Edit tour

Windows Analysis Report
jG8N6WDJOx.exe

Overview

General Information

Sample name:	jG8N6WDJOx.exe renamed because original name is a hash value
Original sample name:	914ca6ae22e3e4d3b6e4fe8442dc7e176037ce54e98dfdec5510a179f4ef3c75.exe
Analysis ID:	1588143
MD5:	a87229b37b8388f3687aaaa3c132ddf2
SHA1:	1390ba7361af77f7d6dbe1b8613faaaec5bc8a47
SHA256:	914ca6ae22e3e4d3b6e4fe8442dc7e176037ce54e98dfdec5510a179f4ef3c75
Tags:	exeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

jG8N6WDJOx.exe (PID: 5544 cmdline: "C:\Users\user\Desktop\jG8N6WDJOx.exe" MD5: A87229B37B8388F3687AAAA3C132DDF2)

powershell.exe (PID: 2504 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7188 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HNkDZJwSy.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7632 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7212 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNkDZJwSy" /XML "C:\Users\user\AppData\Local\Temp\tmp692.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

jG8N6WDJOx.exe (PID: 7404 cmdline: "C:\Users\user\Desktop\jG8N6WDJOx.exe" MD5: A87229B37B8388F3687AAAA3C132DDF2)

HNkDZJwSy.exe (PID: 7588 cmdline: C:\Users\user\AppData\Roaming\HNkDZJwSy.exe MD5: A87229B37B8388F3687AAAA3C132DDF2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "web@iaa-airferight.com", "Password": "webmaster"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.2944845492.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2942551985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2942551985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2944845492.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2944845492.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: jG8N6WDJOx.exe PID: 5544	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jG8N6WDJOx.exe PID: 5544	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: jG8N6WDJOx.exe PID: 5544	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: jG8N6WDJOx.exe PID: 7404	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jG8N6WDJOx.exe PID: 7404	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.jG8N6WDJOx.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.jG8N6WDJOx.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.jG8N6WDJOx.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.jG8N6WDJOx.exe.4bf0008.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.jG8N6WDJOx.exe.4bf0008.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jG8N6WDJOx.exe.4bf0008.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.jG8N6WDJOx.exe.40a4108.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.jG8N6WDJOx.exe.40a4108.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jG8N6WDJOx.exe.40a4108.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.jG8N6WDJOx.exe.40a4108.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.jG8N6WDJOx.exe.40a4108.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jG8N6WDJOx.exe.40a4108.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.jG8N6WDJOx.exe.4bf0008.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.jG8N6WDJOx.exe.4bf0008.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jG8N6WDJOx.exe.4bf0008.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e00f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e09f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.jG8N6WDJOx.exe.4b713e8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.jG8N6WDJOx.exe.4b713e8.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.jG8N6WDJOx.exe.4b713e8.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jG8N6WDJOx.exe.4b713e8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xb210f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xec92f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xb2181:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xec9a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xb220b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xeca2b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xb229d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xecabd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xb2307:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xecb27:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xb2379:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xecb99:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xb240f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xecc2f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xb249f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0xeccbf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.jG8N6WDJOx.exe.4af27c8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.jG8N6WDJOx.exe.4af27c8.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.jG8N6WDJOx.exe.4af27c8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jG8N6WDJOx.exe.4af27c8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x130d2f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16b54f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x130da1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16b5c1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x130e2b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16b64b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x130ebd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16b6dd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x130f27:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16b747:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x130f99:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16b7b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x13102f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16b84f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1310bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x16b8df:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\jG8N6WDJOx.exe", ParentImage: C:\Users\user\Desktop\jG8N6WDJOx.exe, ParentProcessId: 5544, ParentProcessName: jG8N6WDJOx.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe", ProcessId: 2504, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Users\user\Desktop\jG8N6WDJOx.exe, Initiated: true, ProcessId: 7404, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNkDZJwSy" /XML "C:\Users\user\AppData\Local\Temp\tmp692.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNkDZJwSy" /XML "C:\Users\user\AppData\Local\Temp\tmp692.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\jG8N6WDJOx.exe", ParentImage: C:\Users\user\Desktop\jG8N6WDJOx.exe, ParentProcessId: 5544, ParentProcessName: jG8N6WDJOx.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNkDZJwSy" /XML "C:\Users\user\AppData\Local\Temp\tmp692.tmp", ProcessId: 7212, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\jG8N6WDJOx.exe", ParentImage: C:\Users\user\Desktop\jG8N6WDJOx.exe, ParentProcessId: 5544, ParentProcessName: jG8N6WDJOx.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe", ProcessId: 2504, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNkDZJwSy" /XML "C:\Users\user\AppData\Local\Temp\tmp692.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNkDZJwSy" /XML "C:\Users\user\AppData\Local\Temp\tmp692.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\jG8N6WDJOx.exe", ParentImage: C:\Users\user\Desktop\jG8N6WDJOx.exe, ParentProcessId: 5544, ParentProcessName: jG8N6WDJOx.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNkDZJwSy" /XML "C:\Users\user\AppData\Local\Temp\tmp692.tmp", ProcessId: 7212, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: jG8N6WDJOx.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\HNkDZJwSy.exe

Avira: detection malicious, Label: HEUR/AGEN.1357257

Found malware configuration

Source: 8.2.jG8N6WDJOx.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "web@iaa-airferight.com", "Password": "webmaster"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\HNkDZJwSy.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Roaming\HNkDZJwSy.exe	Virustotal: Detection: 52%			Perma Link

Multi AV Scanner detection for submitted file

Source: jG8N6WDJOx.exe	ReversingLabs: Detection: 78%
Source: jG8N6WDJOx.exe	Virustotal: Detection: 52%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\HNkDZJwSy.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: jG8N6WDJOx.exe

Joe Sandbox ML: detected

Source: jG8N6WDJOx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: jG8N6WDJOx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4b713e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4af27c8.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:51543 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 46.175.148.58 46.175.148.58
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 46.175.148.58:25

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.iaa-airferight.com
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: HNkDZJwSy.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: jG8N6WDJOx.exe, 00000008.00000002.2944845492.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: jG8N6WDJOx.exe, 00000000.00000002.1731950261.00000000032C9000.00000004.00000800.00020000.00000000.sdmp, jG8N6WDJOx.exe, 00000008.00000002.2944845492.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: jG8N6WDJOx.exe, HNkDZJwSy.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: jG8N6WDJOx.exe, 00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp, jG8N6WDJOx.exe, 00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp, jG8N6WDJOx.exe, 00000008.00000002.2942551985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: jG8N6WDJOx.exe, 00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp, jG8N6WDJOx.exe, 00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp, jG8N6WDJOx.exe, 00000008.00000002.2942551985.0000000000402000.00000040.00000400.00020000.00000000.sdmp, jG8N6WDJOx.exe, 00000008.00000002.2944845492.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: jG8N6WDJOx.exe, 00000008.00000002.2944845492.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: jG8N6WDJOx.exe, 00000008.00000002.2944845492.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49734 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.jG8N6WDJOx.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.jG8N6WDJOx.exe.4bf0008.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.jG8N6WDJOx.exe.40a4108.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.jG8N6WDJOx.exe.40a4108.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.jG8N6WDJOx.exe.4bf0008.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.jG8N6WDJOx.exe.4b713e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.jG8N6WDJOx.exe.4af27c8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0134D74C	0_2_0134D74C
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_079355DB	0_2_079355DB
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_07936458	0_2_07936458
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793BC58	0_2_0793BC58
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793DB80	0_2_0793DB80
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_07934BA0	0_2_07934BA0
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793D280	0_2_0793D280
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_07933793	0_2_07933793
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793BF10	0_2_0793BF10
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793BF00	0_2_0793BF00
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_079386B0	0_2_079386B0
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_079386C0	0_2_079386C0
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793C638	0_2_0793C638
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793C648	0_2_0793C648
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_07938D29	0_2_07938D29
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_079374B8	0_2_079374B8
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_079374A8	0_2_079374A8
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793BC48	0_2_0793BC48
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_07936391	0_2_07936391
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793633A	0_2_0793633A
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_07938B58	0_2_07938B58
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_07938B49	0_2_07938B49
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_07936371	0_2_07936371
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793DB70	0_2_0793DB70
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_079342DE	0_2_079342DE
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793C250	0_2_0793C250
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_07934250	0_2_07934250
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793C241	0_2_0793C241
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793D270	0_2_0793D270
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793C9F9	0_2_0793C9F9
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793E130	0_2_0793E130
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793E120	0_2_0793E120
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_079388B9	0_2_079388B9
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_079388C8	0_2_079388C8
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793503B	0_2_0793503B
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793C820	0_2_0793C820
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_02C7E6A1	8_2_02C7E6A1
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_02C74A98	8_2_02C74A98
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_02C73E80	8_2_02C73E80
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_02C741C8	8_2_02C741C8
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_02C7A960	8_2_02C7A960
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_06BA5588	8_2_06BA5588
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_06BA65E0	8_2_06BA65E0
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_06BA7D68	8_2_06BA7D68
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_06BAB20F	8_2_06BAB20F
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_06BA3040	8_2_06BA3040
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_06BA7688	8_2_06BA7688
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_06BA5CD3	8_2_06BA5CD3
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_06BAE388	8_2_06BAE388
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_06BA2349	8_2_06BA2349
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_06BA0040	8_2_06BA0040
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_06BA0006	8_2_06BA0006

Source: jG8N6WDJOx.exe

Static PE information: invalid certificate

Source: jG8N6WDJOx.exe, 00000000.00000002.1751921166.00000000076CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameChromeSetup.exe< vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe, 00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe, 00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe, 00000000.00000000.1692310779.0000000000CCE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameChromeSetup.exe< vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe, 00000000.00000002.1760049118.000000000A980000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe, 00000000.00000002.1747810944.0000000005AE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe, 00000000.00000002.1730939225.00000000013ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe, 00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe, 00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe, 00000000.00000002.1731950261.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe, 00000008.00000002.2943101125.0000000001158000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe, 00000008.00000002.2942551985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe, 00000008.00000002.2942804059.0000000000F59000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs jG8N6WDJOx.exe
Source: jG8N6WDJOx.exe	Binary or memory string: OriginalFilenameChromeSetup.exe< vs jG8N6WDJOx.exe

Source: jG8N6WDJOx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.2.jG8N6WDJOx.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.jG8N6WDJOx.exe.4bf0008.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.jG8N6WDJOx.exe.40a4108.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.jG8N6WDJOx.exe.40a4108.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.jG8N6WDJOx.exe.4bf0008.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.jG8N6WDJOx.exe.4b713e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.jG8N6WDJOx.exe.4af27c8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: jG8N6WDJOx.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: HNkDZJwSy.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@14/13@3/2

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

File created: C:\Users\user\AppData\Roaming\HNkDZJwSy.exe

Jump to behavior

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7236:120:WilError_03

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

File created: C:\Users\user\AppData\Local\Temp\tmp692.tmp

Jump to behavior

Source: jG8N6WDJOx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: jG8N6WDJOx.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: jG8N6WDJOx.exe	ReversingLabs: Detection: 78%
Source: jG8N6WDJOx.exe	Virustotal: Detection: 52%

Source: jG8N6WDJOx.exe	String found in binary or memory: appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={7845CB06-2203-CC75-ADD7-5EC2F08BF338}&lang=en&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&brand=RXQR&installdataindex=empty
Source: jG8N6WDJOx.exe	String found in binary or memory: appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={7845CB06-2203-CC75-ADD7-5EC2F08BF338}&lang=en&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&brand=RXQR&installdataindex=empty0

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

File read: C:\Users\user\Desktop\jG8N6WDJOx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\jG8N6WDJOx.exe "C:\Users\user\Desktop\jG8N6WDJOx.exe"
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HNkDZJwSy.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNkDZJwSy" /XML "C:\Users\user\AppData\Local\Temp\tmp692.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Users\user\Desktop\jG8N6WDJOx.exe "C:\Users\user\Desktop\jG8N6WDJOx.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\HNkDZJwSy.exe C:\Users\user\AppData\Roaming\HNkDZJwSy.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HNkDZJwSy.exe"	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNkDZJwSy" /XML "C:\Users\user\AppData\Local\Temp\tmp692.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Users\user\Desktop\jG8N6WDJOx.exe "C:\Users\user\Desktop\jG8N6WDJOx.exe"	Jump to behavior

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: jG8N6WDJOx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: jG8N6WDJOx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793E05B pushfd ; ret	0_2_0793E061
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 0_2_0793D04A push CC0793CCh; retf	0_2_0793D051
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_02C70C55 push edi; retf	8_2_02C70C7A
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Code function: 8_2_06BAFFBF push es; ret	8_2_06BAFFC0

Source: jG8N6WDJOx.exe	Static PE information: section name: .text entropy: 7.69734338252707
Source: HNkDZJwSy.exe.0.dr	Static PE information: section name: .text entropy: 7.69734338252707

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

File created: C:\Users\user\AppData\Roaming\HNkDZJwSy.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNkDZJwSy" /XML "C:\Users\user\AppData\Local\Temp\tmp692.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: jG8N6WDJOx.exe PID: 5544, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: 1340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: 3070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: 5070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: 7E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: 8E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: 8FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: 9FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: AA00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: BA00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: CA00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6911	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2593	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7188	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2271	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Window / User API: threadDelayed 3626	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Window / User API: threadDelayed 6223	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7268	Thread sleep count: 6911 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7252	Thread sleep count: 2593 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7480	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7412	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7604	Thread sleep count: 3626 > 30	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -99844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -99730s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7604	Thread sleep count: 6223 > 30	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -99625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -99515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -99394s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -99245s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -99141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -99031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -98922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -98812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -98703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -98135s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -97919s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -97791s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -97468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -97140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -96921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -96811s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -96699s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -96594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -96469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -96274s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -96150s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -96031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -95922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -95812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -95703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -95594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -95484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -95375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -95266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -95156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -95047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -94938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -94828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -94715s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -94609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -94500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -94390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe TID: 7600	Thread sleep time: -94281s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 99844	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 99730	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 99625	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 99515	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 99394	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 99245	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 99141	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 99031	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 98922	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 98812	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 98135	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 97919	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 97791	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 96921	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 96811	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 96699	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 96594	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 96469	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 96274	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 96150	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 96031	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 95922	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 95812	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 95703	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 95594	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 95484	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 95375	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 95266	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 95156	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 95047	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 94938	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 94828	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 94715	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 94609	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 94500	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 94390	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Thread delayed: delay time: 94281	Jump to behavior

Source: jG8N6WDJOx.exe, 00000000.00000002.1751921166.00000000076A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}tp
Source: jG8N6WDJOx.exe, 00000008.00000002.2943737327.0000000001229000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe"
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HNkDZJwSy.exe"
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HNkDZJwSy.exe"	Jump to behavior

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HNkDZJwSy.exe"	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNkDZJwSy" /XML "C:\Users\user\AppData\Local\Temp\tmp692.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Process created: C:\Users\user\Desktop\jG8N6WDJOx.exe "C:\Users\user\Desktop\jG8N6WDJOx.exe"	Jump to behavior

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Users\user\Desktop\jG8N6WDJOx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Users\user\Desktop\jG8N6WDJOx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

Code function: 8_2_02C76CE8 GetUserNameW,

8_2_02C76CE8

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 8.2.jG8N6WDJOx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4bf0008.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.40a4108.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.40a4108.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4bf0008.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4b713e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4af27c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2944845492.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2942551985.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2944845492.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jG8N6WDJOx.exe PID: 5544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jG8N6WDJOx.exe PID: 7404, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\jG8N6WDJOx.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 8.2.jG8N6WDJOx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4bf0008.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.40a4108.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.40a4108.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4bf0008.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4b713e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4af27c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2942551985.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2944845492.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jG8N6WDJOx.exe PID: 5544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jG8N6WDJOx.exe PID: 7404, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 8.2.jG8N6WDJOx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4bf0008.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.40a4108.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.40a4108.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4bf0008.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4b713e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jG8N6WDJOx.exe.4af27c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2944845492.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2942551985.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2944845492.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jG8N6WDJOx.exe PID: 5544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jG8N6WDJOx.exe PID: 7404, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 Account Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	2 Obfuscated Files or Information	1 Credentials in Registry	1 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	24 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	211 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	141 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
jG8N6WDJOx.exe	79%	ReversingLabs	Win32.Infostealer.Pony
jG8N6WDJOx.exe	52%	Virustotal		Browse
jG8N6WDJOx.exe	100%	Avira	HEUR/AGEN.1357257
jG8N6WDJOx.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\HNkDZJwSy.exe	100%	Avira	HEUR/AGEN.1357257
C:\Users\user\AppData\Roaming\HNkDZJwSy.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\HNkDZJwSy.exe	79%	ReversingLabs	Win32.Infostealer.Pony
C:\Users\user\AppData\Roaming\HNkDZJwSy.exe	52%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
mail.iaa-airferight.com	46.175.148.58	true	false	high
api.ipify.org	104.26.13.205	true	false	high
15.164.165.52.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.apache.org/licenses/LICENSE-2.0	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designersG	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/?	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://account.dyn.com/	jG8N6WDJOx.exe, 00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp, jG8N6WDJOx.exe, 00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp, jG8N6WDJOx.exe, 00000008.00000002.2942551985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers?	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mail.iaa-airferight.com	jG8N6WDJOx.exe, 00000008.00000002.2944845492.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.tiro.com	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.goodfont.co.kr	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ipify.org/t	jG8N6WDJOx.exe, 00000008.00000002.2944845492.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.carterandcone.coml	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.typography.netD	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/cabarga.htmlN	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/staff/dennis.htm	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ipify.org	jG8N6WDJOx.exe, 00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp, jG8N6WDJOx.exe, 00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp, jG8N6WDJOx.exe, 00000008.00000002.2942551985.0000000000402000.00000040.00000400.00020000.00000000.sdmp, jG8N6WDJOx.exe, 00000008.00000002.2944845492.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/frere-user.html	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.jiyu-kobo.co.jp/	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers8	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fonts.com	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sandoll.co.kr	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.zhongyicts.com.cn	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	jG8N6WDJOx.exe, 00000000.00000002.1731950261.00000000032C9000.00000004.00000800.00020000.00000000.sdmp, jG8N6WDJOx.exe, 00000008.00000002.2944845492.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sakkal.com	jG8N6WDJOx.exe, 00000000.00000002.1748233372.00000000070D2000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	false
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588143
Start date and time:	2025-01-10 21:53:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jG8N6WDJOx.exe renamed because original name is a hash value
Original Sample Name:	914ca6ae22e3e4d3b6e4fe8442dc7e176037ce54e98dfdec5510a179f4ef3c75.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@14/13@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 83 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 172.202.163.200, 52.165.164.15, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:54:33	API Interceptor	187x Sleep call for process: jG8N6WDJOx.exe modified
15:54:36	API Interceptor	70x Sleep call for process: powershell.exe modified
20:54:38	Task Scheduler	Run new task: HNkDZJwSy path: C:\Users\user\AppData\Roaming\HNkDZJwSy.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.175.148.58	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse
	kzy8qg5lbR.exe	Get hash	malicious	AgentTesla	Browse
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse
	PO for fabric forecast.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse
104.26.13.205	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	kzy8qg5lbR.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO for fabric forecast.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	46.175.148.58
	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
api.ipify.org	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	s2Jg1MAahY.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Y8Q1voljvb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	IUqsn1SBGy.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DpTbBYeE7J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	RJKUWSGxej.exe	Get hash	malicious	AgentTesla, RedLine	Browse	104.26.13.205
	7DpzcPcsTS.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	B8FnDUj8hy.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	FSRHC6mB16.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLAGIDKOM-NETUA	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	kzy8qg5lbR.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO for fabric forecast.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	46.175.148.58
	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
CLOUDFLARENETUS	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	gKvjKMCUfq.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	104.26.13.205
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	xXUnP7uCBJ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.26.13.205
	http://diebinjmajbkhhg.top/1.php?s=527	Get hash	malicious	Unknown	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\jG8N6WDJOx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380134126512796
Encrypted:	false
SSDEEP:	48:+WSU4xc4RQmFoUeW+gZ9tK8NPZHUxL7u1iMuge//ZmUyus:+LHxcIFKLgZ2KRHWLOuggs
MD5:	62DC4E63B1F62F1DED898AF25361C680
SHA1:	0A47F559038057B9F4D675DADDECA31DF059A0B4
SHA-256:	FCF266542D0006B1E56E72E813591B488253941A83B76524EA73204D8BA45FE4
SHA-512:	77B22859EB2A19597EA67F2C7CCE084250CB2A2DFA6230AD284838AB834B19CA80A6958A56BC5E05005B4F9A4585FE97195C93E9A91ABC0864014BA376F7DE45
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.ConfigurationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1j3smgav.5bq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3fjl04yx.1n1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_erkkbfqe.ais.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lfqzb4bo.fhg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lpeug3kc.ln3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oznbv1j0.od4.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s3rv4uii.5js.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zschz2dd.g0q.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp692.tmp

Download File

Process:	C:\Users\user\Desktop\jG8N6WDJOx.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1575
Entropy (8bit):	5.116840977996722
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaxxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTgv
MD5:	C77BC37BAE609C34D33F67DC8E4ED3CB
SHA1:	5F78910F55C6BD8360782792AF340EB40807341F
SHA-256:	323AA3BFB2EE323FA62C5F3CDED42CBD6158A37870931DD16C695401B759CFC7
SHA-512:	D7B90425E0369D00D44C00B135B3A5F572B4A3E426CC5892CE70A11DC14CF842FCD43ED1F36094A21C5D815C944056B34C41AE3FC59FEFBC491CFA6ABAE18F77
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\HNkDZJwSy.exe

Download File

Process:	C:\Users\user\Desktop\jG8N6WDJOx.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1030192
Entropy (8bit):	7.461054860796241
Encrypted:	false
SSDEEP:	12288:12MKhM39TXsTAi2deLrLGAblJKLAP6ghYZ0zsEoxuj0A7JosuLsitF:0Maci2debGAnnLnzsEoAj0AFotLzF
MD5:	A87229B37B8388F3687AAAA3C132DDF2
SHA1:	1390BA7361AF77F7D6DBE1B8613FAAAEC5BC8A47
SHA-256:	914CA6AE22E3E4D3B6E4FE8442DC7E176037CE54E98DFDEC5510A179F4EF3C75
SHA-512:	EE8FF4C10150A3EA9FE5C2DF88F353A7AF28E462628602B7FD4E9F4BE1E92445D31167ECFEE01AE27E1579D800DC4A7B1E8D6DCBCEF9944A37DB36135096ECF8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 52%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#Yg..............0.................. ........@.. ....................................@.....................................O....................l..0L........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc...............j..............@..B........................H.......\|<..............f.. i..........................................J.(.....s....}......0..J........{......(....o.....(.....r...p..(....o....}.....{.....{.....{.....io....&b.(.....s....}.....(......{.....{....o.....{....o.....{....o.....{....o....o....z.,..{....,..{....o......(......0...............(....s......s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s ...}.....s....}.....s....}.....(!....{.....o"....{.......rs#...o$....{........s%...o&....{.

C:\Users\user\AppData\Roaming\HNkDZJwSy.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\jG8N6WDJOx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.461054860796241
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	jG8N6WDJOx.exe
File size:	1'030'192 bytes
MD5:	a87229b37b8388f3687aaaa3c132ddf2
SHA1:	1390ba7361af77f7d6dbe1b8613faaaec5bc8a47
SHA256:	914ca6ae22e3e4d3b6e4fe8442dc7e176037ce54e98dfdec5510a179f4ef3c75
SHA512:	ee8ff4c10150a3ea9fe5c2df88f353a7af28e462628602b7fd4e9f4be1e92445d31167ecfee01ae27e1579d800dc4a7b1e8d6dcbcef9944a37db36135096ecf8
SSDEEP:	12288:12MKhM39TXsTAi2deLrLGAblJKLAP6ghYZ0zsEoxuj0A7JosuLsitF:0Maci2debGAnnLnzsEoAj0AFotLzF
TLSH:	9F25F4832A2DA672DE38A73C40159CF891B41D6C6188B5A25BF97F3EE57C0225D0FE1D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#Yg..............0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	2946e68e96b3ca4d

Static PE Info

General

Entrypoint:	0x4ccffe
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x675923AF [Wed Dec 11 05:31:27 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	02/07/2021 01:00:00 11/07/2024 00:59:59
Subject Chain	CN=Google LLC, O=Google LLC, L=Mountain View, S=California, C=US
Version:	3
Thumbprint MD5:	DC429A22AA63D23DB8E84F53D05D1D48
Thumbprint SHA-1:	2673EA6CC23BEFFDA49AC715B121544098A1284C
Thumbprint SHA-256:	7D3D117664F121E592EF897973EF9C159150E3D736326E9CD2755F71E0FEBC0C
Serial:	0E4418E2DEDE36DD2974C3443AFB5CE5

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
push ebx
add byte ptr [ecx+00h], bh
jnc 00007F5F786E5CE2h
je 00007F5F786E5CE2h
add byte ptr [ebp+00h], ch
add byte ptr [edx+00h], dl
add byte ptr [esi+00h], ah
insb
add byte ptr [ebp+00h], ah
arpl word ptr [eax], ax
je 00007F5F786E5CE2h
imul eax, dword ptr [eax], 006E006Fh
add byte ptr [ecx+00h], al
jnc 00007F5F786E5CE2h
jnc 00007F5F786E5CE2h
add byte ptr [ebp+00h], ch
bound eax, dword ptr [eax]
insb
add byte ptr [ecx+00h], bh
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
add byte ptr [edi+00h], ch
popad
add byte ptr [eax+eax+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xccfac	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xce000	0x2b5ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xf6c00	0x4c30
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xcb044	0xcb200	c9b96465254be0e7f63cfb0ce61916af	False	0.8794387019230769	data	7.69734338252707	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xce000	0x2b5ac	0x2b600	0e35e18b593290b68374f358d8ac58ad	False	0.20862977305475505	data	5.110806553807546	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfa000	0xc	0x200	e05c072a1996c22e252d310323f0990c	False	0.041015625	data	0.07763316234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xce298	0x3751	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9929383518113127
RT_ICON	0xd19ec	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.0891251626641429
RT_ICON	0xe2214	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.13335610678999368
RT_ICON	0xeb6bc	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.16816081330868762
RT_ICON	0xf0b44	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.15594000944733113
RT_ICON	0xf4d6c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.23392116182572614
RT_ICON	0xf7314	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.274624765478424
RT_ICON	0xf83bc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.41885245901639345
RT_ICON	0xf8d44	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5
RT_GROUP_ICON	0xf91ac	0x84	data	0.7045454545454546
RT_GROUP_ICON	0xf9230	0x14	data	1.05
RT_VERSION	0xf9244	0x368	data	0.40940366972477066

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:54:37.072803974 CET	49734	443	192.168.2.4	104.26.13.205
Jan 10, 2025 21:54:37.072870016 CET	443	49734	104.26.13.205	192.168.2.4
Jan 10, 2025 21:54:37.072954893 CET	49734	443	192.168.2.4	104.26.13.205
Jan 10, 2025 21:54:37.087002993 CET	49734	443	192.168.2.4	104.26.13.205
Jan 10, 2025 21:54:37.087040901 CET	443	49734	104.26.13.205	192.168.2.4
Jan 10, 2025 21:54:37.557516098 CET	443	49734	104.26.13.205	192.168.2.4
Jan 10, 2025 21:54:37.557607889 CET	49734	443	192.168.2.4	104.26.13.205
Jan 10, 2025 21:54:37.561448097 CET	49734	443	192.168.2.4	104.26.13.205
Jan 10, 2025 21:54:37.561465025 CET	443	49734	104.26.13.205	192.168.2.4
Jan 10, 2025 21:54:37.561712980 CET	443	49734	104.26.13.205	192.168.2.4
Jan 10, 2025 21:54:37.701688051 CET	49734	443	192.168.2.4	104.26.13.205
Jan 10, 2025 21:54:37.962240934 CET	49734	443	192.168.2.4	104.26.13.205
Jan 10, 2025 21:54:38.003464937 CET	443	49734	104.26.13.205	192.168.2.4
Jan 10, 2025 21:54:38.086132050 CET	443	49734	104.26.13.205	192.168.2.4
Jan 10, 2025 21:54:38.086193085 CET	443	49734	104.26.13.205	192.168.2.4
Jan 10, 2025 21:54:38.086414099 CET	49734	443	192.168.2.4	104.26.13.205
Jan 10, 2025 21:54:38.093009949 CET	49734	443	192.168.2.4	104.26.13.205
Jan 10, 2025 21:54:39.022486925 CET	49736	25	192.168.2.4	46.175.148.58
Jan 10, 2025 21:54:40.107995987 CET	49736	25	192.168.2.4	46.175.148.58
Jan 10, 2025 21:54:42.107899904 CET	49736	25	192.168.2.4	46.175.148.58
Jan 10, 2025 21:54:46.107944012 CET	49736	25	192.168.2.4	46.175.148.58
Jan 10, 2025 21:54:54.123575926 CET	49736	25	192.168.2.4	46.175.148.58
Jan 10, 2025 21:55:03.241264105 CET	51543	53	192.168.2.4	162.159.36.2
Jan 10, 2025 21:55:03.246108055 CET	53	51543	162.159.36.2	192.168.2.4
Jan 10, 2025 21:55:03.246233940 CET	51543	53	192.168.2.4	162.159.36.2
Jan 10, 2025 21:55:03.251245022 CET	53	51543	162.159.36.2	192.168.2.4
Jan 10, 2025 21:55:03.695015907 CET	51543	53	192.168.2.4	162.159.36.2
Jan 10, 2025 21:55:03.700026035 CET	53	51543	162.159.36.2	192.168.2.4
Jan 10, 2025 21:55:03.700167894 CET	51543	53	192.168.2.4	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:54:37.007278919 CET	60314	53	192.168.2.4	1.1.1.1
Jan 10, 2025 21:54:37.014694929 CET	53	60314	1.1.1.1	192.168.2.4
Jan 10, 2025 21:54:39.009987116 CET	64440	53	192.168.2.4	1.1.1.1
Jan 10, 2025 21:54:39.021709919 CET	53	64440	1.1.1.1	192.168.2.4
Jan 10, 2025 21:55:03.239953995 CET	53	58234	162.159.36.2	192.168.2.4
Jan 10, 2025 21:55:03.705015898 CET	52453	53	192.168.2.4	1.1.1.1
Jan 10, 2025 21:55:03.726438999 CET	53	52453	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:54:37.007278919 CET	192.168.2.4	1.1.1.1	0x91bb	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:54:39.009987116 CET	192.168.2.4	1.1.1.1	0xbc50	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:55:03.705015898 CET	192.168.2.4	1.1.1.1	0x6339	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:54:37.014694929 CET	1.1.1.1	192.168.2.4	0x91bb	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:54:37.014694929 CET	1.1.1.1	192.168.2.4	0x91bb	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:54:37.014694929 CET	1.1.1.1	192.168.2.4	0x91bb	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:54:39.021709919 CET	1.1.1.1	192.168.2.4	0xbc50	No error (0)	mail.iaa-airferight.com		46.175.148.58	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:55:03.726438999 CET	1.1.1.1	192.168.2.4	0x6339	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	104.26.13.205	443	7404	C:\Users\user\Desktop\jG8N6WDJOx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:54:37 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-10 20:54:38 UTC	424	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:54:38 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8fff903799a618b4-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1509&min_rtt=1499&rtt_var=582&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=769&delivery_rate=1846932&cwnd=201&unsent_bytes=0&cid=880c96b7625e9504&ts=539&x=0"
2025-01-10 20:54:38 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	15:54:32
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\jG8N6WDJOx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\jG8N6WDJOx.exe"
Imagebase:	0xc00000
File size:	1'030'192 bytes
MD5 hash:	A87229B37B8388F3687AAAA3C132DDF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1733796471.0000000004079000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1733796471.00000000048E3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:54:34
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jG8N6WDJOx.exe"
Imagebase:	0x430000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:54:34
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:54:34
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HNkDZJwSy.exe"
Imagebase:	0x430000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:54:35
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:54:35
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HNkDZJwSy" /XML "C:\Users\user\AppData\Local\Temp\tmp692.tmp"
Imagebase:	0x640000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:54:35
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:54:35
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\jG8N6WDJOx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\jG8N6WDJOx.exe"
Imagebase:	0xac0000
File size:	1'030'192 bytes
MD5 hash:	A87229B37B8388F3687AAAA3C132DDF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2944845492.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2942551985.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2942551985.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2944845492.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2944845492.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:54:38
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\HNkDZJwSy.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\HNkDZJwSy.exe
Imagebase:	0x890000
File size:	1'030'192 bytes
MD5 hash:	A87229B37B8388F3687AAAA3C132DDF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs Detection: 52%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:54:39
Start date:	10/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	40
Total number of Limit Nodes:	6

Executed Functions

Function 07934250 Relevance: 4.0, Strings: 3, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 07934560
Te^q, xrefs: 07934359
z^I, xrefs: 079344B1

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: Te^q$Te^q$z^I
API String ID: 0-2886491258
Opcode ID: 4bd8f3b1768ef4f9e5d2ef9d6015f5ac0f90fe1ef0600dc63ae07b4041ac414d
Instruction ID: 17c073ad9bcb656aa8f8a6e132aa3248f0f9c1a8671ed3a16063c906736b126f
Opcode Fuzzy Hash: 4bd8f3b1768ef4f9e5d2ef9d6015f5ac0f90fe1ef0600dc63ae07b4041ac414d
Instruction Fuzzy Hash: 17B189B4E052698FCB04CFE9C9809EDFBB2FF89310F14852AD415AB268D7349946CF94

Function 0793633A Relevance: 2.9, Strings: 2, Instructions: 409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 0793672B
ry, xrefs: 07936724

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: ry$ry
API String ID: 0-883804406
Opcode ID: a7117c9ea256d5deca25c87bf05085a3ec73faa40824ac009d880bdfc252195d
Instruction ID: 98c1d7615bb7651e7d2c23f7c2696fcf05e8726064801a57eeb79a29b251031b
Opcode Fuzzy Hash: a7117c9ea256d5deca25c87bf05085a3ec73faa40824ac009d880bdfc252195d
Instruction Fuzzy Hash: 41F1AEB5E05216EFDB04CFA9D8854EEFBB2FF89314B10856AD405AB345C734A946CF90

Function 07936391 Relevance: 2.9, Strings: 2, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 0793672B
ry, xrefs: 07936724

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: ry$ry
API String ID: 0-883804406
Opcode ID: ece96f2c4890a9f45dc52099ba48ebf2860db8e27c68b4d372f4f0c411fe2d34
Instruction ID: f7aa9b2f69d3192c84806a31ffb66a55027f778dff4df76d68abfab3b8647b2e
Opcode Fuzzy Hash: ece96f2c4890a9f45dc52099ba48ebf2860db8e27c68b4d372f4f0c411fe2d34
Instruction Fuzzy Hash: F3E1AEB5E09216EFDB04CFA9D8854EEFBB2FF89314B10856AD405AB345C734A946CF90

Function 07936371 Relevance: 2.9, Strings: 2, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 0793672B
ry, xrefs: 07936724

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: ry$ry
API String ID: 0-883804406
Opcode ID: 353aa69e28c9cd0d178ab0f46b79abe9564e685b81a91a0f5b286e2e838d6dac
Instruction ID: cd7e10355aea70fee360b587a2f5fa53e471f3c8a4a7b7a8c1be420ad64d5389
Opcode Fuzzy Hash: 353aa69e28c9cd0d178ab0f46b79abe9564e685b81a91a0f5b286e2e838d6dac
Instruction Fuzzy Hash: D8E18CB4D0521AEFDB04CFA9D8854EEFBB2FF89304B10856AD405AB345D734AA46CF94

Function 07936458 Relevance: 2.8, Strings: 2, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 0793672B
ry, xrefs: 07936724

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: ry$ry
API String ID: 0-883804406
Opcode ID: 3f3dcc505327bcb7c6d3886c5e5f5e34acec63a1dd6235c3fe3e4c9565f97acb
Instruction ID: 4b8ab9e1f1db7113335247298cde0ee39cfe691f9125e3aed1527f9a03ecc959
Opcode Fuzzy Hash: 3f3dcc505327bcb7c6d3886c5e5f5e34acec63a1dd6235c3fe3e4c9565f97acb
Instruction Fuzzy Hash: B6C13AB4D1520AEFDB04CFA9C4858AEFBB2FF89300F109569D515AB318D774A982CF94

Function 079342DE Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 07934560
z^I, xrefs: 079344B1

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: Te^q$z^I
API String ID: 0-3592684243
Opcode ID: b189f4bdbf4d59cb7c65d9381848a0ec7500aa914354e61a79ebeb077d8bb5f4
Instruction ID: ee20175562dc8c08d3e2df5500d1d192be5356bd5cb799c26d7c7f32c9b539ac
Opcode Fuzzy Hash: b189f4bdbf4d59cb7c65d9381848a0ec7500aa914354e61a79ebeb077d8bb5f4
Instruction Fuzzy Hash: DEA114B4E112598FCB08CFE9C9805EEFBB2FF89350F24942AD419AB268D7349905CF54

Function 0793D280 Relevance: 2.7, Strings: 2, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TuA, xrefs: 0793D3F0
UC;", xrefs: 0793D46E

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: TuA$UC;"
API String ID: 0-2071649361
Opcode ID: bba80ab56a418a89393ca013dab01a3d9cc95f854de87e932bf37fab96a56798
Instruction ID: 8f1e0fdb415d505a1fa11c601e0670ce6e40ca8bd7882ffb20a195e0d6e4e589
Opcode Fuzzy Hash: bba80ab56a418a89393ca013dab01a3d9cc95f854de87e932bf37fab96a56798
Instruction Fuzzy Hash: 209117B1E24209EFCB08CFE6E49199EFBB2FF89314F10942AE415A7264D7709942CF14

Function 0793D270 Relevance: 2.7, Strings: 2, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TuA, xrefs: 0793D3F0
UC;", xrefs: 0793D46E

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: TuA$UC;"
API String ID: 0-2071649361
Opcode ID: d04bb8f7b42e12e2feb6316b329bda05e2c58b6fb5509e132d1692ce42c4b7be
Instruction ID: 993ea3cc167b866bbb50c6b12684b18d0ca5c96eed4e91f367e32fefdc1f4fc4
Opcode Fuzzy Hash: d04bb8f7b42e12e2feb6316b329bda05e2c58b6fb5509e132d1692ce42c4b7be
Instruction Fuzzy Hash: F09116B1E24209EFCB08CFA6E59199EFBB2FF89314F10942AE415A7264D7349942CF14

Function 0793BC48 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

5=6, xrefs: 0793BD86

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: 5=6
API String ID: 0-2897083178
Opcode ID: 0d5d1b2467fb72a40c4ab903f8ec65b2da50b339870125e2dd24f6feb67a1d04
Instruction ID: 5f3c6da330306897615227420becf65defb57e8dec4f5697fcdda6921229028f
Opcode Fuzzy Hash: 0d5d1b2467fb72a40c4ab903f8ec65b2da50b339870125e2dd24f6feb67a1d04
Instruction Fuzzy Hash: 83715AB4E2520A9FCB04CFA9D9455AEFBB2BF89201F10D92BD01AE7254DB749A01CF51

Function 0793BC58 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

5=6, xrefs: 0793BD86

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: 5=6
API String ID: 0-2897083178
Opcode ID: 60f6a8146cfaa49f47d92b8ffaa76426c68aad769211a774118f3f694bbd6147
Instruction ID: 51190748a31c9d89c557a9f4985eb8f403d967aab961cfbad4ecb5f1904f3597
Opcode Fuzzy Hash: 60f6a8146cfaa49f47d92b8ffaa76426c68aad769211a774118f3f694bbd6147
Instruction Fuzzy Hash: 23615BB4E2520A9FCB04CFA9D8415AEFBF2FF89201F10D92AD01AE7254DB749A01CF55

Function 07934BA0 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

-2m, xrefs: 07934CC3

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: -2m
API String ID: 0-2686427999
Opcode ID: bfdf938a98b666a0a859ee068e1a827953021cfb54cf1f18b7c7eb061b94d129
Instruction ID: 90ec47343404f9907583aebf962dddfd64541bdc05a07fe69c4e603acc4cb4b6
Opcode Fuzzy Hash: bfdf938a98b666a0a859ee068e1a827953021cfb54cf1f18b7c7eb061b94d129
Instruction Fuzzy Hash: 2A513AB0E042498FDB08CFAAD4406AEFBF2FF89304F29D06AD419A7255D7745940CB55

Function 0793DB70 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660cefd84942a7d440af2084aedbe698ce753f1625be70b9bb5a4a4b77787854
Instruction ID: 70908c33b34f9cde60684c59bb25db5ee64a8f816d2ff5d726b536c6d0c19ecb
Opcode Fuzzy Hash: 660cefd84942a7d440af2084aedbe698ce753f1625be70b9bb5a4a4b77787854
Instruction Fuzzy Hash: DAB119B1E15209DFDB18CFA6D99059EFBB2FF89304F20D42AD019A7254DB749A06CF90

Function 0793DB80 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adbd90a8eaef354c63da3f85a32c3639ca88f346c1d91ef33d45b26c633b792b
Instruction ID: 951d64911ab02e288aeffb32f02a0f091b130dba17a9685bedc05b365cd9a037
Opcode Fuzzy Hash: adbd90a8eaef354c63da3f85a32c3639ca88f346c1d91ef33d45b26c633b792b
Instruction Fuzzy Hash: 1AB108B1E15209DFDB18CFA6D99059EFBB2FF89304F20D42AD019AB254DB749A06CF50

Function 079355DB Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b333b37a6815f94010c98d8c75838ec1f67342490634d168c290f80168254e6
Instruction ID: 5ddb019ccfb186659925a52ea6f7e58b1d9f2bb5d49a7d3c2041081d3cf8d860
Opcode Fuzzy Hash: 6b333b37a6815f94010c98d8c75838ec1f67342490634d168c290f80168254e6
Instruction Fuzzy Hash: 5B3146B0E016188BDB18CFAAD8402DEBBB3BFC9310F14C06AD408A7264DB345A56CF90

Function 0134D1C8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0134D256
GetCurrentThread.KERNEL32 ref: 0134D293
GetCurrentProcess.KERNEL32 ref: 0134D2D0
GetCurrentThreadId.KERNEL32 ref: 0134D329

Memory Dump Source

Source File: 00000000.00000002.1730638260.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jG8N6WDJOx.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2e28df6e187847619eb3cac41165c8c4d3ec6e65b74d27304f547a0178cecf16
Instruction ID: d7c49b6443300b31166db304e4c13b86a764672e3f532dc0cc89795636186abb
Opcode Fuzzy Hash: 2e28df6e187847619eb3cac41165c8c4d3ec6e65b74d27304f547a0178cecf16
Instruction Fuzzy Hash: 545145B0900249CFDB18DFA9D548B9EBBF1FF98318F208459D019A7260DB34A988CF65

Function 0134D1D8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0134D256
GetCurrentThread.KERNEL32 ref: 0134D293
GetCurrentProcess.KERNEL32 ref: 0134D2D0
GetCurrentThreadId.KERNEL32 ref: 0134D329

Memory Dump Source

Source File: 00000000.00000002.1730638260.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jG8N6WDJOx.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a2f6b276252208668f10bf1f2684458fcd525924a72536d9ae4016336187e4c2
Instruction ID: d82734e4737149e154407fb2fec2af7588d1a3bfc85472520e60fd04fa79465d
Opcode Fuzzy Hash: a2f6b276252208668f10bf1f2684458fcd525924a72536d9ae4016336187e4c2
Instruction Fuzzy Hash: 565126B4900249CFDB14DFAAD548BDEBBF5FB88318F208459D019A7360DB74A988CF65

Function 0134B209 Relevance: 1.7, APIs: 1, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0134B47E

Memory Dump Source

Source File: 00000000.00000002.1730638260.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jG8N6WDJOx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7ccd08cff73ce213edf60729b9695454f8b3fcbcc0c1e18efb3cbfb42d930fbc
Instruction ID: 19362c4cd50e2b2c7a2c31eeed86aa9d52f4289c1e594f00dd68027030f0bc33
Opcode Fuzzy Hash: 7ccd08cff73ce213edf60729b9695454f8b3fcbcc0c1e18efb3cbfb42d930fbc
Instruction Fuzzy Hash: ED814470A00B458FD765DF2AC44079ABBF5FF89308F008A2ED48ADBA54D735E849CB91

Function 0134449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 013459A9

Memory Dump Source

Source File: 00000000.00000002.1730638260.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jG8N6WDJOx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8e119f8140716960c7a6e1c243d84e4d97dc98179517e4c4cdee7d72d0b7f390
Instruction ID: 3b74c7f7ba73e7beae6ff6ccc9a35b33f426a94352c43e8065cdf7070ba44758
Opcode Fuzzy Hash: 8e119f8140716960c7a6e1c243d84e4d97dc98179517e4c4cdee7d72d0b7f390
Instruction Fuzzy Hash: 0741D0B0C00719CBDB24CFA9C844B9DBBF5FF49308F24806AD408AB255DB756989CF91

Function 013458ED Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 013459A9

Memory Dump Source

Source File: 00000000.00000002.1730638260.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jG8N6WDJOx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 41e160cae4ad7d6773b531d06cc8843f5f8fdeb63c4b39bd145afcb9d47e3577
Instruction ID: 6e0009d1db1c9aa4e6407fb877d4ab851ed5b8320c88867c3b28e2850b7bcc3e
Opcode Fuzzy Hash: 41e160cae4ad7d6773b531d06cc8843f5f8fdeb63c4b39bd145afcb9d47e3577
Instruction Fuzzy Hash: 4541D0B0C00719CFDB24CFA9C88479DBBF5BF49308F24806AD409AB255DB75698ACF91

Function 0134D824 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0134D8AF

Memory Dump Source

Source File: 00000000.00000002.1730638260.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jG8N6WDJOx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8ae1c007f8ecf31e1309faea7808902744dba4d38b37b164ae07bfe58cb0834d
Instruction ID: 2c28ae0f03b75ff7b8b1ea22ff74c71efd9da9fbe159ec6406123f6b2f68b3be
Opcode Fuzzy Hash: 8ae1c007f8ecf31e1309faea7808902744dba4d38b37b164ae07bfe58cb0834d
Instruction Fuzzy Hash: 7121B3B5900258DFDB10CFA9D584AEEBFF4FB48324F14842AE959A7310D378A944CF65

Function 0134B4B0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0134B47E

Memory Dump Source

Source File: 00000000.00000002.1730638260.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jG8N6WDJOx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 30e8b86d63908d0dd30f031507e1d45996487d42052f2dbf0056ae7ac8dfee07
Instruction ID: 7eb846883aa0e1806b64635814a564ef81ddf66781fc759103f6b69e2b090381
Opcode Fuzzy Hash: 30e8b86d63908d0dd30f031507e1d45996487d42052f2dbf0056ae7ac8dfee07
Instruction Fuzzy Hash: DB11E371A003049FEB14DF6ED8007AAFBF9EFD5318F0480BAD108E7265C678A845CBA1

Function 0134D828 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0134D8AF

Memory Dump Source

Source File: 00000000.00000002.1730638260.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jG8N6WDJOx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 78c027c3566d599a3ebe5016590ebc5cb1555c19d794cc1cd2acf2b38ccd3818
Instruction ID: 555fa9c3236b6a764912e55aceac9abf9a32addc53469a27e2cf7e8dfc4e5d49
Opcode Fuzzy Hash: 78c027c3566d599a3ebe5016590ebc5cb1555c19d794cc1cd2acf2b38ccd3818
Instruction Fuzzy Hash: 7B21C4B5900258DFDB10CF9AD584ADEBFF4FB48314F14841AE958A7310D374A944CFA5

Function 0793B468 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0793B4E3

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3026f415e8400efcb57fc2f9131010dec9000b2e285f36e673fdce2ae46f7905
Instruction ID: 2c3437284969772be80a54fbc63b88fa99e79d44417893efbb7cec01a25ec540
Opcode Fuzzy Hash: 3026f415e8400efcb57fc2f9131010dec9000b2e285f36e673fdce2ae46f7905
Instruction Fuzzy Hash: 082106B5900249DFDB10CF9AD484BDEFFF4EB48324F10842AE968A7250D774A685CFA5

Function 0793B470 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0793B4E3

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f429aa39ab0eff98c9509ac2cc2fcb0aa9beab2e29483d921f87bfd396292370
Instruction ID: 032338a1a6a928f9106c264cfa3bb88a9f4471cfb8eb21d13952c85eb3d0e5bd
Opcode Fuzzy Hash: f429aa39ab0eff98c9509ac2cc2fcb0aa9beab2e29483d921f87bfd396292370
Instruction Fuzzy Hash: 4821E4B5900249DFDB10CF9AC484BDEFBF4FB48324F108429E958A7250D778A544CFA5

Function 0134B418 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0134B47E

Memory Dump Source

Source File: 00000000.00000002.1730638260.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jG8N6WDJOx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ef8f41fbb492e36a161d44625b5029f897805f9c02bf824ecf2151b561c66e93
Instruction ID: 4a341ff3d490bfed63a004e985f998e1d0ec905433ea4da19abf129d39d4ce38
Opcode Fuzzy Hash: ef8f41fbb492e36a161d44625b5029f897805f9c02bf824ecf2151b561c66e93
Instruction Fuzzy Hash: 8B11DFB5C002498FDB10CFAAD444ADEFBF4EB88228F14842AD959B7314D379A549CFA5

Function 012DD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730126581.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12dd000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58713fe9078e2006bcd71e7814587e676470086746cb1466d5d058a57a20231c
Instruction ID: 0150a1e321cc8e166ac2d7fd2d3ca4d47c8a5538b9bcd054f81f05a121d4bac6
Opcode Fuzzy Hash: 58713fe9078e2006bcd71e7814587e676470086746cb1466d5d058a57a20231c
Instruction Fuzzy Hash: 81216771550648DFCB01DF58E9C0F27BF65FB84318F20C169E9090B296C336D446CBA1

Function 012DD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730126581.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12dd000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76457a3db98c24d6673bc388ffb10c6b91cd19b535d05cfaaad97850352387b9
Instruction ID: 7c2b6de3d4d0885e7c3fb5eee29e9bf28f432083884ecf882bb2e7940f849726
Opcode Fuzzy Hash: 76457a3db98c24d6673bc388ffb10c6b91cd19b535d05cfaaad97850352387b9
Instruction Fuzzy Hash: E2216775110648DFDB01DF98C9C0B6BBF65FB84324F20C16DE9090B296C336E446CBA1

Function 012ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730200249.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ed000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9355946344d71ca98c99299c34aeaea272b2185fd5499b9504399b1513a470b1
Instruction ID: 3a9f08e3826f203d95ffa832fbad2dd9b867f97d407eee1006072b9fcc05b446
Opcode Fuzzy Hash: 9355946344d71ca98c99299c34aeaea272b2185fd5499b9504399b1513a470b1
Instruction Fuzzy Hash: E1213170614208DFCB15DF68D9C8B26BFA1FB84314F68C56DE90A4B256C37BD84BCA61

Function 012ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730200249.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ed000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db15c745a232e06dbccbd395abb1dfc5f1e326e888b53553ca63e839106c3da
Instruction ID: 7e77d7a327e2fe3e1b7e3bf78cbca56ebf6057e920de5fd51ffcf7ae992aa16d
Opcode Fuzzy Hash: 2db15c745a232e06dbccbd395abb1dfc5f1e326e888b53553ca63e839106c3da
Instruction Fuzzy Hash: E3213774514208DFDB01DF98C5C8B26BBE1FB84324F60C56DD9094B257C376D446CA61

Function 012DD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730126581.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12dd000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 952b3ccc006bc9f411a70a8bad19eead37da78a68fb3728a3c322f8da7b5f944
Instruction ID: 0efec98e861f8fe7c7af407df26bb79780a3dbb6aacd634d338d837a045c86ad
Opcode Fuzzy Hash: 952b3ccc006bc9f411a70a8bad19eead37da78a68fb3728a3c322f8da7b5f944
Instruction Fuzzy Hash: 71110376404284CFCB12CF54D5C4B16BF71FB84318F24C6A9D9090B256C336D45ACBA1

Function 012DD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730126581.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12dd000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 952b3ccc006bc9f411a70a8bad19eead37da78a68fb3728a3c322f8da7b5f944
Instruction ID: 4d2745dc74e3340002d504c827fe7660feeb0d6789ffeadcd33a77f0fd9f3658
Opcode Fuzzy Hash: 952b3ccc006bc9f411a70a8bad19eead37da78a68fb3728a3c322f8da7b5f944
Instruction Fuzzy Hash: 93110076404684DFDB12CF44D9C4B56BF72FB94324F24C2A9DA090B257C33AE45ACBA2

Function 012ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730200249.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ed000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871f7e18c1f6789342e62e19fe4dc660986b6e7c47d5d789a5192454c2bfcfc0
Instruction ID: 484994b5e4a96c65e178b94eed6f55af937e117a6fe037ac5e5a061eb36ef7db
Opcode Fuzzy Hash: 871f7e18c1f6789342e62e19fe4dc660986b6e7c47d5d789a5192454c2bfcfc0
Instruction Fuzzy Hash: 2811BB75504284DFDB02CF54C5C8B15BFA1FB84224F24C6AAD9494B297C33AD40ACB61

Function 012ED017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730200249.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ed000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871f7e18c1f6789342e62e19fe4dc660986b6e7c47d5d789a5192454c2bfcfc0
Instruction ID: bb87d1e935da6e98e5926e8a2ee8c07b4c7ca3cbb863ee1d778494034fe8e55e
Opcode Fuzzy Hash: 871f7e18c1f6789342e62e19fe4dc660986b6e7c47d5d789a5192454c2bfcfc0
Instruction Fuzzy Hash: 0211DD75504284CFDB12CF58D5C8B16FFA2FB84314F28C6AAD9094B656C33BD40ACBA2

Non-executed Functions

Function 0793E130 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

{#L, xrefs: 0793E308

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: {#L
API String ID: 0-1361971085
Opcode ID: e3da3181ba2546dc09432d2a82d3e7cd179f4c5b0e4d87817c533c121dd98489
Instruction ID: 872c758aa824ad4c34066b49dcf93e3e3e3d69e90845a9c756035c6de7f1c2e7
Opcode Fuzzy Hash: e3da3181ba2546dc09432d2a82d3e7cd179f4c5b0e4d87817c533c121dd98489
Instruction Fuzzy Hash: E2D1F4B4E1521ADFCB18CFEAD98059EFBF2BF89340F14D52AD419AB264D73499028F50

Function 0793E120 Relevance: 1.6, Strings: 1, Instructions: 323COMMON

Download Yara Rule

Strings

{#L, xrefs: 0793E308

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: {#L
API String ID: 0-1361971085
Opcode ID: 5fe7a0d71715786b06ef6cbc2deef13d13bdf46c8a726fc322cf4d8b84886d72
Instruction ID: 450fddde9f4081c3e53b0710e0e769c40e8970ec276c2ba05fa702f38a4b6c2b
Opcode Fuzzy Hash: 5fe7a0d71715786b06ef6cbc2deef13d13bdf46c8a726fc322cf4d8b84886d72
Instruction Fuzzy Hash: D2D105B4E1421ADFCB18CFEAD98059EFBF2BF89340F14D56AD419AB264D73499028F50

Function 0793503B Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

98R, xrefs: 079351A3

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: 98R
API String ID: 0-576591972
Opcode ID: a926d9d2ea0289585a44db33bb60fb965ae2f266070e323b9475e1165124b773
Instruction ID: 46d28f2e78d98c262a00cadab458785c2a9ac251966a1d0b91688aeeb93116d6
Opcode Fuzzy Hash: a926d9d2ea0289585a44db33bb60fb965ae2f266070e323b9475e1165124b773
Instruction Fuzzy Hash: 9B7139B5E1520ADFCB04CFA9D4819AEFBB2FF89310F15842AD414AB318D3759A51CF94

Function 0793C250 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

iUfo, xrefs: 0793C366

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: iUfo
API String ID: 0-3820436262
Opcode ID: e3306d941e784690b90373189708032d55fa5c5e99a60af0f1df2926f0a14200
Instruction ID: b7083d21a61712cd7706e837bd03184d779555c7ee73e4f598a1db460af2b01f
Opcode Fuzzy Hash: e3306d941e784690b90373189708032d55fa5c5e99a60af0f1df2926f0a14200
Instruction Fuzzy Hash: A15104B5E106199FCB04CFEAD8455EEFBF2BF8A300F10942AE405B7254EB7499058F64

Function 0793C241 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

iUfo, xrefs: 0793C366

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: iUfo
API String ID: 0-3820436262
Opcode ID: fd3f1852582f50c6a3a8f2d5a687f60c52526520f4dc471015167cfe09da2775
Instruction ID: 1c9548d9fafada8398c9ee0c9261c0fa0517fdba2ff5ded36744e693556b6e7d
Opcode Fuzzy Hash: fd3f1852582f50c6a3a8f2d5a687f60c52526520f4dc471015167cfe09da2775
Instruction Fuzzy Hash: 5C5116B5E116198FCB08CFE9D9455EEFBF2BF8A300F10942AE405B7254EB349A058B64

Function 0793C820 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

w7e^, xrefs: 0793C77D

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: w7e^
API String ID: 0-1657886525
Opcode ID: 3dac80f7b6bda6a931db9c358870c833bd2e04336bbba00ce0f1bbef587ba98e
Instruction ID: 01c69a4c244035e425689477a16513cb3878d3fc8c6d8bb4a0f2e8da24228d02
Opcode Fuzzy Hash: 3dac80f7b6bda6a931db9c358870c833bd2e04336bbba00ce0f1bbef587ba98e
Instruction Fuzzy Hash: 46515AB5D15A0ADFCF04CFA9C4415EEFBB2FB8A305F14A56AC406B7280D33886418F64

Function 0793C638 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

w7e^, xrefs: 0793C77D

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: w7e^
API String ID: 0-1657886525
Opcode ID: adbcd94843b326a3dbc2a830cde736052dd85dfe1530ed17a4cb5d558eec2348
Instruction ID: 61c2a60ac1261c7d966e7d7385f7ae78cd4f1eb243332330a247a0d7efd08f16
Opcode Fuzzy Hash: adbcd94843b326a3dbc2a830cde736052dd85dfe1530ed17a4cb5d558eec2348
Instruction Fuzzy Hash: 0E4139B5D15A0ADFCF04CFA6C4405EEFBB2FB8A205F14A52AC416B7294D7384642CF65

Function 0793C648 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

w7e^, xrefs: 0793C77D

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: w7e^
API String ID: 0-1657886525
Opcode ID: b3f8a653f0feaf11811ba67f45d2f2033c4d4f647e32851260d6cbf31e963326
Instruction ID: 5c2fceb8a479f1bff5d4b1e49234b139f9f197f95dfa850c3e2fd87ef81a543d
Opcode Fuzzy Hash: b3f8a653f0feaf11811ba67f45d2f2033c4d4f647e32851260d6cbf31e963326
Instruction Fuzzy Hash: FB4139B5D15A1ADBCF04CFA6C4405EEFBB2FB8A205F14A52AC416B7284D7784642CF68

Function 07938D29 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

0ni, xrefs: 07938EA3

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: 0ni
API String ID: 0-1488673370
Opcode ID: 2f9430f9892d6262460b001f85a40580e5270bb49f2b57454378cee219dc67db
Instruction ID: b635c16d7ff6718ebb947c4deff03332c8dcbca6ea85b103fa3fc4000c73fee7
Opcode Fuzzy Hash: 2f9430f9892d6262460b001f85a40580e5270bb49f2b57454378cee219dc67db
Instruction Fuzzy Hash: 8C516CB1E056588BDB58CF6B994479EFBF3BFC8300F14C1BA951DA6214DB341A868F11

Function 0134D74C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730638260.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f412a5b7569085d2aa066f7ab0ace22e769872b022c56a05c4693f19c5793e14
Instruction ID: 364d7b6398e5ace3862573e2fff0e6a0d4e9102b647b798d6ef5afb500be857b
Opcode Fuzzy Hash: f412a5b7569085d2aa066f7ab0ace22e769872b022c56a05c4693f19c5793e14
Instruction Fuzzy Hash: ABA19236E0020ACFCF15DFB8C84059EBBF6FF95308B15816AE905AB265DB35E955CB40

Function 079374B8 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ffa913504d4bdbcd6bd8aed750fb7cea4f3a71ae2bfcc2d09e32469818e1cf
Instruction ID: 263ba08302b30511aa461d24de530124feded8ed3173e75f8709ed2877df4fee
Opcode Fuzzy Hash: 55ffa913504d4bdbcd6bd8aed750fb7cea4f3a71ae2bfcc2d09e32469818e1cf
Instruction Fuzzy Hash: EA91C3B4A1521ACFCB48CFA9C58499EFBF2FF89314F24995AD415AB320D370AA41CF51

Function 079374A8 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b350da160712cd69f24d859834969ce18f0dcc743a0a72618e8ee9e59902702a
Instruction ID: 08ac3a10680c9b23a209aea3574788324ebd34a994c4101fa77b173569eb5530
Opcode Fuzzy Hash: b350da160712cd69f24d859834969ce18f0dcc743a0a72618e8ee9e59902702a
Instruction Fuzzy Hash: C281F5B4A1525ACFCB08CFA9C58499EFBF1FF89314F14995AD415AB310D370AA41CF51

Function 0793C9F9 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90bc2ae78d9f0fb09309c1cc6e69a88b1070ba9f935355dcb38458d77ad44e2d
Instruction ID: bbab75dda2e2385c1a5e0f64df0d1cc3ddf852b69afa170dee343f31670bc37c
Opcode Fuzzy Hash: 90bc2ae78d9f0fb09309c1cc6e69a88b1070ba9f935355dcb38458d77ad44e2d
Instruction Fuzzy Hash: FE812BB4E145198BCB14DFA9C5805AEFBB2FF89304F24C1A9D418B7256DB34AE41CF61

Function 079388B9 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2233901ed284ebcd00ddd6722d203982ad54db28839342d699d6e0504a8b2479
Instruction ID: 1f6d10902c268b7dcd70113e4ca8be111308e86cb90697e22ed723a4c22a1300
Opcode Fuzzy Hash: 2233901ed284ebcd00ddd6722d203982ad54db28839342d699d6e0504a8b2479
Instruction Fuzzy Hash: EE711BB4E15609CFCB08CFAAC5809DEFBF2FF89210F24942AE415B7254D374AA418B65

Function 079388C8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d0c4c9d8619fc73f1bfaa182551e0b39e29f2dd80f02b96fdcd0dc484908ae
Instruction ID: 9d41ce37b9882434992ed0ff56c3af767b3663525c68eae8940b08c156ea3ffa
Opcode Fuzzy Hash: 49d0c4c9d8619fc73f1bfaa182551e0b39e29f2dd80f02b96fdcd0dc484908ae
Instruction Fuzzy Hash: EF7106B4E15609CFCB08CFAAD5809DEFBF2FF89314F24942AE415B7214D374AA418B65

Function 07938B49 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42f6ec109e068c2e81af0fd6874880fb2a87eaf08be3fe28ad8b7c2265562a25
Instruction ID: ece227b635f41305efdf8ba10a1aca9971f62b95681bf77ddd28d0988fdc9ffc
Opcode Fuzzy Hash: 42f6ec109e068c2e81af0fd6874880fb2a87eaf08be3fe28ad8b7c2265562a25
Instruction Fuzzy Hash: CC4117B0E1520ADFCB44CFA9C5819AEFBF2EF89300F24D56AD405F7214E7349A418BA5

Function 07938B58 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68f979b9f6a3275564937379728cdc698f56918c850e0222807c4b60fba715d3
Instruction ID: a09492c5a01cdddabe263695d3b51993728ce7925b939eee608998f8d2e28836
Opcode Fuzzy Hash: 68f979b9f6a3275564937379728cdc698f56918c850e0222807c4b60fba715d3
Instruction Fuzzy Hash: E641F7B0E1560ADFCB44CFAAC5819AEFBF2FF88300F24D56AD405B7214D7749A418BA5

Function 0793BF00 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611487f87b64534df177f2b2740fd348bc447905f5e61696483122ee5265830d
Instruction ID: 8f3169403e015a47932e8a139b235ca3454e6539612261852bbbe525b654e35b
Opcode Fuzzy Hash: 611487f87b64534df177f2b2740fd348bc447905f5e61696483122ee5265830d
Instruction Fuzzy Hash: 37417CB0E1560ADFCB04CFA5C5426AFFBF2AF89304F20D96AC018B7264D37887018B95

Function 0793BF10 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33dace37b1c2a67ecb641d53967bcec66f0395c7dc4f575376d5178484213de
Instruction ID: 4ad333ea0b96c0daad71156436d9103352d81c1f30568f08a9c90eac0cd21dfd
Opcode Fuzzy Hash: e33dace37b1c2a67ecb641d53967bcec66f0395c7dc4f575376d5178484213de
Instruction Fuzzy Hash: EE411CB0E1560ADFCF44CFA6D5426AEFBF1AF89304F20996AC019B7264E37497418F94

Function 079386B0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75579c62d81abf9041daccae3d2ba1ce94f28171aee6d0f4cc1e7d772f5f6a5f
Instruction ID: 5c99fef053d28ee0c107f0c515d7fa1b8bc6efebfe399f711efc241178bbb841
Opcode Fuzzy Hash: 75579c62d81abf9041daccae3d2ba1ce94f28171aee6d0f4cc1e7d772f5f6a5f
Instruction Fuzzy Hash: 0741F9B4D0560ADFCB44CFAAD481AAEFBF2BF89304F14C466D416A7354D7349A428FA4

Function 079386C0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48617f7e3182ffe9b7de24a844ee73ccec3b2d7bbe66d80c1af4209691f5be8
Instruction ID: 10738ea57432f2def1b2a28ae5a42c225a193ec7d8271fecd40a629eed600787
Opcode Fuzzy Hash: b48617f7e3182ffe9b7de24a844ee73ccec3b2d7bbe66d80c1af4209691f5be8
Instruction Fuzzy Hash: 2341F7B0D1560ADFCB44CFAAD481AAEFBF2BF89304F14C42AD416B7204D7349A418FA4

Function 07933793 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754449544.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7930000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5423e6b1f6fae1b44ed65364b6232519e76dddb5be0733fe4b00ee87276c50f7
Instruction ID: 6df0cee8b83f12fc1b92deb158dce751a3c7552988e8cda54577f6433bc5d39f
Opcode Fuzzy Hash: 5423e6b1f6fae1b44ed65364b6232519e76dddb5be0733fe4b00ee87276c50f7
Instruction Fuzzy Hash: 16211FB1E046589BDB18CFAB9C406DEFBF7AFC9300F04C176D418A6224EB3406558F51

Analysis Process: jG8N6WDJOx.exePID: 7404, Parent PID: 5544COMMON

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	15%
Total number of Nodes:	20
Total number of Limit Nodes:	4

Executed Functions

Function 06BA3040 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06BA374B
$^q, xrefs: 06BA3716
$^q, xrefs: 06BA3722
$^q, xrefs: 06BA373F
$^q, xrefs: 06BA376F
$^q, xrefs: 06BA3763

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: e91434772b2133c7fb1ae70e883b49c990ab4e73bb6b2921f03635b1ed192de4
Instruction ID: 92243d9a095e3ae4945918d2283b200627e0b7e721c06ad48d68cec4d3d0af46
Opcode Fuzzy Hash: e91434772b2133c7fb1ae70e883b49c990ab4e73bb6b2921f03635b1ed192de4
Instruction Fuzzy Hash: CE320F71E1071ACFCB14EF75C85459DF7B6FF89300F6096AAD409AB224EB30A985CB91

Function 06BA7D68 Relevance: 3.0, Strings: 2, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06BA830F
$^q, xrefs: 06BA8303

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 9cd513d57460b5d40806f6135c07d0010e4fae68720f8a4ea58e804fa2b02895
Instruction ID: 6a38bdb0c548c3a0330c7fef600236481ce7c69c8d976b810e4a3fe2790b9fee
Opcode Fuzzy Hash: 9cd513d57460b5d40806f6135c07d0010e4fae68720f8a4ea58e804fa2b02895
Instruction Fuzzy Hash: BB02BD70B042159FDB64DF78D990AAEB7E2EF84310F2485A9D409DB794DB71EC82CB81

Function 02C76CE8 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 02C76E23

Memory Dump Source

Source File: 00000008.00000002.2944614452.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c70000_jG8N6WDJOx.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 42a78b7ae253fbdefe64f3a2aba71a2374007a5b7834a033081b0356e65cd54c
Instruction ID: 57e4e1c9354378cc3863aeccb974324cd2c35ef50e233b106f55f7b538ab93e9
Opcode Fuzzy Hash: 42a78b7ae253fbdefe64f3a2aba71a2374007a5b7834a033081b0356e65cd54c
Instruction Fuzzy Hash: B4513470D106188FDB14CFAAC888B9DBBB5BF48714F248029E819BB350DB74A944CF95

Function 06BA2349 Relevance: 1.0, Instructions: 1007COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6deb7f381f54480ac8eb4f05fa5b98c6936434699eda9ac12b7d1873fdf9110
Instruction ID: 181e6a898d6da63e051da9ef67c58902ab890fbfc94ddc74653358704ef4c8cb
Opcode Fuzzy Hash: f6deb7f381f54480ac8eb4f05fa5b98c6936434699eda9ac12b7d1873fdf9110
Instruction Fuzzy Hash: 46925474E043048FDB64CB68C584A5DBBF2EF44314F5894A9E44AEB365DB35EE86CB80

Function 06BA65E0 Relevance: .8, Instructions: 809COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbfbb9b916daed104756e7183e99ee4bfd8057b19156560382a7b50011c051a7
Instruction ID: cbea9afb873dacb07c354193be0e803fa8ec169c0708b7a9b0d3be87d42b38fc
Opcode Fuzzy Hash: bbfbb9b916daed104756e7183e99ee4bfd8057b19156560382a7b50011c051a7
Instruction Fuzzy Hash: 4962B0B4A04204DFDB54DF68D584AADB7F2EF88314F2485A9E40ADB354EB71EC46CB80

Function 06BA5588 Relevance: .6, Instructions: 604COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 919c89d6eb94915c1648a71312d156f85964f80d3c78e544c1c173bef538a315
Instruction ID: ac41e5b612b31317f18dd7e3866a1c53196c7b97a06e9dd565c1a912e8568908
Opcode Fuzzy Hash: 919c89d6eb94915c1648a71312d156f85964f80d3c78e544c1c173bef538a315
Instruction Fuzzy Hash: FF22D0B2E043059FDF64DF68C5806AEBBB2EF85320F2084A9D445EB345DA35DE46CB91

Function 06BAB20F Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59db8abb80ecbd22708bfed3df98190c7a1cf1ea2a3f9627663f61c73a61376e
Instruction ID: 1ba1f34d65fcb2872a9a00c2cde5e1990e7d2af8e426031fe4f414a6208e2170
Opcode Fuzzy Hash: 59db8abb80ecbd22708bfed3df98190c7a1cf1ea2a3f9627663f61c73a61376e
Instruction Fuzzy Hash: C42291B0E142098FDF64CF6CD5807AEB7E2EB45310F2099A6E429EB395DA35DC818B51

Function 06BAACB8 Relevance: 10.4, Strings: 8, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06BAAE38
$^q, xrefs: 06BAAE84
$^q, xrefs: 06BAAE5B
$^q, xrefs: 06BAAE90
$^q, xrefs: 06BAAE2C
$^q, xrefs: 06BAADE5
$^q, xrefs: 06BAADD9
$^q, xrefs: 06BAAE67

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: a799cc3a71c682426c266d9fb439b0a686473c71a5c45e347b88b75c8ee67e8d
Instruction ID: f1afab74ee4839469432c0cc346a39db0ce0389beb20336653c2cbc4bd7a5c03
Opcode Fuzzy Hash: a799cc3a71c682426c266d9fb439b0a686473c71a5c45e347b88b75c8ee67e8d
Instruction Fuzzy Hash: 72E17D70E543198FDB69DF68D8806AEB7B2EF88300F208969D415DB354EB31DC46CB91

Function 06BAB630 Relevance: 8.0, Strings: 6, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06BABB97
$^q, xrefs: 06BABBD7
$^q, xrefs: 06BABB6F
$^q, xrefs: 06BABBA3
$^q, xrefs: 06BABB63
$^q, xrefs: 06BABBCB

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 77d50f19e43a29b9f84ad6b7c99219c80477663064b141c9b3c2e74c170d11c9
Instruction ID: feae76c74cf5d24d3293cba248332f482252a67c7f900adc1226886bc8ce77ed
Opcode Fuzzy Hash: 77d50f19e43a29b9f84ad6b7c99219c80477663064b141c9b3c2e74c170d11c9
Instruction Fuzzy Hash: 18028EB0E082098FDBA4CF68D584AADB7F2FB85310F2495AAD425DB355DB70DC85CB81

Function 06BA9138 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06BA917F
$^q, xrefs: 06BA91BA
$^q, xrefs: 06BA918B
$^q, xrefs: 06BA91C6

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 2317cb79b1b379431eb79e312abb444113b82344d5d6d0c01a782f8126068b02
Instruction ID: c3d1666bb7b2b8fff2a5cf4fc8a722bb520a4bdd53e40a19b48109ee5630e2c2
Opcode Fuzzy Hash: 2317cb79b1b379431eb79e312abb444113b82344d5d6d0c01a782f8126068b02
Instruction Fuzzy Hash: 5D915F70F1021A9FDB54EF65D9907AEB3F6EBC9204F1085A9C40DEB344EE70AC468B91

Function 06BACF28 Relevance: 4.5, Strings: 3, Instructions: 798
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06BAD333
$^q, xrefs: 06BAD31F
$^q, xrefs: 06BAD327

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 737e2b50b230c03c0cffa9701e6306693b6369d7a427e2e5918484e4718fe542
Instruction ID: 74f81fbc2af3bfb69e80b8a3fcb6889f300a0403bc2be6a1a9d8fe04128373f2
Opcode Fuzzy Hash: 737e2b50b230c03c0cffa9701e6306693b6369d7a427e2e5918484e4718fe542
Instruction Fuzzy Hash: 7C624F71A40205CFCB55EF68D590A5DB7F2FF84314B208A69D0099F769EB71ED8ACB80

Function 06BA4B50 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06BA525D
XPcq, xrefs: 06BA4C7D
\Ocq, xrefs: 06BA4D07

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: b8122ce15af68fe06e251a33878172b7f984839a2b5c53ae3cb71fba966b8037
Instruction ID: 288f8ad41a2e31fac280db2805a6ef8f95e6d5e54562b34b8f6244ce012577e0
Opcode Fuzzy Hash: b8122ce15af68fe06e251a33878172b7f984839a2b5c53ae3cb71fba966b8037
Instruction Fuzzy Hash: 97619E71E402189FEF549FA8C8547AEBAF6EB88310F208469D105EB394DF758D45CB91

Function 06BA9127 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06BA917F
$^q, xrefs: 06BA91BA

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 3818a9d33c8343d3294b44066cf220a72099f6cb088d15eb9bb20e3a10120228
Instruction ID: 3774d812beb6e064f74e479b11f0a3478fc1c81cbd695348233106d4e29748c5
Opcode Fuzzy Hash: 3818a9d33c8343d3294b44066cf220a72099f6cb088d15eb9bb20e3a10120228
Instruction Fuzzy Hash: 0A516330B102159FDB54EF75D990BAE73F6EBC8604F148569C40EEB384EA70EC428B91

Function 02C7EB38 Relevance: 1.7, APIs: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2944614452.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c70000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940b6682156738658a60f1e5faf576a3fa6f5b4ab2cebe35a3f7cdb8332df4c5
Instruction ID: 06cc10d73ee8537b0ab44513728d3ec1539aeb53764f2991170b1dd42dd32295
Opcode Fuzzy Hash: 940b6682156738658a60f1e5faf576a3fa6f5b4ab2cebe35a3f7cdb8332df4c5
Instruction Fuzzy Hash: BD516572E047959FCB14DF79D8042EABFF5AF8A310F0485AAD409AB341DB349845CBD1

Function 02C76CDC Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 02C76E23

Memory Dump Source

Source File: 00000008.00000002.2944614452.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c70000_jG8N6WDJOx.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 800e9edbc753f2e42510d3ee1818fdf2610065fd5759c5ee414f7c06df0b72dd
Instruction ID: 10ca45832652b971162ed902358c8e2e1b988c5dceed87db278a3814ce183dba
Opcode Fuzzy Hash: 800e9edbc753f2e42510d3ee1818fdf2610065fd5759c5ee414f7c06df0b72dd
Instruction Fuzzy Hash: DC5124B4D106188FDB14CFAAC888BDDBBB5BF48714F248029E819BB350D774A944CF95

Function 02C7EC20 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000006), ref: 02C7EC87

Memory Dump Source

Source File: 00000008.00000002.2944614452.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c70000_jG8N6WDJOx.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 396644c2ece1870f554b5d7a2de32e7165ba71abae50427e23e44769e977267a
Instruction ID: 11c83471cb04b23ce56e618757d14897471cd618fbe3a7698037f95aa01d8b43
Opcode Fuzzy Hash: 396644c2ece1870f554b5d7a2de32e7165ba71abae50427e23e44769e977267a
Instruction Fuzzy Hash: 3911EFB6C006699BCB10CF9AC544BDEFBB4BB48324F14816AD818A7250D778A944CFA5

Function 06BA4B40 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

XPcq, xrefs: 06BA4C7D

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: XPcq
API String ID: 0-714321711
Opcode ID: d4f423144472df44a1d55eeb223680d1915a89d1273f8c0f09ac2a8a3c199d20
Instruction ID: 940f1ee9ee768bfdcc14df32a79181afccc513ccb28920f320a7c87ae14f313b
Opcode Fuzzy Hash: d4f423144472df44a1d55eeb223680d1915a89d1273f8c0f09ac2a8a3c199d20
Instruction Fuzzy Hash: BE417C71A002199FDB459FA8C854BAEBBF7EF88700F20856AD105AB395EB758C05CB91

Function 06BADA9D Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06BADBF9

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 3c7299f4217694eced20a95ad0e1c44af220c98217c5c3c4cbd89362ca8382b2
Instruction ID: 671a8de902eab30ca730eb58ba77429029ce37c7e892a7a57036061748a78dce
Opcode Fuzzy Hash: 3c7299f4217694eced20a95ad0e1c44af220c98217c5c3c4cbd89362ca8382b2
Instruction Fuzzy Hash: 8C41BFB0E04309DFDB51DF65C98469EBBB2EF85300F504969E406EB740EB71D946CB91

Function 06BA21D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06BA230B

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: a7b231ffc935456ba23c62687fdf824927ea74e870dc7caefbd49b21f5b5df95
Instruction ID: 771c0095e3fd1e6f0e1f7825e7606e37ad5d5f22b244f699db679f5cedf4b427
Opcode Fuzzy Hash: a7b231ffc935456ba23c62687fdf824927ea74e870dc7caefbd49b21f5b5df95
Instruction Fuzzy Hash: 9D31FE70B183058FDB59AF74C91466E7BE3EB8A710F2444A8D406DB384EE35DE46CBA1

Function 06BA82DE Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$^q, xrefs: 06BA8303

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 6be857b97570a2c9de6859ec9e74182deec7f79a6885f5c7115f7c3913b45b0d
Instruction ID: e09dc8716747eb5e91a8078c5a462e392e8eae696600560c4c6e8766fb16d5bf
Opcode Fuzzy Hash: 6be857b97570a2c9de6859ec9e74182deec7f79a6885f5c7115f7c3913b45b0d
Instruction Fuzzy Hash: 4DF0EDB6F1C310DFEFB85E46E9802A873E4EB40250F1845F6ED85CBA44D770DA01C6A1

Function 06BAC170 Relevance: .6, Instructions: 641COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 173628a1a45d5eed160d691ca408634550bc5268bdc99714ac4e5aaef755ecb6
Instruction ID: ec5015e08f2730ac002e3edfcad5d49d0779848e94ad3fa8c9ab23583f62c6c4
Opcode Fuzzy Hash: 173628a1a45d5eed160d691ca408634550bc5268bdc99714ac4e5aaef755ecb6
Instruction Fuzzy Hash: C132BF74B002199FDF54DF68D980BAEBBF2EB88310F209569D509EB354DB31EC428B91

Function 06BA61E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357fa5e6e06c087c20fbaf1e76ec428dab8958ec8fb477c37a699712f6ab3efb
Instruction ID: db1bd0a199aa826bc3c30185bc9da1e780f1716ec522dd837e7c53d89ae746ff
Opcode Fuzzy Hash: 357fa5e6e06c087c20fbaf1e76ec428dab8958ec8fb477c37a699712f6ab3efb
Instruction Fuzzy Hash: A4619FB1F002114FDB549A79C88466FABD7EFC4620B19447AD80EDB364EEA5DD0287D2

Function 06BA4280 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c75e71b54126fcd4f160e32033e2a0ff1229f4a59cb691636834411bf092f86a
Instruction ID: 7f230068f2c009a56971f95c23d75fd8bb3f89cf7bde97d339a668dcdebbff42
Opcode Fuzzy Hash: c75e71b54126fcd4f160e32033e2a0ff1229f4a59cb691636834411bf092f86a
Instruction Fuzzy Hash: 28816B70B102059FDF54DFA9D4506AEB7F2EF89304F209569D40ADB384EB70EC428B91

Function 06BA45A0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19a1f834bc4a971018f957640036235e00f9dd9071f34ad6119dd69ce8f2ce13
Instruction ID: 8a491c98ea856bdc54ff4b48d03f260c37a1963c440d5f292b291d4e9ff8bc19
Opcode Fuzzy Hash: 19a1f834bc4a971018f957640036235e00f9dd9071f34ad6119dd69ce8f2ce13
Instruction Fuzzy Hash: 53916D70E003598FDF60DF68C880B9DB7B1FF89310F208699D449AB255EB70AA85CF91

Function 06BA45B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83887fbcb77516922ac351f5ff6d389111d80cf289871a3d60466de37a549947
Instruction ID: fd57e54c4aaf6a4e33ead737cc07f079dff60477c1937edbe92eab61736522c7
Opcode Fuzzy Hash: 83887fbcb77516922ac351f5ff6d389111d80cf289871a3d60466de37a549947
Instruction Fuzzy Hash: CB914E74E102198BDF60DF68C980B9DB7B2FF89310F208695D549BB354EB70AA85CF91

Function 06BAEAE8 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025d768d392e2649c968afc9f0d82e68c61145cf1dac46cd77dbd2838cd4c86b
Instruction ID: 13b2c2814d9016877a40beb028dfef1e6e0e853eb98f218bd29d5c7bd7d98325
Opcode Fuzzy Hash: 025d768d392e2649c968afc9f0d82e68c61145cf1dac46cd77dbd2838cd4c86b
Instruction Fuzzy Hash: 43712A71A042089FDB54DFA9D990A9DBBF6FF88310F2485A9D019EB354EB30ED46CB50

Function 06BAEAF8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22110418b27bb82cf23f2f31190cda83be68cb0bc82de99252cafb0043183296
Instruction ID: a0ee0380323f9522f2f41a8a3266ff18d32c0016022e3dde51dc39962562f959
Opcode Fuzzy Hash: 22110418b27bb82cf23f2f31190cda83be68cb0bc82de99252cafb0043183296
Instruction Fuzzy Hash: DF713B71A042089FDB54DFA9D990A9DBBF6FF88310F2485A9D019EB354EB30ED46CB50

Function 06BAFC58 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d72bf469e730c9172b9b0eec7659240614ba55076e6d2a45b59106554acfd50
Instruction ID: 1196c61cbf80207d44c8e2bb48974419ba1a99b12bc8c11aac3e69f591aa2319
Opcode Fuzzy Hash: 9d72bf469e730c9172b9b0eec7659240614ba55076e6d2a45b59106554acfd50
Instruction Fuzzy Hash: EE51F3B1E04205DFCF64ABB8E8546FEBBB6FB85315F1088AAE106D7250DF319955CB80

Function 06BAFA0A Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ebc3cc91b3a2d3dccf001f8b851ca9021dd98c4a7aa3874efe1fda42b6a741c
Instruction ID: dc7cbbdeecf9d6f1b594e3ace64c4b1ffe671e661f7d7f43adf2fb9182f4f9de
Opcode Fuzzy Hash: 3ebc3cc91b3a2d3dccf001f8b851ca9021dd98c4a7aa3874efe1fda42b6a741c
Instruction Fuzzy Hash: 5951F5B1B10304DFEF64666CD9647BE266FD789310F20496AE50AD7398DA39CC468392

Function 06BAFA18 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd729e3ea2828dd82201e73ccbf11a52af471788c397e09d342e80448405341
Instruction ID: 2375cadc21d67ab145b52736fb0c7cd4bfb27a54b3d68efa3845023556614063
Opcode Fuzzy Hash: 2fd729e3ea2828dd82201e73ccbf11a52af471788c397e09d342e80448405341
Instruction Fuzzy Hash: 0B51E570F10304DFEF64666CD964BBF266FD789310F20496AE50AD7398DA39CC4643A2

Function 06BA53F8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 828a68c2298a3d3baabb04651659deffc846dda88628b4c522d99d9256fa4b62
Instruction ID: 47b60fecb08502bf4e24a869ec909312c364e8ca07c272c0d45f3468deb39d81
Opcode Fuzzy Hash: 828a68c2298a3d3baabb04651659deffc846dda88628b4c522d99d9256fa4b62
Instruction Fuzzy Hash: E5415EB2E047099BDF70CEA9D880AAFFBF2FB44310F10496AD216D7654D730EA558B90

Function 06BAD950 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df11b1587ecd2a2cff37888c1cfcdfa53dbe41f2fab5e926d4fb4421e978d01
Instruction ID: 6d154ddf2993b0bc3e37a44fc727f9b735048333ae1ca6cff19646725676006f
Opcode Fuzzy Hash: 7df11b1587ecd2a2cff37888c1cfcdfa53dbe41f2fab5e926d4fb4421e978d01
Instruction Fuzzy Hash: BD31DC71E1430A8FCF65DFA8C99069EBBB2FF85300F148969D505EB715EB70E9468B80

Function 06BA208B Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060727d246b20ee2e4c90a2afdbb29961ef3fa046ebbb1b02a5b99ed276f9382
Instruction ID: e8a8705ca4a821a5536ffdfd1306d871d07289581d8ba4f3672ab279926990b9
Opcode Fuzzy Hash: 060727d246b20ee2e4c90a2afdbb29961ef3fa046ebbb1b02a5b99ed276f9382
Instruction Fuzzy Hash: 5131A175E04315ABCB59CF64D8946AEB7B2FF89300F548469E906EB340DB71EE82CB50

Function 06BA2090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef1926d5d5e73bc7f7afd812f35632ba59f638a42737df74943fd424434195d1
Instruction ID: ef75ded745f7243236e533eba48fbc5f0ab6305dfc2038216457cca9493a481f
Opcode Fuzzy Hash: ef1926d5d5e73bc7f7afd812f35632ba59f638a42737df74943fd424434195d1
Instruction Fuzzy Hash: FD31A171E042159BCB59CF64D8546AEB7B2FF89300F548469E906EB340DB71AE82CB40

Function 06BA3A80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7fd16465baaf6faf426ada315e0f78bb0566db4273727a9cd95b1694324de8
Instruction ID: 823a39fd79e828e563462a5aa442fef943074041170823567dc1df48beccc4ba
Opcode Fuzzy Hash: 4a7fd16465baaf6faf426ada315e0f78bb0566db4273727a9cd95b1694324de8
Instruction Fuzzy Hash: DB218EB6F002159FDB50DF79D880AEEBBF6EB48710F108169E909E7380E770D8418BA5

Function 06BA3A90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2987b96d12c971a706e4ec0dff0502e2c9d1eaccaf45da38d4ef2857409f0dc
Instruction ID: c56a6cfa30974a13508519ad5d3d839a895e49e755b1ee6044a0c90d66cd8758
Opcode Fuzzy Hash: b2987b96d12c971a706e4ec0dff0502e2c9d1eaccaf45da38d4ef2857409f0dc
Instruction Fuzzy Hash: EE218EB6F006159FDB40DF79D880AAEBBF2EB48710F108169E909E7384E770D9018B95

Function 02A2D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2944084790.0000000002A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a2d000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68cb1dbd49fc87a6f5589d9c2f05cd3d8f77c8b4b2fe9e68a041cdc00d8ba2bf
Instruction ID: c3a474f6c761d2a9448e235af21506af51d97386f0c0dbb65ac6f641eb18f14d
Opcode Fuzzy Hash: 68cb1dbd49fc87a6f5589d9c2f05cd3d8f77c8b4b2fe9e68a041cdc00d8ba2bf
Instruction Fuzzy Hash: 00210471508604DFDB14DF18D9C0B26BBA5FB84318F24C66DD94A4B267CB3AD84BCA62

Function 02A2D007 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2944084790.0000000002A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2a2d000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810cea76327b60ed1df2dc048121857d9e53e65e68161926d57d7d809f1b29bd
Instruction ID: b2c77ddf222ca4f32df9a98f77eabe816eead7e049b0c08586c81677b3255b12
Opcode Fuzzy Hash: 810cea76327b60ed1df2dc048121857d9e53e65e68161926d57d7d809f1b29bd
Instruction Fuzzy Hash: 7E21377110D7C09FCB038B24D994711BF71AB46214F29C5DBD8898F2A7C73A984ACB62

Function 06BA6D00 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c8b8745104b60cc186cd03226ecaf8420a3e4b9a2a89b7707f4dff30662ccb5
Instruction ID: 277fb63590bb920974a6a25dd2c88ac8a0d243af1bf5be214fd1654573f5e629
Opcode Fuzzy Hash: 9c8b8745104b60cc186cd03226ecaf8420a3e4b9a2a89b7707f4dff30662ccb5
Instruction Fuzzy Hash: 3A21E1B1B142189FDF54DB69E8506AEB7B7EB84350F2884B9D409EB340EB31EC41CB85

Function 06BA3BA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9374a514b9137ec47d1a9041697deca88ff2261149b95932ce81371821ef90
Instruction ID: dd2afb2f1008588c5119abe68475b33f9a91b6e9e37bce1075db03f41f9f320e
Opcode Fuzzy Hash: 8a9374a514b9137ec47d1a9041697deca88ff2261149b95932ce81371821ef90
Instruction Fuzzy Hash: 63118E72B042255FDF949A68CC14AAE73EAEBC8210F00457AD50AE7344EE64DC428B95

Function 06BA41E2 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f970681aee1827b85eb5e577669fd9605bd045f600b7250685132bbf69694606
Instruction ID: 88dc5bfa4ae63e573c91ed1a29f2b4690a70cdbe602c9413233c81ee33960eda
Opcode Fuzzy Hash: f970681aee1827b85eb5e577669fd9605bd045f600b7250685132bbf69694606
Instruction Fuzzy Hash: BC012871B182101FDB959ABCA44031EA7D7DBCA320F1094BAD10ACB351DD91CC424391

Function 06BA3B8F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd69e4b030cbc2c165a065acef58320df619001c196dbece3887430db444ad4b
Instruction ID: 40104e7baaee2803212413586738135ff71c1326cedf45fa72ade11c36b28d9c
Opcode Fuzzy Hash: fd69e4b030cbc2c165a065acef58320df619001c196dbece3887430db444ad4b
Instruction Fuzzy Hash: D301F572B082251BDBD49A799C106EB77EBDBC8610F04417AD50AD7380EE61980687D5

Function 06BA3859 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31a081197714cf6bd91e3d67f64a31d0e28e420435c689d4a7d2ce7c275ccefc
Instruction ID: 70d16b4d62baf425f31ffbbbd7566886a16cd65efd2905e7c05789bda5f4c5d9
Opcode Fuzzy Hash: 31a081197714cf6bd91e3d67f64a31d0e28e420435c689d4a7d2ce7c275ccefc
Instruction Fuzzy Hash: A821C0B5D01219AFCB00CF9AD984ADEFBB4FB49320F10816AE918A7200C375A954CFA5

Function 06BAA2F0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75113aff732e32dcbd453f9a15c96a0b3ca0681f4d6909afc591f5276fff58ef
Instruction ID: 4942a6b8e493c31a5d14afe41d59acd6f318e29f019d0ff494f745c4b041b40f
Opcode Fuzzy Hash: 75113aff732e32dcbd453f9a15c96a0b3ca0681f4d6909afc591f5276fff58ef
Instruction Fuzzy Hash: 280120B0B142104FD7A5DA7CE8A076E77E6DB8A714F1098BAD14ECB354DE21DC01C791

Function 06BA3860 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f6b803663dea2acbec78a89440696dc1b6172b73dc01c68b315bf36d7f0195a
Instruction ID: 0285d8e533c72bea8571dc5da8196566941b39e2f197f92420a73f962bbffb23
Opcode Fuzzy Hash: 1f6b803663dea2acbec78a89440696dc1b6172b73dc01c68b315bf36d7f0195a
Instruction Fuzzy Hash: 8B11AFB5D01259AFCB00DF9AD984ADEFBB4FB49320F10816AE918A7200D375A954CBA5

Function 06BA41F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fff3d72fffb6ab975ae762f1d4ab22b47d2573018a7d329a553d4d6cefb0c79
Instruction ID: bbee5590c604252de436dad7d47c334eff9b77224a564a75673dcf17d0baf5c3
Opcode Fuzzy Hash: 1fff3d72fffb6ab975ae762f1d4ab22b47d2573018a7d329a553d4d6cefb0c79
Instruction Fuzzy Hash: 4301D171B142205BDB64AAADA44072FF2DBDBC9720F109479E10EC7350EEA1DC420395

Function 06BAED69 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634a88fa0e8254cc0fab5a8572614bbcc5bd3012c3bf0c52ab627e99488bd58c
Instruction ID: 8ba7b546b8d26e26852cac44833c22d4a7837ca1e48dac0eb5fc04c94c236188
Opcode Fuzzy Hash: 634a88fa0e8254cc0fab5a8572614bbcc5bd3012c3bf0c52ab627e99488bd58c
Instruction Fuzzy Hash: 3701F275B141108FDF64DAACA8A072E67E6DBC9310F1498BAE50ECB340DE20DC0383C1

Function 06BAED78 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb691a8725cc1fa3e034c06a3b90d267cf6c9525b3d8fff4051604fc39296bf
Instruction ID: 038b22ee014b4ec0748ece52b6f4cc3f3c899f05d6cbeffb090d768c636b9bd6
Opcode Fuzzy Hash: ffb691a8725cc1fa3e034c06a3b90d267cf6c9525b3d8fff4051604fc39296bf
Instruction Fuzzy Hash: D301AF75B541105BDB65D57DA86472E67DADBCA720F109879E10ECB340EE61DC0383C5

Function 06BAA300 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74963545effaeda570735038e6bf9f6f3afca25cab825b44294c71c746b94fb
Instruction ID: 14a0fe7ae52fab4822c8bdf451ceba9dfd913b5d00c8cd93209e972006f65ea4
Opcode Fuzzy Hash: d74963545effaeda570735038e6bf9f6f3afca25cab825b44294c71c746b94fb
Instruction Fuzzy Hash: A301A470B142145FDB64EA6DE89072EB7EAEB8A714F109879E54EC7344DE21EC02C791

Function 06BA6461 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a365fd0e5eff4bcd8704ddbddea12f5d1273530fe605da78471eacce75a0c6
Instruction ID: 3db700d408b2b69a8b11da4f5e4bbe06d1834cf2f0e9cf0c1f104d31dc55c7cb
Opcode Fuzzy Hash: c5a365fd0e5eff4bcd8704ddbddea12f5d1273530fe605da78471eacce75a0c6
Instruction Fuzzy Hash: 1DE092F2D283096BDBE0CE70896425A77AAD742204F2458E1D405CB241FA36D9018390

Non-executed Functions

Function 06BA7688 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06BA7B79
$^q, xrefs: 06BA77BC
$^q, xrefs: 06BA77ED
$^q, xrefs: 06BA7C24
$^q, xrefs: 06BA77F9
$^q, xrefs: 06BA7C3A
$^q, xrefs: 06BA7B85
$^q, xrefs: 06BA7C18
$^q, xrefs: 06BA77C8
$^q, xrefs: 06BA7C2E

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 4e3e04d0558bde272030e4aa5564e2a32bd8b08215cc7ddf3524fdf37d53dcaf
Instruction ID: 383e826dfb92c8e14b1c2d1ab3983d7175625ed270b9ebf38e873b2cafc8884f
Opcode Fuzzy Hash: 4e3e04d0558bde272030e4aa5564e2a32bd8b08215cc7ddf3524fdf37d53dcaf
Instruction Fuzzy Hash: B7121974E042198FDB64DF79C954A9EB7B2EF88300F2095A9D009AB354EF309D86CF81

Function 06BAA920 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 06BAAA71
$^q, xrefs: 06BAAA22
$^q, xrefs: 06BAAADE
$^q, xrefs: 06BAAA16
$^q, xrefs: 06BAAAA8
$^q, xrefs: 06BAAAD2
$^q, xrefs: 06BAAA9C
$^q, xrefs: 06BAAA7D

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 234e193fa05d2ab3464fe016ab1a0b54a70aef9cdf2dac08d828bd15aca20e7b
Instruction ID: 58ef18400e3575a21963487c3588187dcfb695c236fd80c2a5aceae19f981875
Opcode Fuzzy Hash: 234e193fa05d2ab3464fe016ab1a0b54a70aef9cdf2dac08d828bd15aca20e7b
Instruction Fuzzy Hash: 0F916EB0E04309DFEB68DF65DA54B6EBBF2EF84300F108569D4029B354DB759945CBA0

Function 06BA7088 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 06BA736A
.5vq, xrefs: 06BA70E3
$^q, xrefs: 06BA759C
$^q, xrefs: 06BA7590
$^q, xrefs: 06BA7524
$^q, xrefs: 06BA73D0
$^q, xrefs: 06BA73C4

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: a9c87bc9c220ea41ff948257ba31be3584f395e4c21c2ad928e40e6a5075d9e8
Instruction ID: 77edbc54cc37cd5d72fa86991145164dd408ca95ca4af2b24b8669d76303c946
Opcode Fuzzy Hash: a9c87bc9c220ea41ff948257ba31be3584f395e4c21c2ad928e40e6a5075d9e8
Instruction Fuzzy Hash: BEF12875A44209CFDB59EF69D594A6EB7B2FF84300F2085A8D4059B398DF71EC86CB80

Function 06BA83C0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 06BA861A
$^q, xrefs: 06BA867F
$^q, xrefs: 06BA8626
$^q, xrefs: 06BA868B

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 58be7053d872dede526510e7b67cc1d5baebae56603f05dc3035c30ace1a9673
Instruction ID: 042299fbfd8653cc5087ac8703e6982338933b950a818252dd7c9564cf39a254
Opcode Fuzzy Hash: 58be7053d872dede526510e7b67cc1d5baebae56603f05dc3035c30ace1a9673
Instruction Fuzzy Hash: 83B12970A102088FDB54EF69D9946AEB7B2EF84300F2489A9D406DB754DF75DC86CB80

Function 06BA87D8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 06BA8857
LR^q, xrefs: 06BA891A
$^q, xrefs: 06BA8863
LR^q, xrefs: 06BA88CB

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: d34aafc62d4f60377885f19afd927a67d9aa24324135d929c29013ea199a3800
Instruction ID: 67bae70cebf20f86c85942a26205496f2574545054f65ad009858e2960cc8048
Opcode Fuzzy Hash: d34aafc62d4f60377885f19afd927a67d9aa24324135d929c29013ea199a3800
Instruction Fuzzy Hash: DD51A071B042018FDB58EF29D980A6AB7E2FF88700B1496A9D405DB759DE30EC45CB91

Function 06BAACA8 Relevance: 5.2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

Strings

$^q, xrefs: 06BAAE84
$^q, xrefs: 06BAAE5B
$^q, xrefs: 06BAAE2C
$^q, xrefs: 06BAADD9

Memory Dump Source

Source File: 00000008.00000002.2952089759.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ba0000_jG8N6WDJOx.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: a610097bb3e10a01cf49e1f1b6d094f02ed2ee96c67d70091fb931f15d463976
Instruction ID: b5c6bb3a1add30f68c4e790d4a82125fbd5cf27db0b7ef0678853c934f062f8d
Opcode Fuzzy Hash: a610097bb3e10a01cf49e1f1b6d094f02ed2ee96c67d70091fb931f15d463976
Instruction Fuzzy Hash: DA51C170E14304DFDF65EB64D9806AEB7B2EB88310F2095AAD845DB354EB31DC42CBA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jG8N6WDJOx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jG8N6WDJOx.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1j3smgav.5bq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3fjl04yx.1n1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_erkkbfqe.ais.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lfqzb4bo.fhg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lpeug3kc.ln3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oznbv1j0.od4.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s3rv4uii.5js.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zschz2dd.g0q.psm1

C:\Users\user\AppData\Local\Temp\tmp692.tmp

C:\Users\user\AppData\Roaming\HNkDZJwSy.exe

C:\Users\user\AppData\Roaming\HNkDZJwSy.exe:Zone.Identifier

Static File Info

Windows Analysis Report
jG8N6WDJOx.exe

Function 07934250 Relevance: 4.0, Strings: 3, Instructions: 271
COMMON

Function 0793633A Relevance: 2.9, Strings: 2, Instructions: 409
COMMON

Function 07936391 Relevance: 2.9, Strings: 2, Instructions: 405
COMMON

Function 07936371 Relevance: 2.9, Strings: 2, Instructions: 357
COMMON

Function 07936458 Relevance: 2.8, Strings: 2, Instructions: 284
COMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre