22bd81665fc548bbd18f661b349e4afe
Instruction Fuzzy Hash: 98E11BB4E106198FDB14DF99C580AAEFBF2BF89305F248169D815AB359D730AD41CFA0

Function 07276160 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

bi, xrefs: 072761CB

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID: bi
API String ID: 0-1891080015
Opcode ID: a7eed0eb2881a5c14f687de1a32e1c7548a3ac39f4316a49f26b8c0816ad72c2
Instruction ID: 9c57329eb481dae31a1e6a78a2cabdd7155aa6b0fc33d3dbea279eadc7b499a3
Opcode Fuzzy Hash: a7eed0eb2881a5c14f687de1a32e1c7548a3ac39f4316a49f26b8c0816ad72c2
Instruction Fuzzy Hash: 11512AB4E106198FDB14DFA9C5805AEBBF2BF89201F248169D418AB255D7309942CFA5

Function 0727C678 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935d973652525b79c001729163a8fadcbd33bbe1836d8bc4ddb00187c7b73475
Instruction ID: 462ec0c7ce95a04fc86680453b365746afa29927e1a713f31018c6f3b58b4a79
Opcode Fuzzy Hash: 935d973652525b79c001729163a8fadcbd33bbe1836d8bc4ddb00187c7b73475
Instruction Fuzzy Hash: 5AD1CAB17113468FEB2AEB75C560B6EB7FAAF89600F10846DC106DB294DB34E941CB61

Function 07274628 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f48fbf5d9d989de78ed4e79cfa00f20476308905e4158a425f545b358da2ed
Instruction ID: aeff2c83ae000e71539de58e455352108ef3158235fd8984221f1713483f09f1
Opcode Fuzzy Hash: 10f48fbf5d9d989de78ed4e79cfa00f20476308905e4158a425f545b358da2ed
Instruction Fuzzy Hash: 28E12CB4E102698FDB14DFA9C580AAEFBF2BF89305F248169D815AB355D7309D41CFA0

Function 07273DB8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6b8f9cde0fc046e70bf0312286e6f26bbbc873ae1ea88745c767c0866a0315
Instruction ID: c88b00b8ca04b042b5a2e53c785f700a96a834c97230955a2b7e776a920e4d21
Opcode Fuzzy Hash: dc6b8f9cde0fc046e70bf0312286e6f26bbbc873ae1ea88745c767c0866a0315
Instruction Fuzzy Hash: D7E11AB4E102598FDB14DFA9C580AAEBBF2FF89305F248159E814AB355D731AD41CFA0

Function 07273980 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59e895ab1c30530b29c408cae4091903e1eec1daf1713442797fe3b32549509
Instruction ID: 012b69aec5109d4a6da4f1f7c204ddf82736605a4e10360cb00365c65e5e136f
Opcode Fuzzy Hash: f59e895ab1c30530b29c408cae4091903e1eec1daf1713442797fe3b32549509
Instruction Fuzzy Hash: 8EE119B4E102598FDB14DF99C580AAEFBF2BF89305F248159D815AB35AD730AD41CFA0

Function 072741F0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd6a1d2a34741ba04e1f4e38449172ff46ed92621d2a8ccf85d8e20314cf51cc
Instruction ID: 5be292db89b77b72d4f7b3bf31a3ae1ce5074e5f673010cf39f325d87f9432aa
Opcode Fuzzy Hash: bd6a1d2a34741ba04e1f4e38449172ff46ed92621d2a8ccf85d8e20314cf51cc
Instruction Fuzzy Hash: 69E109B4E102598FDB14DFA9C5809AEBBF2BF89305F248169E815AB355D730AD41CFA0

Function 0151D304 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1534599505.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1510000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5915e06ceef773f1d16d62872b36708c5e16848c07172a98b6fe3e3a81163dee
Instruction ID: 0574f9af69624aa72f16d3a14e1bc77d7ce36aec5d215220c812c7265a55a9d9
Opcode Fuzzy Hash: 5915e06ceef773f1d16d62872b36708c5e16848c07172a98b6fe3e3a81163dee
Instruction Fuzzy Hash: 2BA19236E00216CFDF16DFB5C84059EBBB2FF84300B15856AE906AF265DB71E95ACB40

Function 07274618 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554121405.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac78aae73a996befe2aa2fa3d13a59ad2c5d3fda7004a047288d64c917c824b
Instruction ID: 8ca8d6903b2300f248565cdf23f0c0fe2f261e534092d3ce6849016683efe9dc
Opcode Fuzzy Hash: 9ac78aae73a996befe2aa2fa3d13a59ad2c5d3fda7004a047288d64c917c824b
Instruction Fuzzy Hash: F8512AB5E1026A8FDB14DFA9C5805AEFBF2BF89301F24C169D818AB355D7319941CFA0

Analysis Process: kzy8qg5lbR.exePID: 7248, Parent PID: 1976COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 013B9B38 Relevance: 2.8, Instructions: 2817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d29ef3e31a5e22a46e776a9d89a069d659b6ff3fe78462037cd4374d789f3339
Instruction ID: da8375f2c4ead1363b035e37135073865a521d320c49a2f11a27ee766241339d
Opcode Fuzzy Hash: d29ef3e31a5e22a46e776a9d89a069d659b6ff3fe78462037cd4374d789f3339
Instruction Fuzzy Hash: F553E531C10B1A8ADB51EB68C8845E9F7B1FF99300F51D79AE45877121FB70AAD4CB81

Function 013BCDB0 Relevance: 2.3, Instructions: 2317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1008f752f3862cec7282999af59558070a23094758bd97c347b674c42d242fcd
Instruction ID: 18215a79ef1bcc077278cc3b81d3cbab5ec268b88f3dc280d6e2eeef41cfd839
Opcode Fuzzy Hash: 1008f752f3862cec7282999af59558070a23094758bd97c347b674c42d242fcd
Instruction Fuzzy Hash: D6333C31D1071A8ADB11EF68C8846EDF7B1FF89304F14D69AE549A7211FB70AAC5CB81

Function 013B9364 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29449a008995dc18788d00490c494de3dcd115d440b7f4f4f4f90e549967700f
Instruction ID: dc55ad7dd09c28ada43742f0f3ed3767202b0f2e86583623ca7efc484352d676
Opcode Fuzzy Hash: 29449a008995dc18788d00490c494de3dcd115d440b7f4f4f4f90e549967700f
Instruction Fuzzy Hash: EBE17F74B002148FDB15DF69D894BAEBBF2EF89318F104529E606EB751EA35ED41CB80

Function 013B96E0 Relevance: .4, Instructions: 358
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2ac363b9af3018ddf234941e0dbb46c4373f14ef372e2cb60923510ce1dc6a
Instruction ID: 2efd554194b0fc4f2c47527f7263568d2352dee9c5de268b5625fbee87c69306
Opcode Fuzzy Hash: 6a2ac363b9af3018ddf234941e0dbb46c4373f14ef372e2cb60923510ce1dc6a
Instruction Fuzzy Hash: 92C1AF70A002058FDB14DF6DD8807AEBBB5FF88318F208569E609EB791E731D841CB90

Function 013B41C8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34277ffa2f642064b86d9942a326b92e1bf2b8f61b51f0331aca9659f1bf2f24
Instruction ID: 1809af7327b4f9c25146226decd0f5b5d3f5e2a6976eb65817f53ef155a69492
Opcode Fuzzy Hash: 34277ffa2f642064b86d9942a326b92e1bf2b8f61b51f0331aca9659f1bf2f24
Instruction Fuzzy Hash: A7B16070E00209CFDF14CFA9D8857EEBBF2BF88318F148129D51AAB655EB349851CB55

Function 013B4A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b5a209898ab7ab80ccfc25a0ec4f4943bdd7a8cfe0238d44ac339253677551
Instruction ID: 64c8963a10237486b858d9982ae9da35400967ff87efa04601d308253341eea4
Opcode Fuzzy Hash: e3b5a209898ab7ab80ccfc25a0ec4f4943bdd7a8cfe0238d44ac339253677551
Instruction Fuzzy Hash: 35B16B70E00209DFDF10CFA8D8817EDBBF2AF88718F148129DA16EB655EB349845CB85

Function 013B3E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610152d8ede836d6282e973d8e93446d7bc4b25714d09b9082f551233ff3ac2a
Instruction ID: 5d94da1d270e79c9fc9bad2b7acb9002ffda12493bb27a1de83b1a4e92b8e3b4
Opcode Fuzzy Hash: 610152d8ede836d6282e973d8e93446d7bc4b25714d09b9082f551233ff3ac2a
Instruction Fuzzy Hash: 20917B70E00209DFDF14CFA9D8857EEBBF2BF88318F148129E505AB694EB749845CB95

Function 063AE278 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 063AE2E7

Memory Dump Source

Source File: 00000009.00000002.2777516696.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_63a0000_kzy8qg5lbR.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2b81fc769cc70645a5362f3f51d13801ec6eaaca0a29e4242e94d8d62977e654
Instruction ID: 967defa998bf2e67a21228d284cfc0043e5fb3922296366f2b23842699bf826e
Opcode Fuzzy Hash: 2b81fc769cc70645a5362f3f51d13801ec6eaaca0a29e4242e94d8d62977e654
Instruction Fuzzy Hash: 1F217571C0025ADBDB24DFAAD440B9EFBF4EF48320F14812AD858A3240D778A841CFE1

Function 063AE280 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 063AE2E7

Memory Dump Source

Source File: 00000009.00000002.2777516696.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_63a0000_kzy8qg5lbR.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: b64466bc1f89e55f5d382e4d07b44f3f66a25e01669ab0f31115b4e039c198ed
Instruction ID: 5861f149a70cba6e4a9fbf9f19e6f4670d1cea7e23d65c68d717e1d7575152ee
Opcode Fuzzy Hash: b64466bc1f89e55f5d382e4d07b44f3f66a25e01669ab0f31115b4e039c198ed
Instruction Fuzzy Hash: C811E2B1C0065A9BDB10DF9AD444B9EFBF4AF48320F15816AD818B7240D778A954CFA5

Function 013B7908 Relevance: .6, Instructions: 557
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581c293fff4147817b8cfae9620064dd5bb308407b5bc02b53f663d19e54c86d
Instruction ID: f319279007ceda48366dc225678add1928f2dc77cd68e0f90d555d2ac6ffae22
Opcode Fuzzy Hash: 581c293fff4147817b8cfae9620064dd5bb308407b5bc02b53f663d19e54c86d
Instruction Fuzzy Hash: 3A124D387102168BDB29AB3CE4946A8B2E7FBC9244B104A79D606CB355DF71F8468FC1

Function 013B41BC Relevance: .3, Instructions: 282
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425bb4c0fb2e34dbfe8ce2031578e33dc83bf7176511ba070ae0bc90ba180f9d
Instruction ID: 3d340e8796a86a2980fd3558f4f7189e02868ad7426c84d1ec9ff43c5e1fd5e2
Opcode Fuzzy Hash: 425bb4c0fb2e34dbfe8ce2031578e33dc83bf7176511ba070ae0bc90ba180f9d
Instruction Fuzzy Hash: 13B17070E00209CFDF10CFA9D8857DDBBF1BF88318F148129D51AABA55EB349851CB95

Function 013B4A8C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b937715b67ffd566e7a18a5a49062ae744035071d6cc31f6ab48aa6d40e92909
Instruction ID: c62ee67101c649d016696db91d779ee32ef1531bdcb3e68c8c2ea9cd050545d9
Opcode Fuzzy Hash: b937715b67ffd566e7a18a5a49062ae744035071d6cc31f6ab48aa6d40e92909
Instruction Fuzzy Hash: 36B17D70E00209DFDF10CFA8D8817EDBBF1AF48718F148129D656ABA56FB749845CB89

Function 013B3E74 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784b757a55c6d58f459c3541fd601049b30fff13bc24aada534148828a8b453f
Instruction ID: cc3a012c1bc8ebe7cd2f450f9deb17fa04138a2120737d87e60f25017d429064
Opcode Fuzzy Hash: 784b757a55c6d58f459c3541fd601049b30fff13bc24aada534148828a8b453f
Instruction Fuzzy Hash: C6A18B70E00219DFDF10CFA8D8857EEBBF1BF88318F148129E505AB654EB749846CB95

Function 013B4804 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14133dc1f52fab04a29fae2a3be6ce590a04fe06a7ad09d0898bf4bd5cc36df7
Instruction ID: 36bc5a787f12ed2238d6bdce2f9ba810065c2606f6af52b9ed49a1b9dcd3a761
Opcode Fuzzy Hash: 14133dc1f52fab04a29fae2a3be6ce590a04fe06a7ad09d0898bf4bd5cc36df7
Instruction Fuzzy Hash: DB719D70E00349CFEB10CFA9D8807DEBBF1BF88718F148129E516A7651EB359841CB99

Function 013B4810 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed777a65d69bd42a4f8a4b945448c086d125eca37e4d44d9f3047eceb78978ed
Instruction ID: 2c781ae1302cb8b110818285f47a75cc6cf92beb6cda6cb6bc3b681160b1f40a
Opcode Fuzzy Hash: ed777a65d69bd42a4f8a4b945448c086d125eca37e4d44d9f3047eceb78978ed
Instruction Fuzzy Hash: 39718E70E00349DFEB14CFA9D8807DEBBF2BF88318F148129E516A7655EB359841CB99

Function 013B6ED8 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38d08f5a75db5993ed0458306c77affae25acac517be90ab3d7a2583f5cae5b
Instruction ID: c22ecc02c86742608e651b8bf5250ebcdce8f70536e53c1ebcaf63dcffa73621
Opcode Fuzzy Hash: f38d08f5a75db5993ed0458306c77affae25acac517be90ab3d7a2583f5cae5b
Instruction Fuzzy Hash: BE51E574E002198FDB15DF68C4917EEBBB2FF85304F50856AE606EB681EB719C46CB90

Function 013B6CDF Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6246f565e7fd3d95bb714f26ecb7c02c6ccbb09758ab215e270fb1e1983e021f
Instruction ID: bd0e3bc084ca53cf8f5e6d1a838768c4a01d4b56c8b117927d7e5e8a0b659ab7
Opcode Fuzzy Hash: 6246f565e7fd3d95bb714f26ecb7c02c6ccbb09758ab215e270fb1e1983e021f
Instruction Fuzzy Hash: BB5124B1D102188FDB18CFA9C885BDDBBB1BF48304F14812DD919BB752E774A844CB94

Function 013B6CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46038e8b3b92b05e6689e94e7056cb6135dd3dd11c59048e20f6f3b1e9f295af
Instruction ID: 26c4b4970af734fd16df5efbccff204ad3f6aac40a49bfc42480c1211e8b42c6
Opcode Fuzzy Hash: 46038e8b3b92b05e6689e94e7056cb6135dd3dd11c59048e20f6f3b1e9f295af
Instruction Fuzzy Hash: 4F5124B0E102188FDB18CFA9C885BDDBBB1BF48304F14811DD919BB791E774A844CB95

Function 013B1128 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0009f5bab4f6a2c418a75006e6714c48a5d7753af84a53c9680fea78b3a70a2
Instruction ID: 192f6dada109735dca87265e54e065eb8e4bd0b94399944274deb228fa4cfcec
Opcode Fuzzy Hash: b0009f5bab4f6a2c418a75006e6714c48a5d7753af84a53c9680fea78b3a70a2
Instruction Fuzzy Hash: DF512034E42256CFCB0AFB7EF9A09953BB5B7A67047008B69D2084767EEB203905CB41

Function 013BF2ED Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b514b753db26982a189b5ec940028c856715e319bc1b9d9d063bf098cc8654f
Instruction ID: 78ec50cb0e04d816c94af4c1826572ec8e2589b076ca35a7406e0a2b2baf030b
Opcode Fuzzy Hash: 5b514b753db26982a189b5ec940028c856715e319bc1b9d9d063bf098cc8654f
Instruction Fuzzy Hash: 8A41F1307002058FEB1AAB78D8546AE7BA6AFCA614F144568D406DB796EF35CD42C780

Function 013B1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886d363e680d1c29d014f0fb483e7907b4ee43ba23e4b58d063d985f13cff512
Instruction ID: 7c05297ebc8af4492422c85949ffd75275b994ac9c77553a22ddd43776ec4112
Opcode Fuzzy Hash: 886d363e680d1c29d014f0fb483e7907b4ee43ba23e4b58d063d985f13cff512
Instruction Fuzzy Hash: 14510134D52256CFCB0AFB6EF9A09853BE5B7A57047008B69D2084767DEB707905CB41

Function 013BF1B0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38573f879b39004b55284af4450d6f989de9b4979947493e1e71f0d3a9143194
Instruction ID: 4c3e2867685970258bdf2eb69798e6abc54b5fff6aaa5fd8af35591802163654
Opcode Fuzzy Hash: 38573f879b39004b55284af4450d6f989de9b4979947493e1e71f0d3a9143194
Instruction Fuzzy Hash: 39319339E102059BDB15DFA9C8946DEB7B6FF89304F108519E906EB741EB70AC428B80

Function 013B26DC Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54afcb5bc1d807bbd5e292fa53e3e33260016f835d5a05f86b42b187c0bfdcb2
Instruction ID: 5d0df2aa6a613e4fdf25cc75edcebc5de9775e825732e331335b242f948e95a9
Opcode Fuzzy Hash: 54afcb5bc1d807bbd5e292fa53e3e33260016f835d5a05f86b42b187c0bfdcb2
Instruction Fuzzy Hash: 80411FB4D0034CDFEB10CFA9C884ADEBBF4BF48314F14802AE509AB250EB75A945CB94

Function 013B6F78 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e082fdf3e700c8e59c8f14f72feea2fc2fc578d9c617aaff2774bcc1b20197db
Instruction ID: 24cfad7b87df892f2f18c7863a0e7faaf5a2a08a1439de38f56938ef7985f5d8
Opcode Fuzzy Hash: e082fdf3e700c8e59c8f14f72feea2fc2fc578d9c617aaff2774bcc1b20197db
Instruction Fuzzy Hash: 7D319074E00219CBEB15CF69C4807DEB7B2FF89304F108526E606EB681EB71A945CB50

Function 013BF1C0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1295984c343d8a345838b9d35cc2da832f04129f648f015bd2008940e948099f
Instruction ID: d914684f20b4603fa36c104ac64ff878e16b436fbad3c512d1877d1946f47e1b
Opcode Fuzzy Hash: 1295984c343d8a345838b9d35cc2da832f04129f648f015bd2008940e948099f
Instruction Fuzzy Hash: 3B318238E106059BDB15DFA9D89469EF7F6BF89304F108519E906EB750EB71EC42CB80

Function 013B26E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de6a47bd973c2d521b1d87c1a02cec88dffb07d6b3d75e5f7f9c46d5ed0d2c5
Instruction ID: ad6194defe782ebd62b137914e6b38500d82c0a107067281927c92109c73db14
Opcode Fuzzy Hash: 2de6a47bd973c2d521b1d87c1a02cec88dffb07d6b3d75e5f7f9c46d5ed0d2c5
Instruction Fuzzy Hash: C241EFB4D0034CDFEB14CFA9C484ADEBBF5BF48314F148429E919AB250EB75A945CB94

Function 013B50A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1541d2f7e9653a2f8990420cf917d273a2c77007dad20f57e51ccc24543f3dd0
Instruction ID: d71b95ec55092b350fb853d0883237d64325fd5462e98d29b19222995f089fe9
Opcode Fuzzy Hash: 1541d2f7e9653a2f8990420cf917d273a2c77007dad20f57e51ccc24543f3dd0
Instruction Fuzzy Hash: 6F316E30B00216CBDF25EB78C5A06EE77F2AB89648F100568C605AB7A4EB36DC41CB91

Function 013B5099 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2005961a77e7e3ffa6acc7972359d8676d644820daddcb271c13f05c0595b38c
Instruction ID: 81a900d082ee6e353400852d49abe0b54e49ec85ac80e07b24358341ffeefa84
Opcode Fuzzy Hash: 2005961a77e7e3ffa6acc7972359d8676d644820daddcb271c13f05c0595b38c
Instruction Fuzzy Hash: 5B314D30B04215CBDF25EB78C5A06EE77F2AF49248F100568CA05AB7A5EB36DC41CB91

Function 013B9250 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb50204032a036032037cafc099cb0e240dc154ef16117a84b514007f398ffd4
Instruction ID: 1cc8331da61161855fc6e18df365879d82b4fd86cba529115493264147fa0f97
Opcode Fuzzy Hash: eb50204032a036032037cafc099cb0e240dc154ef16117a84b514007f398ffd4
Instruction Fuzzy Hash: C3319375E0020A9BDB05DFA8C4907DEF7B2BF89308F148619E605AB741E771A842CB90

Function 013B9260 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ff6f8dda8dce7eb47e4d414086bc5677590313f4c3f529d96fc8baabb615ec
Instruction ID: 6a25aa6be314ac3b68f446e47afa12ed05156fa307a68b53be1256da93b6ae0d
Opcode Fuzzy Hash: c8ff6f8dda8dce7eb47e4d414086bc5677590313f4c3f529d96fc8baabb615ec
Instruction Fuzzy Hash: 1F216574E1020A9BDB05DFA9D4907DEF7B2FF89308F148615E605EB751EB71A842CB90

Function 013B16A0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a5f7deb81e4c1f4e2555c5069ba5feb6c3c0c82b0a4249b8a1661e6b5d9613f
Instruction ID: 94c11d897e919ed734d332edadba098cd90e8bc7de0c5a01caf355fbf75c2f1a
Opcode Fuzzy Hash: 9a5f7deb81e4c1f4e2555c5069ba5feb6c3c0c82b0a4249b8a1661e6b5d9613f
Instruction Fuzzy Hash: 8C21F438A012118FEF23AB3DF8A47DA3361FB85B18F145B21D50AC7A56FB25C8458B91

Function 013B9150 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45759294a85e7565993c7af684e083c77059bacb4a6bb88357898627abaa9e50
Instruction ID: 2877fe5d81c150dc3e35ab362e166b1241ed1059d04eff5dd0153229d744f439
Opcode Fuzzy Hash: 45759294a85e7565993c7af684e083c77059bacb4a6bb88357898627abaa9e50
Instruction Fuzzy Hash: AA21B774E0021ADBDB19CF68D4846DEF7B2AF85308F10852AEA06FB741EB71D942CB50

Function 013B1380 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b22d07aa4afd27f12397451b932149807ca4dd3a703dc2ce04c8c1f01461ab8
Instruction ID: 5c0f15acee6fc40b29de215aa5361517afc070399723c9d5ebfb1ad819ad06e7
Opcode Fuzzy Hash: 9b22d07aa4afd27f12397451b932149807ca4dd3a703dc2ce04c8c1f01461ab8
Instruction Fuzzy Hash: 6721A174E412108BEB36576DF4A83A93761E742319F51083AD60BDBE86FA298884C792

Function 013B4F88 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8518e341c8b6bfc9d30604dbf091d23a20cfc34d66dbede94478cdbeec318a1d
Instruction ID: c9f1a4609491543c55dfcbf7cabb88bfe76d4436c3253df05861975996403186
Opcode Fuzzy Hash: 8518e341c8b6bfc9d30604dbf091d23a20cfc34d66dbede94478cdbeec318a1d
Instruction Fuzzy Hash: 0C214834B00205CFDB64DB78C5A86AD77F1AF8D304F100468E606EB3A5EB319D05CB90

Function 0136D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767404361.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_136d000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5f9009366f558f83721f499829295877dc279555cdec58239f372e955a5f10
Instruction ID: 17f2b688552d57909afd0dc51163c94d4fe88976d4328486433fa7561761ffb4
Opcode Fuzzy Hash: 2f5f9009366f558f83721f499829295877dc279555cdec58239f372e955a5f10
Instruction Fuzzy Hash: 76212571604344DFDB15DF64D880B26BB69FB84318F24C56DE88A0B64AC337D407CA62

Function 013B9160 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463613f32a87b0d262f7d1fb61213c927c4d2b58f5b6cc9b64bf15fb96d04b83
Instruction ID: f37bc34e5afa3bce881662a2ee4f1ccda1ed19429501996ae92168df8203a796
Opcode Fuzzy Hash: 463613f32a87b0d262f7d1fb61213c927c4d2b58f5b6cc9b64bf15fb96d04b83
Instruction Fuzzy Hash: 6021AA74E0021ADBCB19CF68D4946DEF7B2AF85308F10851AEA15FB741EB71D945CB50

Function 013B1888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0859c3d843e78c47060f9f4d2a9f6586095917834008bfa8e0c7ba6562f9dcc
Instruction ID: 680bb79f94b517ec8d56f6f724343fd6ab3247834b3f0e58b6e6929b273bba6f
Opcode Fuzzy Hash: d0859c3d843e78c47060f9f4d2a9f6586095917834008bfa8e0c7ba6562f9dcc
Instruction Fuzzy Hash: 31215C30B04255CFDB64EB68D5A47EE77F6AB89248F100468D606EB764EB329C40CBA1

Function 013B16B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca340c0900b01968b1cd3ad91b43858280f9af10c87eeb5addb5bca193db9ea
Instruction ID: 9dfbd6eda10d69acc2a533eded9b1d04183493216b156e0846582149d0e78cf8
Opcode Fuzzy Hash: 9ca340c0900b01968b1cd3ad91b43858280f9af10c87eeb5addb5bca193db9ea
Instruction Fuzzy Hash: 0D218438A012158FDF22E76DF8947DA3355FB85A18F104B20D50AC7656FB35D8458B91

Function 013B1879 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f35c52e9d420ddd019f779b4d7c04877d011680c41d31a883cf9fd114641fae0
Instruction ID: 97b832a84b0a7ab9c92a030243f26ba20c7a2fd854a2750da6596ce0e5d6092d
Opcode Fuzzy Hash: f35c52e9d420ddd019f779b4d7c04877d011680c41d31a883cf9fd114641fae0
Instruction Fuzzy Hash: 9C215C30B04255CFEB64EB78D5A43EE77F1AB49249F200468C206EB7A5EB368D00CB91

Function 013B4F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d3495971f5257cddd29404df07f924be26e3e6f5a294184e96cc164be36161
Instruction ID: 417ee70cf8fbc63b3d8c69796ff726c4345d14839f057b13cad309f3ddf6cc8b
Opcode Fuzzy Hash: 53d3495971f5257cddd29404df07f924be26e3e6f5a294184e96cc164be36161
Instruction Fuzzy Hash: 08213C30B00219CFDB68DF79D5A8AAE77F5AF89714F100468E506EB3A5EB719D00CB91

Function 013B17C3 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9093d9995482232f8cca4be153d99ca803b54de561f0aa5fc0404eaec72ba66d
Instruction ID: 27218ee22ca47d761f91ae94eea11b7a3f904faa67dc3d4700515665c7ac8f67
Opcode Fuzzy Hash: 9093d9995482232f8cca4be153d99ca803b54de561f0aa5fc0404eaec72ba66d
Instruction Fuzzy Hash: 76112676F402168FCF10ABBAA8A52AE3FE9FB44610F100579D706D3741EA31C802C784

Function 013B148B Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a898636e8a1b5f6136c704e96a782f6f53ef41cd639b38bcb6457a19d68363
Instruction ID: 9651e93335ec118a4e15a81ff865d46e2c72df2f083ea1a1ad2d0de85acd55ed
Opcode Fuzzy Hash: a4a898636e8a1b5f6136c704e96a782f6f53ef41cd639b38bcb6457a19d68363
Instruction Fuzzy Hash: 7F11B632B002558FCB15AFBCA4E05FE7FB5EF88258B1440BAD605E7A02F635C9428BD1

Function 013B6B9F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb9093d4d733113fb3ddb85b3d20911ffef1de9d62c01571179954f5b1a639b
Instruction ID: 83ea6280826649e790960311c6e04f1f769cd007c70eebdab2889fdcdafc1a65
Opcode Fuzzy Hash: ceb9093d4d733113fb3ddb85b3d20911ffef1de9d62c01571179954f5b1a639b
Instruction Fuzzy Hash: EA1104717082858FC716AB7D94612EE7FB2EFC7204B1480EBC646CB653EA395C06C3A1

Function 013B80F1 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d249238c90f7ab2c969cd8300051da477756fd2342004226c423dc99662fa7
Instruction ID: 388eeb9dce9a916d44da695d6a111608d3f7e8380a91a688657c4d0145fe4adc
Opcode Fuzzy Hash: a0d249238c90f7ab2c969cd8300051da477756fd2342004226c423dc99662fa7
Instruction Fuzzy Hash: 2711B138A00219DFDF01EBBCF8906DD77B5FB84704F0046B9C609D7255EB31AA058B91

Function 013B0838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0866be860e138160648774f5e77be9bc5f9290fe8a8fdb405868ddf48235954d
Instruction ID: 2f3a9cdce4babe1a5b1764db0070aae5655e60c0a77d00e2dc76ca853a99b5f2
Opcode Fuzzy Hash: 0866be860e138160648774f5e77be9bc5f9290fe8a8fdb405868ddf48235954d
Instruction Fuzzy Hash: 08119B31F052144BEF2A5B7DD4903EB3B71FB81618F148A79E247DB682FA64CA458BC1

Function 013B0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9fdccae644e7f80f17a1d5228bcebdd03c01a6e9a49aca2c9aeb7ac373398c
Instruction ID: cacdd704b7105308bd804334a767b31aa209f87a1897f611b3565e7c91464adc
Opcode Fuzzy Hash: cd9fdccae644e7f80f17a1d5228bcebdd03c01a6e9a49aca2c9aeb7ac373398c
Instruction Fuzzy Hash: EB119B30B012088BEF2A5B7DD4947AB3675FB81618F104A39E207CF652FA61CE454BC1

Function 0136D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767404361.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_136d000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction ID: 7326b28c62850360c15e59904256b6606d5da6f18bb7d1bfa3b718fdeb85103e
Opcode Fuzzy Hash: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction Fuzzy Hash: 00118E75604280DFDB16CF54D5C4B15FF71FB84318F24C6A9D8494B65AC33AD44ACB62

Function 013B1498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c10cf4a9bc8938d55c66f3490bac5d1cc9f795ddb01be30229a7c724ebce9b
Instruction ID: 355efc21f9d16e5d5877006c87b96e1d598f44a50b5e38940967def8cbf62d7a
Opcode Fuzzy Hash: e5c10cf4a9bc8938d55c66f3490bac5d1cc9f795ddb01be30229a7c724ebce9b
Instruction Fuzzy Hash: 52012D31B002159FCB25EFBD94A02EF7BF5EB88218F14047ADA06E7701F635C9418B95

Function 013B1524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00de9e8582e7a221150e993b8d2c65b6a91ca164aea8726aea03861664552673
Instruction ID: cae9b6ea81aea43ee21e4dcb7260f6222078034f770d7a35b5ba8ab811802fa0
Opcode Fuzzy Hash: 00de9e8582e7a221150e993b8d2c65b6a91ca164aea8726aea03861664552673
Instruction Fuzzy Hash: E6F02B33B04114CFDB228BF8A4E01EC7F75FA9411971C0097D606DBA05F235D402C711

Function 013B7090 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f42ef14f9e9433f51b200f2d881c0200de6c82ee3694b41a19042c4b5ba5cbf
Instruction ID: 871823be6dde1e612ccf4d8451a51083a0771249af346b6999cc9c76213da228
Opcode Fuzzy Hash: 9f42ef14f9e9433f51b200f2d881c0200de6c82ee3694b41a19042c4b5ba5cbf
Instruction Fuzzy Hash: 66F03C39B40104CFC714DB64D5A8B6C77B2EF88715F654069E6068B3A0DB31AD42CB40

Function 013B8100 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2767830092.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13b0000_kzy8qg5lbR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8a1d6382ed0109b83b6faf073cb4a249535ce785c2cf5ed4ce7f06ecfccc94
Instruction ID: 7948de55c98d14483d3a028a731bf32f0b3f35d1bcafec71d5c8102fd28da7e1
Opcode Fuzzy Hash: db8a1d6382ed0109b83b6faf073cb4a249535ce785c2cf5ed4ce7f06ecfccc94
Instruction Fuzzy Hash: C1F03C3490121DEFDF45FBB8F9506EDB7B1BB84600F1047B9C40997254EB322E048B91

Analysis Process: DeQadQO.exePID: 7320, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	197
Total number of Limit Nodes:	8

Executed Functions

Function 070F6108 Relevance: .9, Instructions: 897COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29966e8ad4889b6212b1c924378a77978cb141457870bd6dd43b3f661265b333
Instruction ID: 11c5a663f5b4726ee5e80c05520a4196497525dcba698c14616591a71f2ab9c7
Opcode Fuzzy Hash: 29966e8ad4889b6212b1c924378a77978cb141457870bd6dd43b3f661265b333
Instruction Fuzzy Hash: 02827DB1A0020ADFCB15CF68C984AAEBBF2FF89300F158669E5159B761D772E841CB51

Function 070F2E90 Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7f1311688bba2f32763f4461074baca6f27b8a9ec892b95ee846947068d2c6
Instruction ID: 623a9dabd5eaca05b0d9466ee829a25095ad5dcdf7cbced91fd21fefe6aa8af0
Opcode Fuzzy Hash: 0c7f1311688bba2f32763f4461074baca6f27b8a9ec892b95ee846947068d2c6
Instruction Fuzzy Hash: DA227CB0A002199FDB58DF69D854BAEBBF6BF88310F148129E946EB750DB34DD41CB90

Function 070F35F8 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74017dc12dab7bf07573124c1f67d69b7f1edd9c2fb1a929aeca51d5c5ee4bbb
Instruction ID: 3c4cb986f25016b2c4f857db7ea2a0933d89ed1ef9510ec250a22727283d4e43
Opcode Fuzzy Hash: 74017dc12dab7bf07573124c1f67d69b7f1edd9c2fb1a929aeca51d5c5ee4bbb
Instruction Fuzzy Hash: 68D13CB0A0420ADFCB54CFA9C884AADFBF2BF88760F158265E515AB760D731ED41CB50

Function 0156D3C9 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0156D456
GetCurrentThread.KERNEL32 ref: 0156D493
GetCurrentProcess.KERNEL32 ref: 0156D4D0
GetCurrentThreadId.KERNEL32 ref: 0156D529

Memory Dump Source

Source File: 0000000A.00000002.1578653201.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1560000_DeQadQO.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c63bf6b7ff7d25d0685652a78d8e42a6b93463b8bd29e91d0b5535184192cc88
Instruction ID: 56cb4b5e860c380341325cbe794d91f1897329c966792f818ba7b114285749e3
Opcode Fuzzy Hash: c63bf6b7ff7d25d0685652a78d8e42a6b93463b8bd29e91d0b5535184192cc88
Instruction Fuzzy Hash: AB5179B0A00709CFEB14DFA9D548BEEBBF5BF88300F248459D449AB390D7756944CB66

Function 0156D3D8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0156D456
GetCurrentThread.KERNEL32 ref: 0156D493
GetCurrentProcess.KERNEL32 ref: 0156D4D0
GetCurrentThreadId.KERNEL32 ref: 0156D529

Memory Dump Source

Source File: 0000000A.00000002.1578653201.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1560000_DeQadQO.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 34ddb1005348cdb0a60aa0ae4ee7b43d7aeca2637bae2e2260982f9bbc4be3bc
Instruction ID: 2fb903fd086b502e60a0bde7a73817da91f27b3b366190562e654db579ef5fb1
Opcode Fuzzy Hash: 34ddb1005348cdb0a60aa0ae4ee7b43d7aeca2637bae2e2260982f9bbc4be3bc
Instruction Fuzzy Hash: 91519AB0A00709CFEB14DFAAD548BEEBBF5BF48300F248459D409AB390D7716944CB66

Function 071F69BC Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 071F6BFE

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2a243fa8fef0125f8ec68b4733a0cd5644ae26124757d09fbcb7c57071300448
Instruction ID: 4d152335892b4ef7f2a861b363972246d1b5041d7197e8fe4c90e973c01046ff
Opcode Fuzzy Hash: 2a243fa8fef0125f8ec68b4733a0cd5644ae26124757d09fbcb7c57071300448
Instruction Fuzzy Hash: 67A159B1D0021ACFEB21CF68C8417EEBBB2FF48310F14856AD959A7280DB7599858F91

Function 071F69C8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 071F6BFE

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a147703fb014b9c9d51c0c48d18d8b4d56bf523951e9d75b01c82e2a82a26ef5
Instruction ID: dae313024e1789ac7504e6ef9fe1b15baae6ed9593c745f6e1c9ee65b366d945
Opcode Fuzzy Hash: a147703fb014b9c9d51c0c48d18d8b4d56bf523951e9d75b01c82e2a82a26ef5
Instruction Fuzzy Hash: 539159B1D0031ACFEB21DF68C8417AEBBB2FF48310F14816AD959A7280DB759985CF91

Function 0156AD48 Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0156AF9E

Memory Dump Source

Source File: 0000000A.00000002.1578653201.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1560000_DeQadQO.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2ae319b036e5a6daa34aa31a18f649201539e66f117a2f99ea3e0ed99ae5f8a3
Instruction ID: dabc89f7838f224fd132ecea69dc39107bf5540689015fec1e1ed9049e5ef3a3
Opcode Fuzzy Hash: 2ae319b036e5a6daa34aa31a18f649201539e66f117a2f99ea3e0ed99ae5f8a3
Instruction Fuzzy Hash: 3E815670A00B058FEB24DF69D44479ABBF5FF88204F008A2DD59AABA40D775E849CBD1

Function 0156590D Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015659C9

Memory Dump Source

Source File: 0000000A.00000002.1578653201.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1560000_DeQadQO.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b593c6ba55392e46658ec5f0943edcc44e945bab2e0a378fd59715e858ffaebc
Instruction ID: f7a2dfd7d04f834cf93cf3e9117801b6d4e83cc33939a458af62c354faca2432
Opcode Fuzzy Hash: b593c6ba55392e46658ec5f0943edcc44e945bab2e0a378fd59715e858ffaebc
Instruction Fuzzy Hash: FF41E070C00719CBEB24DFAAC884B8EFBB5BF49304F20816AD409AB250DBB55949CF91

Function 015644E4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015659C9

Memory Dump Source

Source File: 0000000A.00000002.1578653201.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1560000_DeQadQO.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 27d9cd5cc7c60cfbb233be24d8249be035830ad857ad43963551ac56e0f68b99
Instruction ID: f47f45e2db5f39faaef6dde90d7b595860607d03d185388270c55256dcf7f07d
Opcode Fuzzy Hash: 27d9cd5cc7c60cfbb233be24d8249be035830ad857ad43963551ac56e0f68b99
Instruction Fuzzy Hash: 2E41D270C00719CFEB24DFA9C844B9EBBF5BF49704F20846AD409AB251DBB15945CF91

Function 0156D6E1 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0156D6A7

Memory Dump Source

Source File: 0000000A.00000002.1578653201.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1560000_DeQadQO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 77912f2ee8118995bc0c887b8b5b26ab41c6cd399e44a41e93b8dcba67d3d9cd
Instruction ID: 756b85db264a067a11ae856aedbfd2168e4091cc81da3945244c68a1e1544537
Opcode Fuzzy Hash: 77912f2ee8118995bc0c887b8b5b26ab41c6cd399e44a41e93b8dcba67d3d9cd
Instruction Fuzzy Hash: 90317C74AC0384DFE3059F61E4657693BBAF7C8710F10893AE9258B3D8DBB488A5CB50

Function 071F6738 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 071F67D0

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d2c55c55e101a70bb2ee1d4a5b9bb3ce98614535082f20136a2f57292e8a36f7
Instruction ID: 571eeb9e5ca9fc7e797145272e16c578e3fd876416584382721bdcb432d77506
Opcode Fuzzy Hash: d2c55c55e101a70bb2ee1d4a5b9bb3ce98614535082f20136a2f57292e8a36f7
Instruction Fuzzy Hash: A12148B59003499FDB10CFA9C885BDEBBF4FF48310F10882AE519A7240C7789544CBA5

Function 071F6740 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 071F67D0

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e9e176397cd655847ade3f8133bb10994270f5df7fbf28bcecf3ed3c0a65eff3
Instruction ID: cbaa5300fdb32b9fbd25fc8f25d9d8393eb70dac1ee69ac8cb627e36a1fe605e
Opcode Fuzzy Hash: e9e176397cd655847ade3f8133bb10994270f5df7fbf28bcecf3ed3c0a65eff3
Instruction Fuzzy Hash: 8A2125B5900359DFDB10CFAAC885BDEBBF5FF48310F14882AE919A7240C7789954CBA5

Function 071F65A0 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 071F6626

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: de3e6b2fd0340d1225e737400ca5c0cfadfcf50e7c46a638d3e31c258d8e49fa
Instruction ID: fa2f9558e000ae2cc990762943d74f596bf88f40d3b8c41f489bdec53ec39886
Opcode Fuzzy Hash: de3e6b2fd0340d1225e737400ca5c0cfadfcf50e7c46a638d3e31c258d8e49fa
Instruction Fuzzy Hash: EF213AB1D003099FDB10DFAAC8457EEBBF4AF48324F14842AD519A7381D7789945CFA5

Function 071F6828 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 071F68B0

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c1b95c073e02c9bbde1e55fa0be32ea4ce0d485c4227196eba2e50b32a63179f
Instruction ID: 0056d5d6668b7ca180bd22509a3180d96a4073b9ea5c4896c77d908750969c96
Opcode Fuzzy Hash: c1b95c073e02c9bbde1e55fa0be32ea4ce0d485c4227196eba2e50b32a63179f
Instruction Fuzzy Hash: 1F2125B1C003499FDB10CFAAC881BEEBBF5FF48310F14842AE559A7240C7799540DBA5

Function 0156D619 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0156D6A7

Memory Dump Source

Source File: 0000000A.00000002.1578653201.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1560000_DeQadQO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6bd27f5443e94fdae73f6c64b8c28c4b96db829ecf5b14bf2ed4ca12a40cc700
Instruction ID: b9625bb882c5bb298ae3d811112109e8deb92c23df7b3524171befac18463cb6
Opcode Fuzzy Hash: 6bd27f5443e94fdae73f6c64b8c28c4b96db829ecf5b14bf2ed4ca12a40cc700
Instruction Fuzzy Hash: 8F21E5B5900249DFDB10CFAAD884ADEBBF8FB48310F14841AE958A7350D374A944CFA5

Function 071F65A8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 071F6626

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 38b384c8cc0c9a89305f6e844ff30d413b3f66dfcc03219c15f86e451ddae34f
Instruction ID: c5b01275172a78aafdb9bf99b3cff3a8d39504a065f25f2e5ea1de12af071bfd
Opcode Fuzzy Hash: 38b384c8cc0c9a89305f6e844ff30d413b3f66dfcc03219c15f86e451ddae34f
Instruction Fuzzy Hash: CB2127B1D003099FDB10DFAAC8857EEBBF4EF48320F14842AD519A7281CB789945CFA5

Function 071F6830 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 071F68B0

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 380f32aad8c282093906373d5384d32bceb6210889e0e55a471b94a265662383
Instruction ID: 2488ef2a2c8c6c6176764c36434bac86faa85fb55c7ba96e9650ad6edf3271c4
Opcode Fuzzy Hash: 380f32aad8c282093906373d5384d32bceb6210889e0e55a471b94a265662383
Instruction Fuzzy Hash: 162103B1C003499FDB10DFAAC881BEEBBF5BF48310F14882AE519A7240C7799940DBA5

Function 0156D620 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0156D6A7

Memory Dump Source

Source File: 0000000A.00000002.1578653201.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1560000_DeQadQO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 60690603a0b13fc06652cd34b492e4e300768afb1f75b1a0d3617d7ccd2c48b1
Instruction ID: 7bb90f53c0ec31235577d4a7927991b96e4fbadac9a38e2af4857588920db3b2
Opcode Fuzzy Hash: 60690603a0b13fc06652cd34b492e4e300768afb1f75b1a0d3617d7ccd2c48b1
Instruction Fuzzy Hash: EF21C6B5900349DFDB10CF9AD484ADEBBF8FB48310F14841AE958A7350D375A954CFA5

Function 071F6679 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 071F66EE

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e73bd4ee35c3010f4601c09b1120cc4607be3f36b0a177fc5340235c7dba3702
Instruction ID: fee5fd2e313f744ebb445e74dfb2b9ae47b430739837ebec04caf0965c327d6d
Opcode Fuzzy Hash: e73bd4ee35c3010f4601c09b1120cc4607be3f36b0a177fc5340235c7dba3702
Instruction Fuzzy Hash: CD111771900349DFDB20DFAAD844BDFBBF5AB48320F14881AE519A7250D7759950CFA1

Function 071F6680 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 071F66EE

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7d84977ae25fa8d4535eb63d94b1db86d32cb1f6bf266b9ac2f59467702fde75
Instruction ID: 78b5f9904304cc617c8ae66e1f4c5a8000d2c492b87d68adbc16799bf8e08ef8
Opcode Fuzzy Hash: 7d84977ae25fa8d4535eb63d94b1db86d32cb1f6bf266b9ac2f59467702fde75
Instruction Fuzzy Hash: AC112671800349DFDB20DFAAD844BDFBBF5AB48320F148819E519A7250C7759540CBA1

Function 071F60B9 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 071F6122

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: adabdb6cb79cc533a6c1b56f27dae45a2546549a106b2001d9e54e5ec9975e56
Instruction ID: c2dd6bc4f62c5aa38afd022378e393900d8701dc0fbf4cc3f0199c106c151f11
Opcode Fuzzy Hash: adabdb6cb79cc533a6c1b56f27dae45a2546549a106b2001d9e54e5ec9975e56
Instruction Fuzzy Hash: 9A116AB1D003498FDB20DFAAD8457DFFBF4AF88210F24881AD519A7240CB79A900CF95

Function 071F60C0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 071F6122

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2baa7556b3f70fbbc0593aa081147968f688830caacf52e56ca7913eb125a8b5
Instruction ID: 1e5acd437b4df7c06393fab99812d52fe665c80af0452b449dc2abf07853a9dc
Opcode Fuzzy Hash: 2baa7556b3f70fbbc0593aa081147968f688830caacf52e56ca7913eb125a8b5
Instruction Fuzzy Hash: 42113AB1D007498FDB20DFAAD44579FFBF4AB88210F248819D519A7240CB75A540CB95

Function 071F96E8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 071F974D

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d3421eca156c14a9cb87fa450e716adb6dfe3df46662fcb326937413b7b69012
Instruction ID: 795704797208da10656760a88e84dac09fce3c0f5e88113a5a00b8a877c6dfc7
Opcode Fuzzy Hash: d3421eca156c14a9cb87fa450e716adb6dfe3df46662fcb326937413b7b69012
Instruction Fuzzy Hash: 7F1103B5800349DFDB20DF9AD885BDEFBF8EB48314F24841AE519A7241C375A544CFA1

Function 071F52E0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 071F974D

Memory Dump Source

Source File: 0000000A.00000002.1585778970.00000000071F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_71f0000_DeQadQO.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 49dcb488efc856caebab64f79ee719cda6fcbf6fa8d9d185fd66f22ca6ccad8c
Instruction ID: 0c78f1ef385926a17206642737ca304dc2e5309adbe6cfe34278d6e9fffb149e
Opcode Fuzzy Hash: 49dcb488efc856caebab64f79ee719cda6fcbf6fa8d9d185fd66f22ca6ccad8c
Instruction Fuzzy Hash: 3D1103B5800349DFDB20EF9AD484BDEBBF8EB48320F108459E519A7340C3B5A944CFA5

Function 0156AF38 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0156AF9E

Memory Dump Source

Source File: 0000000A.00000002.1578653201.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1560000_DeQadQO.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: af5e3e6bee1b5382a152eed0d649ac4eaeb0482ee80d054ca3bc8550fa2dd941
Instruction ID: 9334a94f1555d5b79adef32d908e61041c372f36edf6ecc28143cade771d744c
Opcode Fuzzy Hash: af5e3e6bee1b5382a152eed0d649ac4eaeb0482ee80d054ca3bc8550fa2dd941
Instruction Fuzzy Hash: 9811DFB5C007498FDB24CF9AD444BDEFBF8AB88214F14841AD929B7250C3B9A545CFA6

Function 070F3BE0 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622460f00bf6a232c7b764f0c83346911f052f9e43e5967e4536259840256a4a
Instruction ID: 6a5e4725e55269edd91c8840ecfe5a1713802544b4b8a607e8827ff54b77e9cb
Opcode Fuzzy Hash: 622460f00bf6a232c7b764f0c83346911f052f9e43e5967e4536259840256a4a
Instruction Fuzzy Hash: 06125BB0A00249DFCB54CFA8D884AAEBBF1BF88314F148659E915DB761DB31EC41CB50

Function 070F7BF8 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dabf15c783c203b8bc91149386a3714e9da560eaf1f4c4256aa7c25f6e96165a
Instruction ID: 5c3ba77ed31dbcf1579dc969fb68a64bcbacee96bac508451b644708573c1a02
Opcode Fuzzy Hash: dabf15c783c203b8bc91149386a3714e9da560eaf1f4c4256aa7c25f6e96165a
Instruction Fuzzy Hash: D5F13BB1A00219CFCB14CFACD584AADBBF6FF88310B5A9169E505AB761CB31EC41CB51

Function 070F5AF0 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: befea776cb05cf45161819fe576bca98c1ef6b757fe8222db883ee29b9b867e0
Instruction ID: d939f69bcb1467ad1377a6fc22ecff93abad2cb50de680cdcc0d04e92117dd61
Opcode Fuzzy Hash: befea776cb05cf45161819fe576bca98c1ef6b757fe8222db883ee29b9b867e0
Instruction Fuzzy Hash: 1CC1E3B16002058FC714CF68CC84A6ABBF6FF85314F558666EA29DB791D731EC21CBA1

Function 070F2410 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7002ae5021490aeccd785291bad739e731790c0dec783832259c649ed5c10cd3
Instruction ID: 6206aa26f068bd13f70ee98a097204330baecd48bdbc0d10afaa54d672f94409
Opcode Fuzzy Hash: 7002ae5021490aeccd785291bad739e731790c0dec783832259c649ed5c10cd3
Instruction Fuzzy Hash: 4DB1BBB53002169FDB15AF34D858B7E7BE6BB89600F148628EA06CB790DFB5DC41CB91

Function 070F5170 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecdda5c3ccb8141170f428cf2d791cde545626f4ace15d7f8ae4791dc543c78a
Instruction ID: 038d2d498d545fa80fd4bd1cb820bac9df74339c6be968d216d1c1266a5198cc
Opcode Fuzzy Hash: ecdda5c3ccb8141170f428cf2d791cde545626f4ace15d7f8ae4791dc543c78a
Instruction Fuzzy Hash: BCB184B03205128FDB649B29CC6873D3AE6EF86A05F19426AF313CFBA1DA65DC51C741

Function 070F3BD0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f0e352973284ae24c6505b0670ab05ee3735f556f0fd4fe8eed8c0446ebfdd
Instruction ID: abc294caa2e4318567a67bd333e0902b445077dd915f35ec1fc38701a86c44fe
Opcode Fuzzy Hash: 99f0e352973284ae24c6505b0670ab05ee3735f556f0fd4fe8eed8c0446ebfdd
Instruction Fuzzy Hash: 0DC14BB0A00249DFCB54CFA9D984AAEBBF2BF89314F148659E915EB761D730EC41CB50

Function 070F2970 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49c904fc44313a8a5890656ab5f422ab772773bb421907dd58d3eb94bfc1ea9
Instruction ID: 54919205a96ae62fef956ac38a5e4f1ed052a7dd33c3e6319d7f318ac4074b13
Opcode Fuzzy Hash: d49c904fc44313a8a5890656ab5f422ab772773bb421907dd58d3eb94bfc1ea9
Instruction Fuzzy Hash: 178190B4A00106CFCB58CF69C884AAEB7F1BF89310F148269DA16D7B64DB31E841CB91

Function 070F6D18 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513f25ecf08f7beeebdea4c107901299dc667307a3e5051ded1d8405d4c3b22f
Instruction ID: 840f7dd0a3d7495ce32884cb045039b963c8792ac5bbd28c5d4e45c234b01406
Opcode Fuzzy Hash: 513f25ecf08f7beeebdea4c107901299dc667307a3e5051ded1d8405d4c3b22f
Instruction Fuzzy Hash: A761C2B2710116CFCB54DF39C994A6A7BE9FF49204B0942AAE616CB761DB33DC00CB60

Function 070F41B0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69cbb7e230388aa4a7c7abe582eb90c8ed1b0c60692a481ccf792d0f675c8066
Instruction ID: 58010a5b6c49b96b7d44a044b75f386156d036e886798ec92249dcc0c7012b50
Opcode Fuzzy Hash: 69cbb7e230388aa4a7c7abe582eb90c8ed1b0c60692a481ccf792d0f675c8066
Instruction Fuzzy Hash: 407137B47102868FCB55CF68C894A6E7BF5EF89250B1941A9FA16CB770DB70EC41CB90

Function 070FC63F Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27ff7ae4c9f285bd1a486a520bfd0f813535188aeb58334771c3faa49ed340cc
Instruction ID: b07679ccf39312de800bdd50776d55ccca2ad6d2808b8861427d86b3e80c894b
Opcode Fuzzy Hash: 27ff7ae4c9f285bd1a486a520bfd0f813535188aeb58334771c3faa49ed340cc
Instruction Fuzzy Hash: 7851EEB0E0024D9FEB18DBA9D4517FFBAB2BF84710F108225E655A77C0CB745942CB91

Function 070F71B0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ce1e4b406868e9337bbbeb7e6273cb5c26b150aec36dfca426b9ff203a090a
Instruction ID: 1b51ece5cb9ce81ebd7dd569a3495eb4a0112080817090a0f404db72d54bf478
Opcode Fuzzy Hash: c5ce1e4b406868e9337bbbeb7e6273cb5c26b150aec36dfca426b9ff203a090a
Instruction Fuzzy Hash: ED618DB0E0034AEFDB16CFA5C5406DEBBF2AF8A300F649319E905BB641D770A941CB41

Function 070F8D74 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 242269b60feef5d79df524198c06251d3e95cd87f73e2ca21d1b96471abfc560
Instruction ID: 89f085613bba67f4e956c33512c4567c469538dc8d0b92fff326f0f3e4fd3654
Opcode Fuzzy Hash: 242269b60feef5d79df524198c06251d3e95cd87f73e2ca21d1b96471abfc560
Instruction Fuzzy Hash: 945192B5B006169FCB14DB79D848AAEBBF6EFC5320B148629E519DB390EF70DC058790

Function 070F86A0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e620a04bf88c62843fe64c227bed9687ae9a8b16cd11336ca2e89942ee6def7e
Instruction ID: 130e943f9bb9b46c1b612cac038af3bad8ce44b00ae6ea556524d7da64d979a9
Opcode Fuzzy Hash: e620a04bf88c62843fe64c227bed9687ae9a8b16cd11336ca2e89942ee6def7e
Instruction Fuzzy Hash: B751B135F002189FD704ABB8E4466EDBBB2BFC8700F55C5A9D892AB385CF346D498791

Function 070F86B0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4c37de4f78334201e32e3a9b8397037a8b820474cce7e8f762ca851f54a94d
Instruction ID: 2be3b02eb8425d71e864c4b52e2f805bb881004a0113b9e23d5f21f8e1b9ad99
Opcode Fuzzy Hash: 9f4c37de4f78334201e32e3a9b8397037a8b820474cce7e8f762ca851f54a94d
Instruction Fuzzy Hash: 1A51AF31F002189FD704ABB8E4456ADBBB2BBC9700F55C5A9E8826B385CF356E498781

Function 070F71A0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 565f5a1ed43b48649c6dbe16ca403e84e3c7523e76913b2cc08b71ee40e37124
Instruction ID: b93ade59e7752f7b747c6dcacd27ac86f503bed865ea864356cae6795bf60c60
Opcode Fuzzy Hash: 565f5a1ed43b48649c6dbe16ca403e84e3c7523e76913b2cc08b71ee40e37124
Instruction Fuzzy Hash: 6B518CB4E0074AEFDB16CFA5C5406DDBBF2AF8A300F64921AE945BB641D370A981CF41

Function 070F6383 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3437660d722abe80b2d3fa21a4d98f913525675a35a90d914af94613a199e0e2
Instruction ID: 8cbafe195553884c4b7c15586b5c3951fc75bfab75a8def43906321d0f405e78
Opcode Fuzzy Hash: 3437660d722abe80b2d3fa21a4d98f913525675a35a90d914af94613a199e0e2
Instruction Fuzzy Hash: CC41C3B1A00249DFCF11DFA4C844BADBFB2EF45310F048265EA15EB691D772E954CBA0

Function 070F78D8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00945c56d7c0781798b57057b6beeb6061d7127d6428218b3a9bd6923700b885
Instruction ID: 5b724ddb0425cff338c7cfd6bd5343c08aa6d2e830e0b03156d20a999694a9b1
Opcode Fuzzy Hash: 00945c56d7c0781798b57057b6beeb6061d7127d6428218b3a9bd6923700b885
Instruction Fuzzy Hash: 5B41F0717002049FDB189B68D854BAE7BF6BBC8210F545169E606DB790CF31DC42CBA1

Function 070F88D6 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d36643afcb62d10693b94c398c9de0ffce47ed182f028fe772c6fa63d6ebed
Instruction ID: 1fa4898baf3b9d654e8f6615c8cea23aa2e6a5520b69d0042ac4bd0033cb845c
Opcode Fuzzy Hash: 56d36643afcb62d10693b94c398c9de0ffce47ed182f028fe772c6fa63d6ebed
Instruction Fuzzy Hash: 9731057171C3844FD7059BB4A8193B97FE5EB86211F09C5ABE182CB7D2CE288C05C762

Function 070F4FD0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 261e74aadc4c5d2e903ca426a859b7773917d0d79f96781bba2577487980dbfe
Instruction ID: b5d40d4346d549a8067ba507cfaa8de7a7a2e84ffd7d2d2378efce5855e549de
Opcode Fuzzy Hash: 261e74aadc4c5d2e903ca426a859b7773917d0d79f96781bba2577487980dbfe
Instruction Fuzzy Hash: C73108B03102058FDB29CB74DC9473D7BA6FB82701B15466AE216CBB81EB26DC5087D1

Function 070F14A8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18ab8c2b467d9f2b83316f890d338b2f178ab497f3a2a5a0b1a14df4ddac8d22
Instruction ID: b23a0eabbbfc955edb95ac2a1368ea524bcd626eb0d7739c8009dce77315c087
Opcode Fuzzy Hash: 18ab8c2b467d9f2b83316f890d338b2f178ab497f3a2a5a0b1a14df4ddac8d22
Instruction Fuzzy Hash: BD31CE7520014EDFCB05AFA8E494ABF7FB2FB89204F404128FA168B340CB35D961DBA1

Function 070FB834 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f4b36e65fcf09f9f4c5821e11e24edb22c22bfa9949b84695bd60e7f5628b8
Instruction ID: 4d5f14b2fe9d77a55cc80277ca7a0db22faf4a132f9a91683fffa475e7268eaf
Opcode Fuzzy Hash: 24f4b36e65fcf09f9f4c5821e11e24edb22c22bfa9949b84695bd60e7f5628b8
Instruction Fuzzy Hash: 423158B1900309AFDB10DFA9D844ADEBFF9EB48310F14842AE519E7310D774A944CFA5

Function 070FD5A8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f6d0bf38496b73510546c7015b8af7936cd6b3c44ca1439d9ae991ae40765e1
Instruction ID: 755fc25064cb3f12ac02467eddd193c805dbd22a266654ad3e0409a6cb5040aa
Opcode Fuzzy Hash: 9f6d0bf38496b73510546c7015b8af7936cd6b3c44ca1439d9ae991ae40765e1
Instruction Fuzzy Hash: 543121B0B18659CFC714CB69C4206BEBBF2FF46605F10826BD1AAE7A41D339D901CB61

Function 070F4448 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762c338a637ab766374b71d7897fca271011a8d01314ddb06c3363b5a0b2d4ca
Instruction ID: 9f4cd1d3f611a57d3e738101296b551fe96f02a5d3f241962a4dedd4b6f29dab
Opcode Fuzzy Hash: 762c338a637ab766374b71d7897fca271011a8d01314ddb06c3363b5a0b2d4ca
Instruction Fuzzy Hash: 062128B53042528BDB247739946433F3AD79FC5914B184139FE02CBBA2FE25C8429741

Function 070F4458 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98138d00a514963059bbd1d55eecf8bca104238b2a393608a63ae721568e4260
Instruction ID: 7c125f623d90de8f9d0cddf15372ea5874c0dd6a62eed0b6bd1f47fa60f89571
Opcode Fuzzy Hash: 98138d00a514963059bbd1d55eecf8bca104238b2a393608a63ae721568e4260
Instruction Fuzzy Hash: F421C2713002568BEB24772994A437F76D7AFC5A14F144139FE06CFBA6EE65CC829780

Function 070F7BE8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ceab2f9b61db06c7949ea1acc5084bb656b69607ac9f962da755e5586433fc3
Instruction ID: ef8b653ece46653fb28a3eb1e22fd1879c8e37a1fea7e307333e51bf8221be9e
Opcode Fuzzy Hash: 4ceab2f9b61db06c7949ea1acc5084bb656b69607ac9f962da755e5586433fc3
Instruction Fuzzy Hash: 1B3173B0A005158FCB08DF6CC8849AEBBF6FF84320B558259E515DB7A1DB34EC52CB91

Function 070F8918 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32ec359c9eff4b1913f58c9f3c556f27859dcbe28cd505fbfa46b95c0d8749a
Instruction ID: f7ac9f6dbed7829f4fcab97d7e05b927558e8f17bd58ce1c46fa2caa13d087de
Opcode Fuzzy Hash: b32ec359c9eff4b1913f58c9f3c556f27859dcbe28cd505fbfa46b95c0d8749a
Instruction Fuzzy Hash: F221F1317142088FD7049BF8A81937E3EE6ABC9211F04DA3AF546C7BC1CE748C018792

Function 0104D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1577204338.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_104d000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227f46dcbe74eabf43d135c05b15818d330b5424513800578fb7ec0f77e3d46c
Instruction ID: df4b7cff0457cbaaf49a866d4d2959249334dd88c545f5cd55299d12b9a22168
Opcode Fuzzy Hash: 227f46dcbe74eabf43d135c05b15818d330b5424513800578fb7ec0f77e3d46c
Instruction Fuzzy Hash: 8B2136B1500244EFDB01DF54D8C0B2ABFA1FBD4318F20C1B9E8490B246C736D456CBA2

Function 0104D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1577204338.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_104d000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf924f204b5355eb290a86ec2f505ddf4d5de93c7e8526df8563334e292317b
Instruction ID: ceb6e4fc0ec45de6a56fe3f8f47530d37d6f10a8e4d5d7c348eaee0e2025596d
Opcode Fuzzy Hash: 1cf924f204b5355eb290a86ec2f505ddf4d5de93c7e8526df8563334e292317b
Instruction Fuzzy Hash: 722106B1500204DFDB05DF94D9C0B5ABBA5FBD4324F24C1B9E9490B256C736E456CBA2

Function 070F27D8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dcdc087f56a6b449a94844e6ba49360cd49ef596d8acb5497bea7b4a77f53de
Instruction ID: 98d7e74ccacc79059754f30a385d5026438550f8dd2422f38e6340ea12a78749
Opcode Fuzzy Hash: 8dcdc087f56a6b449a94844e6ba49360cd49ef596d8acb5497bea7b4a77f53de
Instruction Fuzzy Hash: 53210275701616CBC725AA65D4A893EBBE2FF896607084279E61ACB794CF30DC03C7C0

Function 0122D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1578305650.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_122d000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62748d8798cc957a1a8e0f9c49205f027c2c11c5ce961ef1c0e22bf4a1faba1d
Instruction ID: d93c27ed685e2327709836c6639313d9a5c0ceff0103d1381ba604b693735584
Opcode Fuzzy Hash: 62748d8798cc957a1a8e0f9c49205f027c2c11c5ce961ef1c0e22bf4a1faba1d
Instruction Fuzzy Hash: 11214971514308FFEB05DFA4D9C0B29BB65FB85324F20C66DE9094B243C376D806CA62

Function 0122D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1578305650.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_122d000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e21dd99dd6d76cf58e674c8bb042edd8ff4c5979bb110d41b1d271cd932903fe
Instruction ID: c315fa1897340479394c7ca900edab1db31bb77eb822a89d789084dd33f8967c
Opcode Fuzzy Hash: e21dd99dd6d76cf58e674c8bb042edd8ff4c5979bb110d41b1d271cd932903fe
Instruction Fuzzy Hash: E6213771514348EFDB15DFA4D8C0B1ABB61FB84314F20C56DE9090B266C37BD507CA62

Function 070F98C0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29212e85dc2a8667bc1795feee60f3448d876c07c9268dfc7b3d53ba805ddee6
Instruction ID: 6c3758801891e573e126b01272881a1646acd70e42a4bfdc83e14da89bf8af43
Opcode Fuzzy Hash: 29212e85dc2a8667bc1795feee60f3448d876c07c9268dfc7b3d53ba805ddee6
Instruction Fuzzy Hash: D1212BB0B28209DFD7549ABD984473E3BEAEBC9611F514239E606E7384DF709D018792

Function 070F1498 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1fb1302ef1e7cd7c2e3da9764e849f66bfab347913ed85170429f04b9e0c78
Instruction ID: 4d8f1d8364141b3c9c6b7fc6cdbecef1ddf0765ec103ab395aaede1dfd629147
Opcode Fuzzy Hash: 2f1fb1302ef1e7cd7c2e3da9764e849f66bfab347913ed85170429f04b9e0c78
Instruction Fuzzy Hash: AD21D1B660424EDFCB40AF68E495BAF7BB1EB86714F004138F9068B740CB78D855CBA1

Function 070F98B1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1879a028e372b2b1a829a1078ec80dafae59a8079d90beea30591044028b10
Instruction ID: ff2b42c4a92ee5bb7df6c6a66161cd290ff406f9674e178f9034a960c34c299f
Opcode Fuzzy Hash: ea1879a028e372b2b1a829a1078ec80dafae59a8079d90beea30591044028b10
Instruction Fuzzy Hash: 911136B0B28305DFD7148EB99844B7E3BBAEBC9201F11467EE606E7384DF7199018792

Function 070FA4C7 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560b140368d566a98535bba5d34b3b50d571e77c90aa4e547a66c4a2ccb56bdf
Instruction ID: 77f5d9fd4d569301341c9e23cf85ad56f5ecec4f399f323711f3b278ee7a7327
Opcode Fuzzy Hash: 560b140368d566a98535bba5d34b3b50d571e77c90aa4e547a66c4a2ccb56bdf
Instruction Fuzzy Hash: 7B31E0B0D01318DFDB20CFA9C984B8EBBF4AF49714F24851AE408BB280C7B55845CBA1

Function 070FD4D8 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ce2e50fdf4b7c021641264bbb683b442b9de9780e218c1f06cb916b96e0b81
Instruction ID: e9ad409beb15654c495e8638cc498814ba19ce3eec951aeab397215543838006
Opcode Fuzzy Hash: 25ce2e50fdf4b7c021641264bbb683b442b9de9780e218c1f06cb916b96e0b81
Instruction Fuzzy Hash: 54113D707043009FE7195B298829B2A7B97AFC5F04F5581A6E203CF7D1CAB4DC4087E1

Function 070F5839 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516c3db020f3503afa19b6fc50fe993aa59cece6d052a348068dba068b414c8d
Instruction ID: 7756fd606b46dda109a97ccf5d982857a8c5740b8e39cdf711a53aa85701da42
Opcode Fuzzy Hash: 516c3db020f3503afa19b6fc50fe993aa59cece6d052a348068dba068b414c8d
Instruction Fuzzy Hash: 272189B0E0120D9FDB05DFA5E994AEEBFF6AF88205F148029E461F7250DB319A41DF60

Function 070FA4D0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6b48ac02ea25217b711b652ba3684f25fd8778c4b5a12f68c6a9b375e92f01
Instruction ID: 84012d7a78c92b023445e4c838f234550bbb2933e6d601f806f48835d194e10a
Opcode Fuzzy Hash: 8f6b48ac02ea25217b711b652ba3684f25fd8778c4b5a12f68c6a9b375e92f01
Instruction Fuzzy Hash: 4221D0B0D11318DFDB20CF9AC588B8EBBF4BB49714F24851AE508BB290C7B55845CFA5

Function 0122D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1578305650.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_122d000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c701f3d7fa54a02e5ce9aab35114cd7f046497c20befde2a3008935c7528536
Instruction ID: 75298a8174b1937086c98055a43fda853e3f3609817809ae613942a633c45749
Opcode Fuzzy Hash: 4c701f3d7fa54a02e5ce9aab35114cd7f046497c20befde2a3008935c7528536
Instruction Fuzzy Hash: 6621B0714083849FCB02CF24D994715BF71EB46314F28C5DAD9498F2A7C33A980ACB62

Function 070F27C8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3e13a2de5a51e0058a776f9f1ae828c59783eab233a6d2f387aacada1d6779a
Instruction ID: 6e9f65c8457c8a1326447a50109125a8b001836ba1e483b028e264a3600cb4f3
Opcode Fuzzy Hash: d3e13a2de5a51e0058a776f9f1ae828c59783eab233a6d2f387aacada1d6779a
Instruction Fuzzy Hash: 6E112576702512CFC715AA29D4A8B3E7BE2FF856517194279E60ADB750CF30DC038780

Function 070FA310 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3335c7f41b9a9a21199e6330bda3b7107b02a2db23096833b2b294c71b0384a1
Instruction ID: b53954624dd8c2b2d486e63f9cfeac7e0fd71448097c5054c4f44177c16a3924
Opcode Fuzzy Hash: 3335c7f41b9a9a21199e6330bda3b7107b02a2db23096833b2b294c71b0384a1
Instruction Fuzzy Hash: F311C6B6B0061A9FCB10DA7998446BFB7F7EBC92507148628E518D7380EF309D058760

Function 070F78CB Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09c1e51c553f5ccfa530ec22fce11ebbac8ff2bc8faee543194394ff1831353
Instruction ID: c8c6a394178c838f357439a975e5ea2d1c5bb272cb48b7f0e150c3c0a45e5ac0
Opcode Fuzzy Hash: e09c1e51c553f5ccfa530ec22fce11ebbac8ff2bc8faee543194394ff1831353
Instruction Fuzzy Hash: 19118E76B102059FCB00CF64D849BADBBB6BB8C310F149129FA16E7790CB31AC10CBA0

Function 070FA240 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc135639e7596edb29e71923227029944bc5e17a4e6970ac54b13ac2deb43af
Instruction ID: f7395ae4433ad86744e9354040859d9bc54c6d38cd467ec8ff7dcdeeefdfc67e
Opcode Fuzzy Hash: 6bc135639e7596edb29e71923227029944bc5e17a4e6970ac54b13ac2deb43af
Instruction Fuzzy Hash: 15111CB1B0021A8FCB95EBBDD8105EEB6F6AFC9710B508169C508E7240EB768D41CBA1

Function 070FD4C9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a1581f754cefc268784d9ccd556dc214a13de823af3f65afdb410fcfdc57e4
Instruction ID: d7f1cb6844365782f53c9ee697051e2a58fde3066056e512a7c91f2fb6525958
Opcode Fuzzy Hash: c0a1581f754cefc268784d9ccd556dc214a13de823af3f65afdb410fcfdc57e4
Instruction Fuzzy Hash: CF112BB0B40200DFE7244B64C82AB697397FBC5F04F558566E206DF6D5CAB4DC408B91

Function 070F8CF4 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655db8924e9e84e9e1a89105172b6e655b671c30ef0e4905d2a71097b1a37009
Instruction ID: fcf518b369e2b43d845637cc06fdc5305f5888a76096a7960d35034a64ab52d9
Opcode Fuzzy Hash: 655db8924e9e84e9e1a89105172b6e655b671c30ef0e4905d2a71097b1a37009
Instruction Fuzzy Hash: 6111EE1140E3D55FE303AB7CA8B01C97FB1AE9750870A85C3C1D4DE0A3E61858ACC3AB

Function 070FB844 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e44aa15a7bede5b6d45cf04b1adc5eef7ed2e3c26ebf8df558259f3c52c07b4f
Instruction ID: 46c2c98ff8fa30d3ed93f105c6927bd6187e0841754d1083dca9ec242f7dc359
Opcode Fuzzy Hash: e44aa15a7bede5b6d45cf04b1adc5eef7ed2e3c26ebf8df558259f3c52c07b4f
Instruction Fuzzy Hash: 6F2103B5800349EFCB20CFAAD884BDEBBF4FB48310F10841AE919A7210D374A944CFA5

Function 0104D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1577204338.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_104d000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction ID: 5d28eb843da36fd73240cb2ca20bc0254ba10c8991e4b83f45c3989fb0139135
Opcode Fuzzy Hash: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction Fuzzy Hash: A811DFB6404240DFCB02CF54D9C0B56BFB1FB94324F24C2A9D8490B657C33AE456CBA2

Function 0104D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1577204338.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_104d000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction ID: 33d7ce0356fda9255b0dd28f368b89d26a18d3687f0212ade3a2cec5d5b735e6
Opcode Fuzzy Hash: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction Fuzzy Hash: A911DFB2504280DFCB02CF54D9C0B16BFB1FB94318F24C6A9D8490B657C336D456CBA2

Function 0122D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1578305650.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_122d000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction ID: 0e8a5be45bcb7d3ab36ff45990bfddd800b5bd855af05636337a424dec8a2911
Opcode Fuzzy Hash: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction Fuzzy Hash: F211BB75904284EFDB02CF54C5C0B19FFA1FB85224F24C6A9D9494B697C33AD44ACB62

Function 070F8C50 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b5e08e8fcb55c5df4e62ce73796b2c692c3464d62a9322675e8e7e105971b7b
Instruction ID: 538bc59389f3185861692b2ad7b4ccb270799d42c5e510fe6cd4b7ced3aedd2c
Opcode Fuzzy Hash: 6b5e08e8fcb55c5df4e62ce73796b2c692c3464d62a9322675e8e7e105971b7b
Instruction Fuzzy Hash: 6601F7B122E365CFC3108E689C416AEBBE4EB56721F06C777E269CB6C1D239C84183D1

Function 070F6077 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7114ec9ce5c77f77b3a3b6898ff6fc499fac4e2e3b8feeda17f5f8d73dc0ac9b
Instruction ID: 6244dd0ff1ec4530e97333d29ade44b8cf7f3ebc770f75ed0bfa627f9ca35a1e
Opcode Fuzzy Hash: 7114ec9ce5c77f77b3a3b6898ff6fc499fac4e2e3b8feeda17f5f8d73dc0ac9b
Instruction Fuzzy Hash: FA01A7B570010A9FDF40CAA8C844BFFB7F9EBC8310F14C525E601DB641D936D98187A0

Function 070F8C40 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4897c3503125e52e2f5a16878bf3beb8f5be7fd6d5dcaee9a81a045caf472c0
Instruction ID: 902b1ec7cc6d058363f361bde13e06e51c5b5c2ac0d171c485558abe186fbbff
Opcode Fuzzy Hash: d4897c3503125e52e2f5a16878bf3beb8f5be7fd6d5dcaee9a81a045caf472c0
Instruction Fuzzy Hash: F901DBF121E364CFC7104E69DC815AE76E5E756621F05C737E269C76C1D634C84143D1

Function 070F8469 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4156bea77e6fce50698eca62be7205ad0321538ab3b7b656d80fd591ea8a3cd5
Instruction ID: 0c1d2ccf32ab1b40d0105da03e34dcc31a9e6bf41f6e518b9f425ba5968b6547
Opcode Fuzzy Hash: 4156bea77e6fce50698eca62be7205ad0321538ab3b7b656d80fd591ea8a3cd5
Instruction Fuzzy Hash: 73111770E0020DAFDB44EFA8D9517AEBFB2FB88204F1085B9C115AB250EB305A069B81

Function 070F6221 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5563adcfdb42f6a7ad5db231e8d3790e60b35e8b113df997e883f90c61c9c1c2
Instruction ID: e2752b84045f8f51e34a85de6d9ee794681f6ed102d22fc9d5f87bcdd51957ad
Opcode Fuzzy Hash: 5563adcfdb42f6a7ad5db231e8d3790e60b35e8b113df997e883f90c61c9c1c2
Instruction Fuzzy Hash: 8801E976A0021D9FCF45CF99D9458DDBBF9EF88310F00812AE509EB254D7719919CB90

Function 070F1F70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3647e74232ec5fba8893e123ed790a953d755d42015980e5f5b1e0f7b9b34fd0
Instruction ID: 6a9b06466ae6e347d91c5db7a0185dc65144a529cd148070e80870f6c156e0a9
Opcode Fuzzy Hash: 3647e74232ec5fba8893e123ed790a953d755d42015980e5f5b1e0f7b9b34fd0
Instruction Fuzzy Hash: 35F0F4B7600109ABCB018E55EC00BEF7BAADBC9751F14C235F718C7680CB36C91297A0

Function 070F1F80 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd214b03f256222520cdee04253004416eb4c543aae0ad30905d00ffcd395a1
Instruction ID: df0b06946fe4957e904cc7101a78d058eccb887e97eda983904c8668c88b7aea
Opcode Fuzzy Hash: dcd214b03f256222520cdee04253004416eb4c543aae0ad30905d00ffcd395a1
Instruction Fuzzy Hash: 5101A2B2B00119AB8B159E59A810AAF7FEADBC9650F148229F705D7280CB75C91197A0

Function 0104D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1577204338.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_104d000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e05344189782bde4b8103ab7c3ad2de4f48c2b04e3a742fdf31bbb9478c251
Instruction ID: d8ec5d9c0135967c52cf61558fd2915eba4500468c0667e27dd8ea44bc740009
Opcode Fuzzy Hash: 58e05344189782bde4b8103ab7c3ad2de4f48c2b04e3a742fdf31bbb9478c251
Instruction Fuzzy Hash: 9901FCB10043849BE7509BA9DCC4757BBD8FF51624F14C466ED490E287D3789440C772

Function 070F8478 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d03df7eb86cc63078068f653e7af85b5f616145ba192a6abc087b3c1bf17f4d
Instruction ID: d84557bdc76597826cb9265e7f113acc10020a9f315d37075080fd00b32842d7
Opcode Fuzzy Hash: 8d03df7eb86cc63078068f653e7af85b5f616145ba192a6abc087b3c1bf17f4d
Instruction Fuzzy Hash: 7F010C70E0020D9FDB44EFE8D5506EEBFB2FF48204F1085A9C115AB254EB305A069B81

Function 070F6F48 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c648dd131bce353739a3a11c065d067d76ee04694f9ca9acd35f821319d2e9
Instruction ID: b1aea2f4605c5e220a7b95cf7adfec7715178ea0165d998e64a43886cc9281e7
Opcode Fuzzy Hash: f5c648dd131bce353739a3a11c065d067d76ee04694f9ca9acd35f821319d2e9
Instruction Fuzzy Hash: 0EF090B2B142155FCB24DE59C440ABE37E9DB88320F158276E629C7750C93AD8448791

Function 070FA884 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce7e52b8d57e38db23510910f440feedc19efa20810cbbcd727d53ba54ea166
Instruction ID: e0a70ad95081b25c2c9ff49971f2e2bb2f313d3140db1e3f286102eef385724a
Opcode Fuzzy Hash: 7ce7e52b8d57e38db23510910f440feedc19efa20810cbbcd727d53ba54ea166
Instruction Fuzzy Hash: 40010CF1D0021ADFDB14CF69C8443ADBBF1AF46364F14C215E528AA690D3B44A86CB90

Function 0104D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1577204338.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_104d000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685dc08e940d280903b1c8880f430a97c9455505619efe6a6b75b6212558e8c3
Instruction ID: 5ef02b6288b8ab0c46e18f56c7ba94379fb27a28bf87188853db3355a116eae2
Opcode Fuzzy Hash: 685dc08e940d280903b1c8880f430a97c9455505619efe6a6b75b6212558e8c3
Instruction Fuzzy Hash: 3EF04471404744AFE7508A59D8C4B62FFE8EB51624F14C45AED484E287D275A844CBA1

Function 070FA278 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915d6e708a86cc72f14dac5615c4ca69f7038fe1e3e055fdff74dc5fc37eae61
Instruction ID: 3858402cf19ef7326a2e666ec29c14c21d758bdfd6ee1fc84a18a6a399883e56
Opcode Fuzzy Hash: 915d6e708a86cc72f14dac5615c4ca69f7038fe1e3e055fdff74dc5fc37eae61
Instruction Fuzzy Hash: F9F090B2B0024A8B8B89E6ECC8101EE72B3AFC56507648219C605A7754EF76DD02D791

Function 070FA890 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f4f3317620b4ae42fcf35feea30be7a28db5d412fdf392acc82f2ae1b63353
Instruction ID: 7f5321260763c312b3f60a2cce59df3b13373236994f48b4b6f1f864d14d382c
Opcode Fuzzy Hash: 00f4f3317620b4ae42fcf35feea30be7a28db5d412fdf392acc82f2ae1b63353
Instruction Fuzzy Hash: 8B01ECF0D0021ADFEB14CF59C4043AE7AF1BF45350F10C225E528AA690D7B44A82CBD0

Function 070FA92B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8602bfdb7a4ca4de977c8c4dd8bf63a84f10995247e8006db4e57a46b7afbade
Instruction ID: 5cabb9fade301363581a3d6618e7b5399b42f4fac61271044f05567a79185393
Opcode Fuzzy Hash: 8602bfdb7a4ca4de977c8c4dd8bf63a84f10995247e8006db4e57a46b7afbade
Instruction Fuzzy Hash: 43F030B27002286F5318966EEC84D6BBBEEFBCD6743158179F548D7350D9719C0186A0

Function 070FBC78 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ed6ce3b14d8a345273bd5216e4e9ee069f6f6180cfba197f24b73e8f78fd6c
Instruction ID: 1afaa885a5fd58cbcb103c6046df95ca1294a2b2f9504f21ba53e4c695b155e6
Opcode Fuzzy Hash: 74ed6ce3b14d8a345273bd5216e4e9ee069f6f6180cfba197f24b73e8f78fd6c
Instruction Fuzzy Hash: ECF0E2F1A093849FDB05CBB0CC159AA7FF88B8210071944EBD905C7642E9308D0AC722

Function 070FBCD8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7bf0096d49405f60445747a85ca0dd485a2ee46186b499ec0c8122c9a825b0c
Instruction ID: 2ce71e8b780be50bb90d7b97f3a732e549e7c7e2aaaae62ca8c05b7919da1fa5
Opcode Fuzzy Hash: e7bf0096d49405f60445747a85ca0dd485a2ee46186b499ec0c8122c9a825b0c
Instruction Fuzzy Hash: BCF027F2A04208AFCF05CFA4D84199E7FFAEF44214F0881ABE404D7321E6319D04CB51

Function 070FA930 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d4c420514ef11f5b28586e580c81a6dd446791b88355a8fc23672245672c10
Instruction ID: fa073525c66f40292cb35dc85efdcb6aef399c38bbad86e817c35b464387c1a0
Opcode Fuzzy Hash: c9d4c420514ef11f5b28586e580c81a6dd446791b88355a8fc23672245672c10
Instruction Fuzzy Hash: B9E0ED767042286F9318DA6EEC84D6BBBEEFBCD674355817AF548C7310D9719C01C6A0

Function 070FD383 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 843b4e743371f0527f95d092ec5a50fc9811f5f3b0d12fd3a68c0c2c7aac281a
Instruction ID: 0c2e6ab74cc7015a09c7133f85a8f10606f376e052ca76c93f5e439e9dcebd52
Opcode Fuzzy Hash: 843b4e743371f0527f95d092ec5a50fc9811f5f3b0d12fd3a68c0c2c7aac281a
Instruction Fuzzy Hash: E1E026F2B04109CBE710AB98A4117A97765FBD2B01F90827AD341D7B48CB32C8068622

Function 070F2C13 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a30c34327bfa42178c930a680e0c2b26aa46e3a99816e7939faa0223b5f70e
Instruction ID: 78d83746f570e314ffe65c837124054f1e6ae6fba2ff59e55b282ce6c8c3401b
Opcode Fuzzy Hash: 53a30c34327bfa42178c930a680e0c2b26aa46e3a99816e7939faa0223b5f70e
Instruction Fuzzy Hash: BAD0A73201024C07DA01FB74F85A7D4B775F7D4508F44A130E02406615DF6468488690

Function 070F2C20 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd6803f7704e694707b5c0830db61ee5f97b818c74f058a122b1339b80a5e4b
Instruction ID: 1fbc60282151ec08285d9eff7af1294ed4de62c0d41c6a1ea2b9e8fb43cef21c
Opcode Fuzzy Hash: 9cd6803f7704e694707b5c0830db61ee5f97b818c74f058a122b1339b80a5e4b
Instruction Fuzzy Hash: 66C0803101030D47DE01F7B9F9599D5777AF6C85087406530E43509529EF743C4C87D1

Function 070FF4A8 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c30f668aad5535c0aa5587d49b6644b871962f28727cd67eae078024d0a63d
Instruction ID: a5af0418c1997eb1560e0975deacebb24991143c9c27878f0b77ec0148c92ac6
Opcode Fuzzy Hash: 05c30f668aad5535c0aa5587d49b6644b871962f28727cd67eae078024d0a63d
Instruction Fuzzy Hash: 68C08C730003058BD72C3BB0AA0E32436A8AB42212F8000109208808B08EFCA4C0C699

Function 070F59C0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb943edec02841e0bf6bcbbe293941a586c13ca72c08c38c47c88a165fcd45f5
Instruction ID: aeadd256b816f901ce6f830ffdd95122be02800232aa1dedde4fa5a4d7c18b90
Opcode Fuzzy Hash: bb943edec02841e0bf6bcbbe293941a586c13ca72c08c38c47c88a165fcd45f5
Instruction Fuzzy Hash: 8DB0920B6940404BEF1606609C263A66F72D366200FCCB9A0CDA095384D108981B6250

Function 070FA208 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b662863ed04c7d0d812cc47138ef0720454b89b8e1e3569204324166a2a7d9c1
Instruction ID: 1d1b49e714f9a00514dde3b7512059eb84ea0328d72aa65d018242d4e999cadd
Opcode Fuzzy Hash: b662863ed04c7d0d812cc47138ef0720454b89b8e1e3569204324166a2a7d9c1
Instruction Fuzzy Hash: A1C04CBA2192C09ED7477F249C21D82BF72BF62208349A6D3D1905B9B3D515C82CD726

Function 070FBCB0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1585449665.00000000070F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_70f0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884848de8acadd93480012ba7914022f5f904b9a33d1b774e7e6467c9dac4f37
Instruction ID: 147aeb7346af8b2e53e79cd2188afd220d2fae70bcd40c9791bb57481a08c42e
Opcode Fuzzy Hash: 884848de8acadd93480012ba7914022f5f904b9a33d1b774e7e6467c9dac4f37
Instruction Fuzzy Hash: 09C04C9616D3C18EE306577458215923F2089B250834D64978294965A3D514401DD63A

Analysis Process: DeQadQO.exePID: 7664, Parent PID: 7320COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 02DA9B38 Relevance: 3.1, Instructions: 3065COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143023a15e122667a62f30d9faa6f065b7978ece552a64e8ab29bc592005befd
Instruction ID: 3febf02f98929210527cb61cf36b69298628afff2d9ccfaa707af50ee91dd087
Opcode Fuzzy Hash: 143023a15e122667a62f30d9faa6f065b7978ece552a64e8ab29bc592005befd
Instruction Fuzzy Hash: 55631E31D10B1A8ADB11EF68C8946A9F7B1FF99310F11C79AE45977221FB70AAC4CB41

Function 02DACDB0 Relevance: 2.3, Instructions: 2309COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13d8096b4c1a977f58bb4f53c01dab574ffaf12242d6dcf5f2b32f985659fb9
Instruction ID: 23f1189fcab3ad4ba65c5f6588e4c608cc475d3923d8793b6ce01cfe8d0199d3
Opcode Fuzzy Hash: e13d8096b4c1a977f58bb4f53c01dab574ffaf12242d6dcf5f2b32f985659fb9
Instruction Fuzzy Hash: EA333F31D107198EDB11EF68C894AADF7B1FF89300F51C79AE459A7211EB70AAC5CB81

Function 02DA9378 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fe922b880be3b7143a1206c9c4cd250d0c85297365789e0175c54a1681d993
Instruction ID: 49e3338e163df25e4cf4f2d72b1891ea1429688062cc680a187b752a5ac2800e
Opcode Fuzzy Hash: c1fe922b880be3b7143a1206c9c4cd250d0c85297365789e0175c54a1681d993
Instruction Fuzzy Hash: 8C326075A002088FDB14DF68D9A4BAEBBB2FF88310F148569E90ADB395DB75DC41CB50

Function 02DA4A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e415f0936c26ef96f5d729fea96e29e24a1877c8a7d602a1148f4bb60bf312dd
Instruction ID: 8a0c130238b1d8f37cb1688ae50d77005110a75cf8394a446ca7b67c72898c96
Opcode Fuzzy Hash: e415f0936c26ef96f5d729fea96e29e24a1877c8a7d602a1148f4bb60bf312dd
Instruction Fuzzy Hash: FDB13E70E00209CFDF14CFA9D895B9EBBF2AF88354F148529D419EB394EBB49845CB91

Function 02DA3E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2923fc2232e6ce6214f9484dc1a7a4195f1d5e27ab9b8ac3fee586398d9c7f4a
Instruction ID: d0bcc94758ae711c37e2a4f7f837df0fd6353d4f854c36b4178138da06d7a98d
Opcode Fuzzy Hash: 2923fc2232e6ce6214f9484dc1a7a4195f1d5e27ab9b8ac3fee586398d9c7f4a
Instruction Fuzzy Hash: 2C914B70E10209DFDF14CFA9C995B9EBBF2AF88314F148129E415AB394EB749845CB91

Function 064CE278 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 064CE2E7

Memory Dump Source

Source File: 0000000E.00000002.2777936135.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_64c0000_DeQadQO.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: dade346022df81f8581c59e1b79e20e5a3fd06c865777b9dd69697a45efdd89a
Instruction ID: e01043799c13c66168a8beba271a3d57bb4bf4daa07b03412f6656cdb299a33b
Opcode Fuzzy Hash: dade346022df81f8581c59e1b79e20e5a3fd06c865777b9dd69697a45efdd89a
Instruction Fuzzy Hash: 3D2165B5C0061ACFDB20CFAAD844BDEBBF5EF48220F14816AD858A7740D7789940CFA1

Function 064CE280 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 064CE2E7

Memory Dump Source

Source File: 0000000E.00000002.2777936135.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_64c0000_DeQadQO.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 39dfbfad37a68420858fde9739a9d58e00147ebc1f8cf73659ac61704ac944a4
Instruction ID: f560d237763832c8928b83dc4a9b489a5cdac88e22fb702a412bdbdc6953c6e6
Opcode Fuzzy Hash: 39dfbfad37a68420858fde9739a9d58e00147ebc1f8cf73659ac61704ac944a4
Instruction Fuzzy Hash: C311F6B1C0065ADBDB10DF9AD444BDEFBF4AF48220F15816AD418A7340D778A945CFA5

Function 02DA7908 Relevance: .6, Instructions: 553
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38e7edb3055dde34518a6792d5d9569b830b34e23492c574f00e4b461440d29
Instruction ID: a0d0427fb65ce9e77fe719face1c49201d323a3c8910da94c7dec84d038ec59b
Opcode Fuzzy Hash: d38e7edb3055dde34518a6792d5d9569b830b34e23492c574f00e4b461440d29
Instruction Fuzzy Hash: 2F122770B102099BDB15AB7CE8A4B6CB6A3FB89201F608939E405CB395DF75DC46CF91

Function 02DA7918 Relevance: .6, Instructions: 550
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a98bdb975751ca742f0366819ff590ce7589bbe814ecac00665f87d91e35cf62
Instruction ID: 24c2a92f27f7751ea6ea570d794eca31697625fd10a0e48ace4f7dc84369560e
Opcode Fuzzy Hash: a98bdb975751ca742f0366819ff590ce7589bbe814ecac00665f87d91e35cf62
Instruction Fuzzy Hash: 5A122830B102099BDB15AB7CE8A4A6CB6A3FBC9641F608939E405CB395DF71DC46CF91

Function 02DA4A8E Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834bd6296910b2401c451c1d7be9cec03dedeea5d2c2cb4bd183882be4ff3dcb
Instruction ID: 9f31d3f752839c3f81cb30e27586b0ccd3b954ae12dc1d738be0ee2764fb62f7
Opcode Fuzzy Hash: 834bd6296910b2401c451c1d7be9cec03dedeea5d2c2cb4bd183882be4ff3dcb
Instruction Fuzzy Hash: CBA13B70E00209CFDF10CFA9D895B9EBBF1AF88354F148529D819EB394EBB59845CB91

Function 02DA9364 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02e6e62bafab6faf3fc23e1bf5476c565b308b54638202b289031591d3ac2a8d
Instruction ID: 51a0d66a4830ee782228e01a543290516f526487fd5b04c6d34132c1ccae3f5c
Opcode Fuzzy Hash: 02e6e62bafab6faf3fc23e1bf5476c565b308b54638202b289031591d3ac2a8d
Instruction Fuzzy Hash: 6E912C75A002489FDB14DFA8D9A4BADBBB2EF88310F148565E806E73A4DB75DC42CB50

Function 02DA3E74 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c01643351c47623a251393a2710e19cac9a800a0615a8154373247136c7e32
Instruction ID: 89c791e0ecf0ad7460713abaaeb4aeffd78e2e9318e11d75f84b252154857d64
Opcode Fuzzy Hash: f3c01643351c47623a251393a2710e19cac9a800a0615a8154373247136c7e32
Instruction Fuzzy Hash: 00915A70E10209DFDF50CFA8C995B9EBBF2AF48314F248129E415AB394EBB49845CF91

Function 02DA4810 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0159231d6bfef2991ec27f007595012b509a3194f06c6b2cbd91f463199cf820
Instruction ID: b6f81f2361204f378851eda8193d299f5a5f54d651767cc3c5bc3d262c5e1f74
Opcode Fuzzy Hash: 0159231d6bfef2991ec27f007595012b509a3194f06c6b2cbd91f463199cf820
Instruction Fuzzy Hash: D47159B0E00249CFDB14DFA9D895B9EBBF2BF88314F148129E415AB354EBB49841CB95

Function 02DA4804 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60df8bd9d713f810e0f43a43e1d914d64b45606a33b7bb1cc948fbc3a4f676b2
Instruction ID: 3ac359e0877d7cf908a0ece607c7c3b933a570ee96b68d6725e0c5f5160d528a
Opcode Fuzzy Hash: 60df8bd9d713f810e0f43a43e1d914d64b45606a33b7bb1cc948fbc3a4f676b2
Instruction Fuzzy Hash: BE7149B0E00249CFDB10CFA9D995B9EBBF2BF88314F148129E415AB354EBB49841CF95

Function 02DA6ED8 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226f63cd230326bdc322bcd59aa3f8ab35ba2ddcdbd61be980563a9db853c479
Instruction ID: 0253f1afd7940457d466b52c214f584022a139c224b83bff7b1033126fca2cfb
Opcode Fuzzy Hash: 226f63cd230326bdc322bcd59aa3f8ab35ba2ddcdbd61be980563a9db853c479
Instruction Fuzzy Hash: 2B418331A002199FDB15DF68C461BAEB7B6EF89300F24856AE415EB390DB75DC46CB90

Function 02DA6CDE Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f3f7631c5dfe7d77a178d8e89443f40c63a23d2146a4b6ca527c2bb2b94636
Instruction ID: 3ad2644af00bf8169b57c7590f21a054ce96bde2f3a82f698cc3aa3e1a3b2d1d
Opcode Fuzzy Hash: e9f3f7631c5dfe7d77a178d8e89443f40c63a23d2146a4b6ca527c2bb2b94636
Instruction Fuzzy Hash: 0F5102B1E00218CFDF18CFAAC894B9DBBB5BF48314F188119E815BB391D7B49944CB95

Function 02DA6CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511032d278a2548b84e68fdc9b7f3e7f93fc8f31d639182f1941a9e07ef5d2e8
Instruction ID: 2387ed45d625a298fa710ce023bbaccdd2354c735832916cf36254dc8eb283c9
Opcode Fuzzy Hash: 511032d278a2548b84e68fdc9b7f3e7f93fc8f31d639182f1941a9e07ef5d2e8
Instruction Fuzzy Hash: 44510271E00218CFDF18CFAAC894B9EBBB5BF48314F188119E815BB390D7B4A944CB95

Function 02DA1128 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d30eb3415b32060dee9f744b24b3b4a055935df801c4a99645999817bbee26
Instruction ID: e29fe6aa383ea30086472225280f1ed62207643e5d8bbdbec71db24a80407991
Opcode Fuzzy Hash: 29d30eb3415b32060dee9f744b24b3b4a055935df801c4a99645999817bbee26
Instruction Fuzzy Hash: 78510C7960124EEFD70AFB78F8A09A43BB1BBA5704700497AE1008B76EEB606D55CB41

Function 02DA1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b55c754e19521f0f4d8a0d9e3b184165824b91521f9d8df47b17d0b7565d512
Instruction ID: abaf93f4fb3da70e9d4284e89bb045d5e4a5bc9d3aec1bd643d831d9507fe70e
Opcode Fuzzy Hash: 5b55c754e19521f0f4d8a0d9e3b184165824b91521f9d8df47b17d0b7565d512
Instruction Fuzzy Hash: DF51DF7954124EEFD70AFB7DF8A09A43BB1BBA5704300497AE1008B76EEB706D55CB41

Function 02DAF2ED Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520d4864b5c47b7bd2961ffc7c9f41ce439ceadb4f607e46e6a8aacb3b27982e
Instruction ID: 83f249cbfe42f8765ff518b546f0076fa42567ffd57cce0a0b1ec6accd1012d1
Opcode Fuzzy Hash: 520d4864b5c47b7bd2961ffc7c9f41ce439ceadb4f607e46e6a8aacb3b27982e
Instruction Fuzzy Hash: C7310230B002058FEB15AB78D564BAE77B3AF89640F2448B9C402DB781DF7ACD46CB91

Function 02DAF300 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f93477feb153b6aab3d0cce339f8ba0910be7e2d0f1fa15e8fa782deb09c14
Instruction ID: 245ae3dbfd3849eefa2e605b633377eb78576b51e331079baa2cc2d1ec044a40
Opcode Fuzzy Hash: b7f93477feb153b6aab3d0cce339f8ba0910be7e2d0f1fa15e8fa782deb09c14
Instruction Fuzzy Hash: 8131C130B002058FEB15AB78D564B6E77A3AFC9640F2488B8C406DB395EF76CD45CB95

Function 02DAF1B0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e913bdba9cf953b61586e9019fdad67910804dc6d6acd01ddf9b676c8f0285
Instruction ID: 81935092874613ee68fbc721b0d4aed911c1c8b688ea84ce4b159e79868346db
Opcode Fuzzy Hash: b2e913bdba9cf953b61586e9019fdad67910804dc6d6acd01ddf9b676c8f0285
Instruction Fuzzy Hash: 8D315235E1060A9FDB14DFA4D865A9EB7B2FF89300F14C529E806E7750DB71AC42CB90

Function 02DA6F78 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1778a8c77b63f48076194eb63540dde3420165253d8e894ca7e597de62073c7a
Instruction ID: 12ae508f4eed0d50a22aa5e591b1b78da68a78a3ee45328ae7dff73da506f22a
Opcode Fuzzy Hash: 1778a8c77b63f48076194eb63540dde3420165253d8e894ca7e597de62073c7a
Instruction Fuzzy Hash: 73313A30E10209DBEB14CF64D461B9EB7B6EB89210F208526E411EB380EB71ED46CB94

Function 02DA26DC Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39223f7a10c0a403de48471038e0d006654c5ba44e0b85033b495a3b3c2ba738
Instruction ID: 88bfb4f6394422d7c930a58850ae5ba0f3f211ce974d3299677ea8524df18e1c
Opcode Fuzzy Hash: 39223f7a10c0a403de48471038e0d006654c5ba44e0b85033b495a3b3c2ba738
Instruction Fuzzy Hash: BD41FFB0D00349DFEB10CFA9C898ADEBBF5BF48314F248029E819AB350DB759945CB91

Function 02DAF1C0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7b93492e68076b585d1fe94674541be8e6dae8f57fc0763a904636985d8f42
Instruction ID: 6e7f01bdb69d539b48aaa9f9d7371d215e44468dba7751fa3c7b1af9febed251
Opcode Fuzzy Hash: ad7b93492e68076b585d1fe94674541be8e6dae8f57fc0763a904636985d8f42
Instruction Fuzzy Hash: 67315035E106099FCB14DFA4D865A9EB7B2FF89300F14C529E806E7750DB71AC42CB90

Function 02DA5099 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d373438ddd862a4897b66adcefbb50649199029c01b8570ea0eb6256173926
Instruction ID: 56d529ee0881b90894cb0705ca58a5f2ce4fbdc557569494bc205241ab8e01e2
Opcode Fuzzy Hash: 98d373438ddd862a4897b66adcefbb50649199029c01b8570ea0eb6256173926
Instruction Fuzzy Hash: F3315C34A04209CFDB14EB74D575AAE77B2AF49344F610478D405AB3A5EB36DC41CB91

Function 02DA26E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a7a8d82dd517d8749e145d483d2a0cb3a2e9621a0cdec7782cf1777e5df310
Instruction ID: f984d128629da5d034f200fcaa587228853265e8365ee5fe9bdf58571b47eac2
Opcode Fuzzy Hash: d6a7a8d82dd517d8749e145d483d2a0cb3a2e9621a0cdec7782cf1777e5df310
Instruction Fuzzy Hash: 8741EFB0D00348DFEB10DFAAC894A9EBBF5FF48314F148429E819AB350DB75A945CB91

Function 02DA50A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012c11779eec11f3868acacec2222cdc3c87d03cfa06f4c24931b6c1bd6d2be4
Instruction ID: 574652480313b797ccfbbe92370a3432acf3572aa4533db0f4d6c7905b12d205
Opcode Fuzzy Hash: 012c11779eec11f3868acacec2222cdc3c87d03cfa06f4c24931b6c1bd6d2be4
Instruction Fuzzy Hash: 5D313A34A00219CBDB24EB74D575AAE73B2AB89744F610478D406AB3A4EB36DC41CBA5

Function 02DA9250 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8f4c2c496430eaad79e36fba09df108d5f0c3c8c630cb819a1e75a8eb23836
Instruction ID: 45398831b65260417588968546a29d96fc636b3ed9ef7b1a19e38f0846e89928
Opcode Fuzzy Hash: 7e8f4c2c496430eaad79e36fba09df108d5f0c3c8c630cb819a1e75a8eb23836
Instruction Fuzzy Hash: A5314975A1020A9BDB05CFA5D8A0BDEB7B2FF89304F54C529E805EB350EB719846CB90

Function 02DA9260 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d566951ded8f25c287801a9fb9730492e57e79939bf76867e55efe950c30074
Instruction ID: 41854b1044bd2c6007508fd0ba1b9533c242484dc592b527beb2e752cf8ae109
Opcode Fuzzy Hash: 6d566951ded8f25c287801a9fb9730492e57e79939bf76867e55efe950c30074
Instruction Fuzzy Hash: 35213C35A1020A9BDB05CFA5D8A0BDEB7B2FF89300F54C529E805EB354EB719C46CB90

Function 02DA16A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ee3ef59768e62647982dea317e78a9f9eb637cd04b3d9e0ff1b75c2979299d
Instruction ID: 356cc86865f2bccaccb8eeaf788c4787e1582c31593288b62c6dadb8ee612efc
Opcode Fuzzy Hash: 61ee3ef59768e62647982dea317e78a9f9eb637cd04b3d9e0ff1b75c2979299d
Instruction Fuzzy Hash: A321A13861020A8FEF12EB78E8A8B993365FB95704F145A32E00AC7359EB24DC55CBC1

Function 02DA9150 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f25200bdcc5a59121a93a20a28422696d7b46a40bc25a969dd3c3131c2797088
Instruction ID: e3a07b341d564a2d7dae6593f19758091b8cd558572717986f10c0c72a72e67b
Opcode Fuzzy Hash: f25200bdcc5a59121a93a20a28422696d7b46a40bc25a969dd3c3131c2797088
Instruction Fuzzy Hash: 5E216235E0020ACBDB18CFA4D864ADEB7B2EF85310F64852AE815FB340DB719C46CB50

Function 02D1D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767448195.0000000002D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2d1d000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220427784eefe907f6234d47dac2917c16f028930fc3c83f9c4c534df538198e
Instruction ID: 56186f4f5360fd6575e32b1d84be09fa54a1bdce0820f8aa19001a2a74fddb19
Opcode Fuzzy Hash: 220427784eefe907f6234d47dac2917c16f028930fc3c83f9c4c534df538198e
Instruction Fuzzy Hash: 5121F275604344EFDB14DF24E980B26BB66FB84314F34C5ADE84A4B786C33AD847CA62

Function 02DA4F88 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 583dcb176d0746c94f85d02fb1fbf9e8482016a860589e7524f252d329cf9dcd
Instruction ID: 1df5606ae83a9b164a23cbca56f0aecf31522dd6582e5f87c411e88a8f7ed534
Opcode Fuzzy Hash: 583dcb176d0746c94f85d02fb1fbf9e8482016a860589e7524f252d329cf9dcd
Instruction Fuzzy Hash: 2E214B34A002098FDB54DB74D569BADB7F1AF98301F2148A8E406EB3A4DB719C04CB94

Function 02DA1380 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9063a6cdbf34911e28e81953dac2c814e7fc3a7192d54390be9e6b26584732ec
Instruction ID: d0feaad7ba860070b9472fd047d546deeb60bd4fd85b424306590228913d8306
Opcode Fuzzy Hash: 9063a6cdbf34911e28e81953dac2c814e7fc3a7192d54390be9e6b26584732ec
Instruction Fuzzy Hash: 8C21AF74A012099BEF396A78E4B8BAD3B61E746315F10082AF44ACB7C0DB69CC81C752

Function 02DA9160 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34963d289b6a5e6575361ca18b4864d3d93b6466738d99ec5335da8eb27f39ef
Instruction ID: 204af56fdbff102cabeb9ad10b7e9df2884f5b2f19048aecde788cb82b4e1c02
Opcode Fuzzy Hash: 34963d289b6a5e6575361ca18b4864d3d93b6466738d99ec5335da8eb27f39ef
Instruction Fuzzy Hash: B2212F35E0020A9BDB18CFA5D864ADEB7B2AF89314F60852AE815FB340DB719D46CB51

Function 02DA1888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d29d4496aca4d93928b589dacf376867177638feaed7d4c68202fc6fb2a0bb35
Instruction ID: f52ae08f6bb4fa5ba454a54606802e7d12b2507c3810f9c597b1bdc47199d151
Opcode Fuzzy Hash: d29d4496aca4d93928b589dacf376867177638feaed7d4c68202fc6fb2a0bb35
Instruction Fuzzy Hash: 63212A34B042198FDB54EB78C525BAE77F6AB89645F200478D40AEB3A4DB32CD40CBA1

Function 02DA16B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c85f53b35e464d9dd7148e7b0cc55ea51ab187dbca034234d38bc11f60b3f2a4
Instruction ID: 646d743fada5196ed2dce5882ffe24bf6e716af375f69a21f2fab31edaf42974
Opcode Fuzzy Hash: c85f53b35e464d9dd7148e7b0cc55ea51ab187dbca034234d38bc11f60b3f2a4
Instruction Fuzzy Hash: 9F21633861020A8FEF16FB78F8A4B993365FB85604F145A36E00AC7359EB25DC55CB91

Function 02DA187A Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0aa2b348bfe3ccf45c3aec668d747654f30ccfe8178aafe122be8f188bb80b0
Instruction ID: c9f15850d025b1a898ec04f8ea7bcf6d230493cedd44ea8f9563e085ab1db8ee
Opcode Fuzzy Hash: d0aa2b348bfe3ccf45c3aec668d747654f30ccfe8178aafe122be8f188bb80b0
Instruction Fuzzy Hash: CA213634A04205CBDB54EB78C525BAE77F2BF89205F210868D04AEB3A4DB36CC40CBA1

Function 02DA4F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eccac737e53b5cca546b8fe9d1997c4b381b0bed4c3bafb864206b46955bc68
Instruction ID: 67d6a9e73fe994b250565ff7bb7c3dee9d3d389714ee439e0ce4d824e682b777
Opcode Fuzzy Hash: 4eccac737e53b5cca546b8fe9d1997c4b381b0bed4c3bafb864206b46955bc68
Instruction Fuzzy Hash: 8F211934B002098FDB54EB74D569BAE77F1EF88701F210868E406EB3A4EB729D04CB95

Function 02D1D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767448195.0000000002D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2d1d000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da6694d4e5483ad43cd1609eb13bdc6e187ee8b33feb1933b89c06b1e1cbd0c
Instruction ID: 2b52f9ed096db3da411e91942be12bba8e183ba67f5e67c2596ef009109c28e3
Opcode Fuzzy Hash: 5da6694d4e5483ad43cd1609eb13bdc6e187ee8b33feb1933b89c06b1e1cbd0c
Instruction Fuzzy Hash: 6421A1755093C0DFCB02CF24D990715BF72EB46214F28C5EAD8498F6A7C33A984ACB62

Function 02DA17C2 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 663d642d97fa01e16e7f0a12ffe3f0b4fb04eaf073b3c3b26712dc572dcea408
Instruction ID: 0e05e5ca04c247212b6f0fbee8f869162eb357b1f3409df3dfd0dac276c56b63
Opcode Fuzzy Hash: 663d642d97fa01e16e7f0a12ffe3f0b4fb04eaf073b3c3b26712dc572dcea408
Instruction Fuzzy Hash: 5911E576B00256ABCF14AF799859B9E7BF6FB88660F104835E949D3344EB35CC01C790

Function 02DA0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac4d82094bc86921a7be07ea4c2984a15f7cb9ba78f6fd8c5f2b7c023e355aa
Instruction ID: 722caa77b5236e68eb35fb03c15b614aa8752f5596b5febaa1b6a07228105c85
Opcode Fuzzy Hash: 6ac4d82094bc86921a7be07ea4c2984a15f7cb9ba78f6fd8c5f2b7c023e355aa
Instruction Fuzzy Hash: A511A030B012088FEF24BBB9D464B6A3261FB85616F248A39D006CF385DB21DD81CBD5

Function 02DA0838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786499c2a47fef591d3270c4757e8b93daf6e1be145df54ff872a748e8c26dd4
Instruction ID: d712b2b598a841ca1ae2226578f36a839cac906a1e6002a696aa11a2138a2a46
Opcode Fuzzy Hash: 786499c2a47fef591d3270c4757e8b93daf6e1be145df54ff872a748e8c26dd4
Instruction Fuzzy Hash: A711E531B002098BFF256BB9D430BAA3261FB85316F258939D402CB385DB65CD81CBC9

Function 02DA80F1 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04df395b62bafc4b3b215384db0b550325daa830619eaf1ebabaad9f62c6c45
Instruction ID: 8e6464065ffcf749aa912a4fd8d60f25258a60c91c37843e232bb89141c2fdbb
Opcode Fuzzy Hash: b04df395b62bafc4b3b215384db0b550325daa830619eaf1ebabaad9f62c6c45
Instruction Fuzzy Hash: 59113A34A0020DDBDB01EBA8F9A1A9D77A1FB84200F2086BAD405DB254EB319E458B91

Function 02DA148E Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 329d8de1513ba85afaa34173d7b090bd5b29c4a08becb7826cd7f8df3e7233cc
Instruction ID: 228f45959bed203e7d73150b862df82f9ae8ec9fe8dd925e315d03bdf0c7eb25
Opcode Fuzzy Hash: 329d8de1513ba85afaa34173d7b090bd5b29c4a08becb7826cd7f8df3e7233cc
Instruction Fuzzy Hash: 02116131A002159FCB21EFB89460AEEBBF6EB48211F14047AD409E7341E736DD82CBE1

Function 02DA6B9F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d135e0412ab06082c9edc1de89d891ee5e8dd3d561344337c49eaac87a734652
Instruction ID: 91f4f6f07c0c3f03238c56d43a7e40819319bca154e0902ee0e9854f41888b4f
Opcode Fuzzy Hash: d135e0412ab06082c9edc1de89d891ee5e8dd3d561344337c49eaac87a734652
Instruction Fuzzy Hash: 7911D6717046448FC7156BB8D4647AD7BB2EFC6311F1984ABC089CB791EF798C428BA1

Function 02DA1498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679fec341e5456ad97647354cc4f1dad7c7cf447bd03885ac7853d3d5854789f
Instruction ID: cd141579b1faa9283ccfa40397b28175f14d6af29699a3dbbaf35a8617bb4998
Opcode Fuzzy Hash: 679fec341e5456ad97647354cc4f1dad7c7cf447bd03885ac7853d3d5854789f
Instruction Fuzzy Hash: 31014031A012159FCF21EFB89460AAE7BF6EB48255F14047AD80AE7341E736DD81CBE5

Function 02DA9898 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62cdf9f011d18300a068ed26d36c8541bb594ecb151be53060ba6a65b45d8f04
Instruction ID: 188a83e94ca2960cece17f6c4a010599e41564a32e0d6802120cb9d94417dbe3
Opcode Fuzzy Hash: 62cdf9f011d18300a068ed26d36c8541bb594ecb151be53060ba6a65b45d8f04
Instruction Fuzzy Hash: C4015231A002088BDB14EFA9E994BDAB766FFC9310F548174D8085B396EB74AD05CBA1

Function 02DA1524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95876bb74e75174bc68859dfc9a781c8c8cd5f403fd0fd7fda8b5d138ce060b2
Instruction ID: 91555abfa39cb85eb608c2af58d16a9912d704f38b4a50844318b2f1cf757f61
Opcode Fuzzy Hash: 95876bb74e75174bc68859dfc9a781c8c8cd5f403fd0fd7fda8b5d138ce060b2
Instruction Fuzzy Hash: 8EF0F632A041508FDB229BE894A0AEC7B72FA85211F180097C44ADB395D321DC42CB11

Function 02DA7090 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52a06c846094fab02e022f36217cde1d103187f6150c99261f2b4677af441bd
Instruction ID: 25f431c03816b22bcfef4c76e4ca9491ea0dc11bafb84c5de697db361ba0cc08
Opcode Fuzzy Hash: f52a06c846094fab02e022f36217cde1d103187f6150c99261f2b4677af441bd
Instruction Fuzzy Hash: 17F01439B00108CFDB04DB64D5A8AAC7BB2EF88715F2040A8E5068B3A0DF31AD02CB40

Function 02DA8100 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2767966786.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2da0000_DeQadQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4786d2011328ffcfcea40b1af94e9196f3c145eaa936f9e57b5225dd368a1e9
Instruction ID: 9e5ca02db6e9a7876509df110c0c420134aaa2b30baed9398f93263ae5654b35
Opcode Fuzzy Hash: c4786d2011328ffcfcea40b1af94e9196f3c145eaa936f9e57b5225dd368a1e9
Instruction Fuzzy Hash: 43F0CD3491120DEBDB41FBB8F9A1ADD77B1EB84600F6086B9C4059B254EB316E149B91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kzy8qg5lbR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DeQadQO.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kzy8qg5lbR.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0dtkcpd3.ng5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ij2knqz.hv0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_natx4uak.srn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qgf4bzj2.xku.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tb50xwy3.kyy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x0phvmhg.2r1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xj3i4fdi.5m0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ywwo2mux.s2h.psm1

C:\Users\user\AppData\Local\Temp\tmpD8B8.tmp

C:\Users\user\AppData\Local\Temp\tmpEA3C.tmp

C:\Users\user\AppData\Roaming\DeQadQO.exe

C:\Users\user\AppData\Roaming\DeQadQO.exe:Zone.Identifier

Windows Analysis Report
kzy8qg5lbR.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre