Edit tour

Windows Analysis Report
xJZHVgxQul.exe

Overview

General Information

Sample name:	xJZHVgxQul.exe renamed because original name is a hash value
Original sample name:	d2200969f527ad8529714c8fdd97ae9646eaa76c702dfcd71dd2ad7e84898cdf.exe
Analysis ID:	1588293
MD5:	20e0718ded5409c8ad729c85e4eacfb1
SHA1:	df1d5d23084b07944abe9b081f61750cc382feb0
SHA256:	d2200969f527ad8529714c8fdd97ae9646eaa76c702dfcd71dd2ad7e84898cdf
Tags:	AgentTeslaexeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

xJZHVgxQul.exe (PID: 6508 cmdline: "C:\Users\user\Desktop\xJZHVgxQul.exe" MD5: 20E0718DED5409C8AD729C85E4EACFB1)

powershell.exe (PID: 3624 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7488 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 3496 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eWJxJJ.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2368 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp6409.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xJZHVgxQul.exe (PID: 7276 cmdline: "C:\Users\user\Desktop\xJZHVgxQul.exe" MD5: 20E0718DED5409C8AD729C85E4EACFB1)

eWJxJJ.exe (PID: 7388 cmdline: C:\Users\user\AppData\Roaming\eWJxJJ.exe MD5: 20E0718DED5409C8AD729C85E4EACFB1)

schtasks.exe (PID: 7620 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp75DB.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

eWJxJJ.exe (PID: 7668 cmdline: "C:\Users\user\AppData\Roaming\eWJxJJ.exe" MD5: 20E0718DED5409C8AD729C85E4EACFB1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "web@iaa-airferight.com", "Password": "webmaster"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.2967236057.0000000002ADC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.2967765524.0000000002E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2967765524.0000000002E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2964047218.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2964047218.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.2967765524.0000000002E9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2967236057.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2967236057.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: xJZHVgxQul.exe PID: 6508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xJZHVgxQul.exe PID: 6508	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: xJZHVgxQul.exe PID: 6508	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: xJZHVgxQul.exe PID: 7276	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xJZHVgxQul.exe PID: 7276	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: eWJxJJ.exe PID: 7388	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: eWJxJJ.exe PID: 7668	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: eWJxJJ.exe PID: 7668	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.xJZHVgxQul.exe.426b138.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.xJZHVgxQul.exe.426b138.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.xJZHVgxQul.exe.426b138.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.xJZHVgxQul.exe.42a5b58.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.xJZHVgxQul.exe.42a5b58.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.xJZHVgxQul.exe.42a5b58.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.xJZHVgxQul.exe.42a5b58.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.xJZHVgxQul.exe.42a5b58.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.xJZHVgxQul.exe.42a5b58.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.xJZHVgxQul.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.xJZHVgxQul.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.xJZHVgxQul.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.xJZHVgxQul.exe.426b138.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.xJZHVgxQul.exe.426b138.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.xJZHVgxQul.exe.426b138.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e00b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e09d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e107:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e179:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e20f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e29f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.xJZHVgxQul.exe.438cff0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.xJZHVgxQul.exe.438cff0.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.xJZHVgxQul.exe.438cff0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.xJZHVgxQul.exe.438cff0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xb230f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xb2381:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xb240b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xb249d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xb2507:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xb2579:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xb260f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xb269f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.xJZHVgxQul.exe.42eb978.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.xJZHVgxQul.exe.42eb978.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.xJZHVgxQul.exe.42eb978.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.xJZHVgxQul.exe.42eb978.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x153987:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1539f9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x153a83:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x153b15:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x153b7f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x153bf1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x153c87:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x153d17:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\xJZHVgxQul.exe", ParentImage: C:\Users\user\Desktop\xJZHVgxQul.exe, ParentProcessId: 6508, ParentProcessName: xJZHVgxQul.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe", ProcessId: 3624, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp75DB.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp75DB.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\eWJxJJ.exe, ParentImage: C:\Users\user\AppData\Roaming\eWJxJJ.exe, ParentProcessId: 7388, ParentProcessName: eWJxJJ.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp75DB.tmp", ProcessId: 7620, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Users\user\Desktop\xJZHVgxQul.exe, Initiated: true, ProcessId: 7276, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49737

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp6409.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp6409.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\xJZHVgxQul.exe", ParentImage: C:\Users\user\Desktop\xJZHVgxQul.exe, ParentProcessId: 6508, ParentProcessName: xJZHVgxQul.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp6409.tmp", ProcessId: 2368, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\xJZHVgxQul.exe", ParentImage: C:\Users\user\Desktop\xJZHVgxQul.exe, ParentProcessId: 6508, ParentProcessName: xJZHVgxQul.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe", ProcessId: 3624, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp6409.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp6409.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\xJZHVgxQul.exe", ParentImage: C:\Users\user\Desktop\xJZHVgxQul.exe, ParentProcessId: 6508, ParentProcessName: xJZHVgxQul.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp6409.tmp", ProcessId: 2368, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.xJZHVgxQul.exe.42a5b58.6.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "web@iaa-airferight.com", "Password": "webmaster"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Virustotal: Detection: 59%			Perma Link

Multi AV Scanner detection for submitted file

Source: xJZHVgxQul.exe	Virustotal: Detection: 59%			Perma Link
Source: xJZHVgxQul.exe	ReversingLabs: Detection: 82%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: xJZHVgxQul.exe

Joe Sandbox ML: detected

Source: xJZHVgxQul.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49739 version: TLS 1.2

Source: xJZHVgxQul.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: QpXjz.pdbSHA256 source: xJZHVgxQul.exe, eWJxJJ.exe.0.dr
Source:	Binary string: QpXjz.pdb source: xJZHVgxQul.exe, eWJxJJ.exe.0.dr

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.xJZHVgxQul.exe.438cff0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.42eb978.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:57751 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 46.175.148.58 46.175.148.58

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49737 -> 46.175.148.58:25

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.iaa-airferight.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: xJZHVgxQul.exe, 00000008.00000002.2967236057.0000000002ADC000.00000004.00000800.00020000.00000000.sdmp, eWJxJJ.exe, 0000000D.00000002.2967765524.0000000002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: xJZHVgxQul.exe, 00000000.00000002.1747427029.0000000003211000.00000004.00000800.00020000.00000000.sdmp, xJZHVgxQul.exe, 00000008.00000002.2967236057.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, eWJxJJ.exe, 00000009.00000002.1793361972.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, eWJxJJ.exe, 0000000D.00000002.2967765524.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: xJZHVgxQul.exe, 00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, xJZHVgxQul.exe, 00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp, xJZHVgxQul.exe, 00000008.00000002.2964047218.0000000000403000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: xJZHVgxQul.exe, 00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, xJZHVgxQul.exe, 00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp, xJZHVgxQul.exe, 00000008.00000002.2964047218.0000000000403000.00000040.00000400.00020000.00000000.sdmp, xJZHVgxQul.exe, 00000008.00000002.2967236057.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, eWJxJJ.exe, 0000000D.00000002.2967765524.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: xJZHVgxQul.exe, 00000008.00000002.2967236057.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, eWJxJJ.exe, 0000000D.00000002.2967765524.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: xJZHVgxQul.exe, 00000008.00000002.2967236057.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, eWJxJJ.exe, 0000000D.00000002.2967765524.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49739 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.xJZHVgxQul.exe.426b138.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.xJZHVgxQul.exe.42a5b58.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.xJZHVgxQul.exe.42a5b58.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.xJZHVgxQul.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.xJZHVgxQul.exe.426b138.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.xJZHVgxQul.exe.438cff0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.xJZHVgxQul.exe.42eb978.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_01684218	0_2_01684218
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_01684B00	0_2_01684B00
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_01686F92	0_2_01686F92
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_0168D424	0_2_0168D424
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_07BBA880	0_2_07BBA880
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_07BB26F8	0_2_07BB26F8
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_07BB4D38	0_2_07BB4D38
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_07BB43F0	0_2_07BB43F0
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_07BB43E0	0_2_07BB43E0
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_07BB22C0	0_2_07BB22C0
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_07BB4900	0_2_07BB4900
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_0107A198	8_2_0107A198
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_0107E6B0	8_2_0107E6B0
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_0107A960	8_2_0107A960
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_01074A98	8_2_01074A98
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_01073E80	8_2_01073E80
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_010741C8	8_2_010741C8
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_06697D68	8_2_06697D68
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_066965E0	8_2_066965E0
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_06695588	8_2_06695588
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_0669B20F	8_2_0669B20F
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_06692358	8_2_06692358
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_06697688	8_2_06697688
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_06695CE8	8_2_06695CE8
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_0669E388	8_2_0669E388
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_06690040	8_2_06690040
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_066902C6	8_2_066902C6
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_06690006	8_2_06690006
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_01744218	9_2_01744218
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_01746F90	9_2_01746F90
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_0174D424	9_2_0174D424
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_072A0FE8	9_2_072A0FE8
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_072A0FF8	9_2_072A0FF8
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_073B26F8	9_2_073B26F8
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_073B4D38	9_2_073B4D38
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_073B43F0	9_2_073B43F0
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_073B43E0	9_2_073B43E0
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_073B9A28	9_2_073B9A28
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_073B22C0	9_2_073B22C0
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_073B4900	9_2_073B4900
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_07786DB8	9_2_07786DB8
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_0116E6A1	13_2_0116E6A1
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_0116A960	13_2_0116A960
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_01164A98	13_2_01164A98
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_01163E80	13_2_01163E80
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_011641C8	13_2_011641C8
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B05588	13_2_06B05588
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B065E0	13_2_06B065E0
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B07D68	13_2_06B07D68
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B0B20F	13_2_06B0B20F
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B03040	13_2_06B03040
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B07688	13_2_06B07688
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B05CD3	13_2_06B05CD3
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B0E388	13_2_06B0E388
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B02349	13_2_06B02349
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B00040	13_2_06B00040
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B00006	13_2_06B00006
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B00160	13_2_06B00160

Source: xJZHVgxQul.exe, 00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe, 00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe, 00000000.00000002.1762398737.0000000005C00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe, 00000000.00000002.1771461190.0000000007FF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQ, vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe, 00000000.00000002.1771461190.0000000007FF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQpXjz.exe( vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe, 00000000.00000002.1766907047.0000000007900000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe, 00000000.00000002.1745850914.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe, 00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe, 00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe, 00000000.00000000.1705430579.0000000000CA2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameQpXjz.exe( vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe, 00000000.00000002.1747427029.0000000003274000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe, 00000008.00000002.2964470056.0000000000AF9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe, 00000008.00000002.2964047218.0000000000403000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs xJZHVgxQul.exe
Source: xJZHVgxQul.exe	Binary or memory string: OriginalFilenameQpXjz.exe( vs xJZHVgxQul.exe

Source: xJZHVgxQul.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.xJZHVgxQul.exe.426b138.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.xJZHVgxQul.exe.42a5b58.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.xJZHVgxQul.exe.42a5b58.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.xJZHVgxQul.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.xJZHVgxQul.exe.426b138.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.xJZHVgxQul.exe.438cff0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.xJZHVgxQul.exe.42eb978.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: xJZHVgxQul.exe, 00000000.00000002.1747427029.0000000003274000.00000004.00000800.00020000.00000000.sdmp, eWJxJJ.exe, 00000009.00000002.1793361972.0000000003154000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .Sln@\^q
Source: xJZHVgxQul.exe, 00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Njj.Sln

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@3/2

Source: C:\Users\user\Desktop\xJZHVgxQul.exe

File created: C:\Users\user\AppData\Roaming\eWJxJJ.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:280:120:WilError_03

Source: C:\Users\user\Desktop\xJZHVgxQul.exe

File created: C:\Users\user\AppData\Local\Temp\tmp6409.tmp

Jump to behavior

Source: xJZHVgxQul.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: xJZHVgxQul.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\xJZHVgxQul.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\xJZHVgxQul.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xJZHVgxQul.exe	Virustotal: Detection: 59%
Source: xJZHVgxQul.exe	ReversingLabs: Detection: 82%

Source: C:\Users\user\Desktop\xJZHVgxQul.exe

File read: C:\Users\user\Desktop\xJZHVgxQul.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\xJZHVgxQul.exe "C:\Users\user\Desktop\xJZHVgxQul.exe"
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eWJxJJ.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp6409.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Users\user\Desktop\xJZHVgxQul.exe "C:\Users\user\Desktop\xJZHVgxQul.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\eWJxJJ.exe C:\Users\user\AppData\Roaming\eWJxJJ.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp75DB.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process created: C:\Users\user\AppData\Roaming\eWJxJJ.exe "C:\Users\user\AppData\Roaming\eWJxJJ.exe"
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe"	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eWJxJJ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp6409.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Users\user\Desktop\xJZHVgxQul.exe "C:\Users\user\Desktop\xJZHVgxQul.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp75DB.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process created: C:\Users\user\AppData\Roaming\eWJxJJ.exe "C:\Users\user\AppData\Roaming\eWJxJJ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Section loaded: wintypes.dll

Source: C:\Users\user\Desktop\xJZHVgxQul.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\xJZHVgxQul.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\xJZHVgxQul.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: xJZHVgxQul.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: xJZHVgxQul.exe

Static file information: File size 1142784 > 1048576

Source: xJZHVgxQul.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: xJZHVgxQul.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: QpXjz.pdbSHA256 source: xJZHVgxQul.exe, eWJxJJ.exe.0.dr
Source:	Binary string: QpXjz.pdb source: xJZHVgxQul.exe, eWJxJJ.exe.0.dr

Source: xJZHVgxQul.exe

Static PE information: 0x8AD3D0F3 [Thu Oct 22 14:36:35 2043 UTC]

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_0579B5F3 push eax; ret	0_2_0579B623
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_0579AF18 push eax; mov dword ptr [esp], ecx	0_2_0579AF1C
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_05799B77 push 8BFFFFFFh; retf	0_2_05799B7F
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 0_2_05799B4D push 8BFFFFFFh; retf	0_2_05799B59
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_01070C55 push edi; retf	8_2_01070C7A
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Code function: 8_2_0669FFBF push es; ret	8_2_0669FFC0
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 9_2_072AF893 push esp; retf	9_2_072AF8B1
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Code function: 13_2_06B0FFB0 push es; ret	13_2_06B0FFC0

Source: xJZHVgxQul.exe	Static PE information: section name: .text entropy: 6.883080208423551
Source: eWJxJJ.exe.0.dr	Static PE information: section name: .text entropy: 6.883080208423551

Source: C:\Users\user\Desktop\xJZHVgxQul.exe

File created: C:\Users\user\AppData\Roaming\eWJxJJ.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\xJZHVgxQul.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp6409.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: xJZHVgxQul.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eWJxJJ.exe PID: 7388, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Memory allocated: 1680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Memory allocated: 3210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Memory allocated: 5210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Memory allocated: 92D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Memory allocated: A2D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Memory allocated: A4D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Memory allocated: B4D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Memory allocated: 1030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Memory allocated: 2A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Memory allocated: 1740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Memory allocated: 30F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Memory allocated: 50F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Memory allocated: 9170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Memory allocated: 7B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Memory allocated: A170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Memory allocated: B170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Memory allocated: 1160000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Memory allocated: 2E20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Memory allocated: 4E20000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5636	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4833	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Window / User API: threadDelayed 3840	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Window / User API: threadDelayed 5993	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Window / User API: threadDelayed 2823
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Window / User API: threadDelayed 6996

Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 6628	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7068	Thread sleep count: 5636 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7308	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6940	Thread sleep count: 225 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7268	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7544	Thread sleep count: 3840 > 30	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -99637s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -99516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -99405s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7544	Thread sleep count: 5993 > 30	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -98828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -98719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -98485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -98360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -98235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -98110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -97985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -97860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -97735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -97610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -97219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -97000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -96891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -96766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -96641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -96531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -96422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -96313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -96188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -96063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -95953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -95840s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -95735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -95625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -95516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -95391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -95282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -95157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -95032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -94922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -94813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -94688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -94563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -94438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -94313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe TID: 7516	Thread sleep time: -94203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7448	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -28592453314249787s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7792	Thread sleep count: 2823 > 30
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -99874s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7792	Thread sleep count: 6996 > 30
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -99759s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -99657s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -99538s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -99422s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -99313s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -99188s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -99078s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -98969s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -98844s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -98735s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -98610s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -98485s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -98360s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -98235s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -98110s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -97985s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -97860s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -97735s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -97610s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -97485s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -97360s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -97235s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -97110s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -96985s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -96860s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -96735s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -96610s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -96485s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -96360s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -96235s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -96110s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -95985s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -95860s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -95735s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -95610s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -95485s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -95360s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -95235s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -95110s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -94985s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -94860s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -94735s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -94610s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -94485s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -94360s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -94235s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -94110s >= -30000s
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe TID: 7788	Thread sleep time: -93985s >= -30000s

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 99637	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 99405	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 98828	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 98719	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 98485	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 98360	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 97985	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 97219	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 97000	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 96891	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 96766	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 96641	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 96531	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 96422	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 96313	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 96188	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 96063	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 95953	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 95840	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 95735	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 95625	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 95516	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 95391	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 95282	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 95157	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 95032	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 94922	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 94813	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 94688	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 94563	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 94438	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 94313	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Thread delayed: delay time: 94203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 99874
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 99759
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 99657
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 99538
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 99422
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 99313
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 99188
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 99078
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 98969
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 98844
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 98735
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 98610
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 98485
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 98360
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 98235
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 98110
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 97985
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 97860
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 97735
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 97610
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 97485
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 97360
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 97235
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 97110
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 96985
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 96860
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 96735
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 96610
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 96485
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 96360
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 96235
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 96110
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 95985
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 95860
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 95735
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 95610
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 95485
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 95360
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 95235
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 95110
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 94985
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 94860
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 94735
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 94610
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 94485
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 94360
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 94235
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 94110
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Thread delayed: delay time: 93985

Source: xJZHVgxQul.exe, 00000008.00000002.2965483939.0000000000C45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlli
Source: eWJxJJ.exe, 0000000D.00000002.2966828531.0000000001246000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\xJZHVgxQul.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe"
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eWJxJJ.exe"
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe"	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eWJxJJ.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Memory written: C:\Users\user\Desktop\xJZHVgxQul.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Memory written: C:\Users\user\AppData\Roaming\eWJxJJ.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe"	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eWJxJJ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp6409.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Process created: C:\Users\user\Desktop\xJZHVgxQul.exe "C:\Users\user\Desktop\xJZHVgxQul.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp75DB.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Process created: C:\Users\user\AppData\Roaming\eWJxJJ.exe "C:\Users\user\AppData\Roaming\eWJxJJ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Users\user\Desktop\xJZHVgxQul.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Users\user\Desktop\xJZHVgxQul.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Queries volume information: C:\Users\user\AppData\Roaming\eWJxJJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Queries volume information: C:\Users\user\AppData\Roaming\eWJxJJ.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\xJZHVgxQul.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.xJZHVgxQul.exe.426b138.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.42a5b58.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.42a5b58.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.xJZHVgxQul.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.426b138.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.438cff0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.42eb978.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2967236057.0000000002ADC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2967765524.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2964047218.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2967765524.0000000002E9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2967236057.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xJZHVgxQul.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xJZHVgxQul.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eWJxJJ.exe PID: 7668, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\xJZHVgxQul.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\xJZHVgxQul.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\eWJxJJ.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.xJZHVgxQul.exe.426b138.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.42a5b58.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.42a5b58.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.xJZHVgxQul.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.426b138.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.438cff0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.42eb978.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2967765524.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2964047218.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2967236057.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xJZHVgxQul.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xJZHVgxQul.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eWJxJJ.exe PID: 7668, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.xJZHVgxQul.exe.426b138.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.42a5b58.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.42a5b58.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.xJZHVgxQul.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.426b138.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.438cff0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xJZHVgxQul.exe.42eb978.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2967236057.0000000002ADC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2967765524.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2964047218.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2967765524.0000000002E9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2967236057.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xJZHVgxQul.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xJZHVgxQul.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eWJxJJ.exe PID: 7668, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	2 Obfuscated Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	1 Software Packing	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	211 Security Software Discovery	Distributed Component Object Model	Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xJZHVgxQul.exe	59%	Virustotal		Browse
xJZHVgxQul.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
xJZHVgxQul.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\eWJxJJ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\eWJxJJ.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\AppData\Roaming\eWJxJJ.exe	59%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
mail.iaa-airferight.com	46.175.148.58	true	false	high
api.ipify.org	104.26.12.205	true	false	high
206.23.85.13.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.apache.org/licenses/LICENSE-2.0	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designersG	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/?	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://account.dyn.com/	xJZHVgxQul.exe, 00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, xJZHVgxQul.exe, 00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp, xJZHVgxQul.exe, 00000008.00000002.2964047218.0000000000403000.00000040.00000400.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers?	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mail.iaa-airferight.com	xJZHVgxQul.exe, 00000008.00000002.2967236057.0000000002ADC000.00000004.00000800.00020000.00000000.sdmp, eWJxJJ.exe, 0000000D.00000002.2967765524.0000000002E9C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.tiro.com	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.goodfont.co.kr	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ipify.org/t	xJZHVgxQul.exe, 00000008.00000002.2967236057.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, eWJxJJ.exe, 0000000D.00000002.2967765524.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.carterandcone.coml	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.typography.netD	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/cabarga.htmlN	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/staff/dennis.htm	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ipify.org	xJZHVgxQul.exe, 00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, xJZHVgxQul.exe, 00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp, xJZHVgxQul.exe, 00000008.00000002.2964047218.0000000000403000.00000040.00000400.00020000.00000000.sdmp, xJZHVgxQul.exe, 00000008.00000002.2967236057.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, eWJxJJ.exe, 0000000D.00000002.2967765524.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/frere-user.html	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.jiyu-kobo.co.jp/	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers8	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fonts.com	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sandoll.co.kr	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.zhongyicts.com.cn	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	xJZHVgxQul.exe, 00000000.00000002.1747427029.0000000003211000.00000004.00000800.00020000.00000000.sdmp, xJZHVgxQul.exe, 00000008.00000002.2967236057.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, eWJxJJ.exe, 00000009.00000002.1793361972.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, eWJxJJ.exe, 0000000D.00000002.2967765524.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sakkal.com	xJZHVgxQul.exe, 00000000.00000002.1763287021.00000000073B2000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588293
Start date and time:	2025-01-10 23:36:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xJZHVgxQul.exe renamed because original name is a hash value
Original Sample Name:	d2200969f527ad8529714c8fdd97ae9646eaa76c702dfcd71dd2ad7e84898cdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 207 Number of non-executed functions: 21
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.245.163.56, 13.85.23.206, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:37:42	API Interceptor	179x Sleep call for process: xJZHVgxQul.exe modified
17:37:44	API Interceptor	39x Sleep call for process: powershell.exe modified
17:37:47	API Interceptor	172x Sleep call for process: eWJxJJ.exe modified
22:37:31	Task Scheduler	Run new task: {60D1C0C7-5BE1-483F-9605-F930E9FD610A} path:
22:37:45	Task Scheduler	Run new task: eWJxJJ path: C:\Users\user\AppData\Roaming\eWJxJJ.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	api.ipify.org/
	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
46.175.148.58	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse
	kzy8qg5lbR.exe	Get hash	malicious	AgentTesla	Browse
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse
	PO for fabric forecast.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	kzy8qg5lbR.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO for fabric forecast.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	46.175.148.58
api.ipify.org	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	s2Jg1MAahY.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Y8Q1voljvb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	IUqsn1SBGy.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DpTbBYeE7J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	RJKUWSGxej.exe	Get hash	malicious	AgentTesla, RedLine	Browse	104.26.13.205
	7DpzcPcsTS.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	B8FnDUj8hy.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.162.153
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.223.109
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	Full-Ver_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.60
	7b4Iaf58Rp.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
ASLAGIDKOM-NETUA	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	kzy8qg5lbR.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO for fabric forecast.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	46.175.148.58

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.12.205
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.12.205
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	3j7f6Bv4FT.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	3j7f6Bv4FT.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	b5BQbAhwVD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.12.205
	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.12.205
	iRmpdWgpoF.exe	Get hash	malicious	Unknown	Browse	104.26.12.205

Process:	C:\Users\user\AppData\Roaming\eWJxJJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xJZHVgxQul.exe.log

Download File

Process:	C:\Users\user\Desktop\xJZHVgxQul.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379071839957789
Encrypted:	false
SSDEEP:	48:bWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugeC/ZPUyus:bLHxvIIwLgZ2KRHWLOug8s
MD5:	4135B00B11C8089FA64CF40DE44EDC1C
SHA1:	3490E9A1BCB4FDEC9332379CD669FB69BB74A601
SHA-256:	A5E4501942BD47C58D7C3934AB6443BC684A3AD54A5709CB62EC2B45504BDC63
SHA-512:	DCB00F8E5764F5710DEEEAC6A810585B07570ECB2753FE83E8604E422FCC7C6B26C52518F385A3483480BCD93B1DC8016C103AC82E7AB823C6C49AB23D079871
Malicious:	false
Preview:	@...e.................................&..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4dzfumwj.pdt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5b5pjbqw.a1l.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_art2xoni.zw5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_heipoja3.qt3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_muwgycz1.ee5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q3zi4onu.qyv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rkkruh2v.cld.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tooqpcsf.3rn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp6409.tmp

Download File

Process:	C:\Users\user\Desktop\xJZHVgxQul.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	5.108512529143448
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta5xLxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTC1v
MD5:	B730169D0C908FA40AAF54E853917192
SHA1:	A0E241BF4CB8987E99A0D0D4F0497AE3DB4A1408
SHA-256:	6BCA510CC835DC7577E150CEED8AC8CE6E8F1707F4DD2859B453FE9EF31E4B22
SHA-512:	86BDE250FBF71EC87A62589E0773B4B45242016DA2E84A5358F111A35E28612350756E267D9397F68EDDC22CB835C02FDAAEF6AB093C61E93893DC72FE5368BA
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp75DB.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\eWJxJJ.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	5.108512529143448
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta5xLxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTC1v
MD5:	B730169D0C908FA40AAF54E853917192
SHA1:	A0E241BF4CB8987E99A0D0D4F0497AE3DB4A1408
SHA-256:	6BCA510CC835DC7577E150CEED8AC8CE6E8F1707F4DD2859B453FE9EF31E4B22
SHA-512:	86BDE250FBF71EC87A62589E0773B4B45242016DA2E84A5358F111A35E28612350756E267D9397F68EDDC22CB835C02FDAAEF6AB093C61E93893DC72FE5368BA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\eWJxJJ.exe

Download File

Process:	C:\Users\user\Desktop\xJZHVgxQul.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1142784
Entropy (8bit):	6.847929298614678
Encrypted:	false
SSDEEP:	12288:hFF8EA/neBWMV96UTMMUsoSKTY6hbozirMB5gsKY2nN4jrIF:T6HeYMP6EoY6h8zi4B56XnNssF
MD5:	20E0718DED5409C8AD729C85E4EACFB1
SHA1:	DF1D5D23084B07944ABE9B081F61750CC382FEB0
SHA-256:	D2200969F527AD8529714C8FDD97AE9646EAA76C702DFCD71DD2AD7E84898CDF
SHA-512:	696FDBD50CF4F889B8B786838395A7D5C993152F2D320F73473A69A0B22AC7425F46B5DAFE31191EA991BC3105A4EA7060F70418521EE543716DC044567F1B03
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 59%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.............f.... ........@.. ....................................@.....................................O.......................................p............................................ ............... ..H............text...l.... ...................... ..`.rsrc...............................@..@.reloc...............n..............@..B................E.......H............R......J.......0............................................0............}......}.....(.......(......{...........%.r...p(....s.....%.r...p(....s.....%.r%..p(....s.......o.......(...+....-....o....&..0...........s2.....o.......0...........sA.....o.......0...........s/.....o.......0...........s8.....o.......0...........s;.....o.......0...........s>.....o.......0...........s5.....o.......0...........sD.....o.......0...........sG.....o.......0...........s .

C:\Users\user\AppData\Roaming\eWJxJJ.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\xJZHVgxQul.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.847929298614678
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	xJZHVgxQul.exe
File size:	1'142'784 bytes
MD5:	20e0718ded5409c8ad729c85e4eacfb1
SHA1:	df1d5d23084b07944abe9b081f61750cc382feb0
SHA256:	d2200969f527ad8529714c8fdd97ae9646eaa76c702dfcd71dd2ad7e84898cdf
SHA512:	696fdbd50cf4f889b8b786838395a7d5c993152f2d320f73473a69a0b22ac7425f46b5dafe31191ea991bc3105a4ea7060f70418521ee543716dc044567f1b03
SSDEEP:	12288:hFF8EA/neBWMV96UTMMUsoSKTY6hbozirMB5gsKY2nN4jrIF:T6HeYMP6EoY6h8zi4B56XnNssF
TLSH:	C0356E3F087D12F7C575C37C8AE44897A1B09C5F7184B86546E65B79A33AA063C8F22E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.............f.... ........@.. ....................................@................................

File Icon


Icon Hash:	2946e68e96b3ca4d

Static PE Info

General

Entrypoint:	0x4ed366
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x8AD3D0F3 [Thu Oct 22 14:36:35 2043 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xed311	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xee000	0x2b71c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xebac0	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xeb36c	0xeb400	2cb1292a03fe332d0e7bb4d5b897a0d2	False	0.6826566236052072	data	6.883080208423551	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xee000	0x2b71c	0x2b800	d83e3658a8fad638e120620707e59b5a	False	0.20960174209770116	data	5.132620536995076	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11a000	0xc	0x200	7cda671670b38f967356daa663f2d0c6	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xee2b0	0x3751	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9929383518113127
RT_ICON	0xf1a04	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.0891251626641429
RT_ICON	0x10222c	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.13335610678999368
RT_ICON	0x10b6d4	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.16816081330868762
RT_ICON	0x110b5c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.15594000944733113
RT_ICON	0x114d84	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.23392116182572614
RT_ICON	0x11732c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.274624765478424
RT_ICON	0x1183d4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.41885245901639345
RT_ICON	0x118d5c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5
RT_GROUP_ICON	0x1191c4	0x84	data	0.7045454545454546
RT_VERSION	0x119248	0x2e8	data	0.43548387096774194
RT_MANIFEST	0x119530	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:37:46.349734068 CET	49735	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:46.349787951 CET	443	49735	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:46.349848986 CET	49735	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:46.357563019 CET	49735	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:46.357583046 CET	443	49735	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:46.838764906 CET	443	49735	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:46.839025021 CET	49735	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:46.869170904 CET	49735	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:46.869223118 CET	443	49735	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:46.869528055 CET	443	49735	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:47.020291090 CET	49735	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:47.029561996 CET	49735	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:47.075341940 CET	443	49735	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:47.149080992 CET	443	49735	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:47.149152040 CET	443	49735	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:47.149372101 CET	49735	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:47.298537970 CET	49735	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:48.171881914 CET	49737	25	192.168.2.4	46.175.148.58
Jan 10, 2025 23:37:49.333789110 CET	49737	25	192.168.2.4	46.175.148.58
Jan 10, 2025 23:37:50.246138096 CET	49739	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:50.246187925 CET	443	49739	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:50.246572971 CET	49739	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:50.251260042 CET	49739	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:50.251281023 CET	443	49739	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:50.705204010 CET	443	49739	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:50.705291033 CET	49739	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:50.707308054 CET	49739	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:50.707340002 CET	443	49739	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:50.707581997 CET	443	49739	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:50.765877008 CET	49739	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:50.811342001 CET	443	49739	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:50.876140118 CET	443	49739	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:50.876208067 CET	443	49739	104.26.12.205	192.168.2.4
Jan 10, 2025 23:37:50.876378059 CET	49739	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:50.883296013 CET	49739	443	192.168.2.4	104.26.12.205
Jan 10, 2025 23:37:51.456037045 CET	49740	25	192.168.2.4	46.175.148.58
Jan 10, 2025 23:37:51.520288944 CET	49737	25	192.168.2.4	46.175.148.58
Jan 10, 2025 23:37:52.457762957 CET	49740	25	192.168.2.4	46.175.148.58
Jan 10, 2025 23:37:54.457781076 CET	49740	25	192.168.2.4	46.175.148.58
Jan 10, 2025 23:37:55.520246983 CET	49737	25	192.168.2.4	46.175.148.58
Jan 10, 2025 23:37:58.462065935 CET	49740	25	192.168.2.4	46.175.148.58
Jan 10, 2025 23:38:03.535907030 CET	49737	25	192.168.2.4	46.175.148.58
Jan 10, 2025 23:38:06.473560095 CET	49740	25	192.168.2.4	46.175.148.58
Jan 10, 2025 23:38:12.590604067 CET	57751	53	192.168.2.4	162.159.36.2
Jan 10, 2025 23:38:12.595463037 CET	53	57751	162.159.36.2	192.168.2.4
Jan 10, 2025 23:38:12.595587015 CET	57751	53	192.168.2.4	162.159.36.2
Jan 10, 2025 23:38:12.600471020 CET	53	57751	162.159.36.2	192.168.2.4
Jan 10, 2025 23:38:13.098419905 CET	57751	53	192.168.2.4	162.159.36.2
Jan 10, 2025 23:38:13.116213083 CET	57751	53	192.168.2.4	162.159.36.2
Jan 10, 2025 23:38:13.121381998 CET	53	57751	162.159.36.2	192.168.2.4
Jan 10, 2025 23:38:13.121452093 CET	57751	53	192.168.2.4	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:37:46.329875946 CET	64825	53	192.168.2.4	1.1.1.1
Jan 10, 2025 23:37:46.336693048 CET	53	64825	1.1.1.1	192.168.2.4
Jan 10, 2025 23:37:48.134521961 CET	61464	53	192.168.2.4	1.1.1.1
Jan 10, 2025 23:37:48.171096087 CET	53	61464	1.1.1.1	192.168.2.4
Jan 10, 2025 23:38:12.589958906 CET	53	59980	162.159.36.2	192.168.2.4
Jan 10, 2025 23:38:13.149076939 CET	63203	53	192.168.2.4	1.1.1.1
Jan 10, 2025 23:38:13.156845093 CET	53	63203	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:37:46.329875946 CET	192.168.2.4	1.1.1.1	0xf4d0	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:37:48.134521961 CET	192.168.2.4	1.1.1.1	0x42f7	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:13.149076939 CET	192.168.2.4	1.1.1.1	0x8225	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:37:46.336693048 CET	1.1.1.1	192.168.2.4	0xf4d0	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:37:46.336693048 CET	1.1.1.1	192.168.2.4	0xf4d0	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:37:46.336693048 CET	1.1.1.1	192.168.2.4	0xf4d0	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:37:48.171096087 CET	1.1.1.1	192.168.2.4	0x42f7	No error (0)	mail.iaa-airferight.com		46.175.148.58	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:13.156845093 CET	1.1.1.1	192.168.2.4	0x8225	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	104.26.12.205	443	7276	C:\Users\user\Desktop\xJZHVgxQul.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:37:47 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-10 22:37:47 UTC	424	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:37:47 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 900027515e50185d-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1499&min_rtt=1489&rtt_var=579&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=769&delivery_rate=1858688&cwnd=238&unsent_bytes=0&cid=eec9cd7447116ba2&ts=322&x=0"
2025-01-10 22:37:47 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	104.26.12.205	443	7668	C:\Users\user\AppData\Roaming\eWJxJJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:37:50 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-10 22:37:50 UTC	424	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:37:50 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 900027689baf8c48-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2008&min_rtt=2000&rtt_var=756&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=769&delivery_rate=1460000&cwnd=215&unsent_bytes=0&cid=310b905b324aad65&ts=174&x=0"
2025-01-10 22:37:50 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	17:37:40
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\xJZHVgxQul.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xJZHVgxQul.exe"
Imagebase:	0xca0000
File size:	1'142'784 bytes
MD5 hash:	20E0718DED5409C8AD729C85E4EACFB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1751392675.0000000004219000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1751392675.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:37:43
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\xJZHVgxQul.exe"
Imagebase:	0x120000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:37:43
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:37:43
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eWJxJJ.exe"
Imagebase:	0x120000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:37:43
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:37:43
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp6409.tmp"
Imagebase:	0x240000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:37:43
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:37:44
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\xJZHVgxQul.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xJZHVgxQul.exe"
Imagebase:	0x590000
File size:	1'142'784 bytes
MD5 hash:	20E0718DED5409C8AD729C85E4EACFB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2967236057.0000000002ADC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2964047218.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2964047218.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2967236057.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2967236057.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:37:45
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\eWJxJJ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\eWJxJJ.exe
Imagebase:	0xd00000
File size:	1'142'784 bytes
MD5 hash:	20E0718DED5409C8AD729C85E4EACFB1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs Detection: 59%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:37:46
Start date:	10/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:37:48
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eWJxJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp75DB.tmp"
Imagebase:	0x240000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:37:48
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:37:48
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\eWJxJJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\eWJxJJ.exe"
Imagebase:	0xa00000
File size:	1'142'784 bytes
MD5 hash:	20E0718DED5409C8AD729C85E4EACFB1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.2967765524.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.2967765524.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.2967765524.0000000002E9C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.3%
Total number of Nodes:	235
Total number of Limit Nodes:	13

Executed Functions

Function 01684B00 Relevance: 1.6, Strings: 1, Instructions: 308COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 01684AD2

Memory Dump Source

Source File: 00000000.00000002.1746774840.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1680000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: `Q^q
API String ID: 0-1948671464
Opcode ID: 3edf97c2c7013b4ab359437b5f6c577fc867242c2ccc6559b5a74e72f419bb9d
Instruction ID: 16d2a760a5f8535f7e48e5b6188b03d61211b8e712d83b543d04b35f966acfe0
Opcode Fuzzy Hash: 3edf97c2c7013b4ab359437b5f6c577fc867242c2ccc6559b5a74e72f419bb9d
Instruction Fuzzy Hash: 51A17A676005438BC715757A8C1A7663AC7976A02CF29D398C26DAF7E3EF92C50283C6

Function 07BBA880 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c57c4eacb48b3582b8d127266265474459d03db497bb9ba8061f6e6651516fd
Instruction ID: 020ad88fb4836ae68af3ff47f07600269f9de27764a1b3a051ce80326eb71cad
Opcode Fuzzy Hash: 7c57c4eacb48b3582b8d127266265474459d03db497bb9ba8061f6e6651516fd
Instruction Fuzzy Hash: A1D1AEB0B016058FEB25EB75C950BBEB7F6AF89600F1084AED9459B390EB75D802C751

Function 01684218 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746774840.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1680000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31706ed19655187e155323b6d71d6b2c01199b6aa66bec55cdb50c16c051569
Instruction ID: 752ca0212349a9963bf999faa24668cff85884a8297bcc6ef9d00c4e2a496087
Opcode Fuzzy Hash: b31706ed19655187e155323b6d71d6b2c01199b6aa66bec55cdb50c16c051569
Instruction Fuzzy Hash: 80519070E012099FCB08DFA9D8949AEBBF2FF88300F14852AD419AB364DB3599468B54

Function 01686F92 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746774840.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1680000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186d8697219b695f0817e432ec515a7a2ca627f989c5f9355598ee8898078cc8
Instruction ID: c9382f14d323c72f083ca1593671426e4f87b87c855aab0763b90c6104ff1e98
Opcode Fuzzy Hash: 186d8697219b695f0817e432ec515a7a2ca627f989c5f9355598ee8898078cc8
Instruction Fuzzy Hash: 0E51A270E01209DFCB08DFA9D8949AEBBF2FF88300F148529D419AB364DB359846CF94

Function 07BB54AC Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07BB56EE

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 477e74ffd75a9529aba47a2ee28cbfb7e8d861d091e4ee53f1e79514eccaef37
Instruction ID: 4251a16b2fa0d3b0c69e2843cbfef4009aaa3c1a5479ee78300f7e29df0a4338
Opcode Fuzzy Hash: 477e74ffd75a9529aba47a2ee28cbfb7e8d861d091e4ee53f1e79514eccaef37
Instruction Fuzzy Hash: FBA193B1D0021ADFEB20DF69C8417EDBBB2FF44314F1485A9E849A7240D7B49995CF92

Function 07BB54B8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07BB56EE

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 52818966714ba46bc3e00a8458e087c22f67744d60349a7143bffe60524d752e
Instruction ID: a4d6acfe5406db1601bc082d81499b03be5530ce07dfd8b2956b86b328f2c928
Opcode Fuzzy Hash: 52818966714ba46bc3e00a8458e087c22f67744d60349a7143bffe60524d752e
Instruction Fuzzy Hash: D59172B1D0021ADFEB20DF69C8407EDBBB2FF48314F1485A9E849A7250D7B49995CF92

Function 0168AE59 Relevance: 1.7, APIs: 1, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0168B0BE

Memory Dump Source

Source File: 00000000.00000002.1746774840.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1680000_xJZHVgxQul.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1597195d4971cde65f626f1bb67c33151f19924c3d57220d13d8e8a2a8f4dfeb
Instruction ID: 76e502e5016760e92c1cb347eff2830a7a82cd6715b03955113333736ff317f5
Opcode Fuzzy Hash: 1597195d4971cde65f626f1bb67c33151f19924c3d57220d13d8e8a2a8f4dfeb
Instruction Fuzzy Hash: 239166B0A00B458FD725EF69D85475ABBF1FF88200F048A2ED486DBB91D735E949CB90

Function 016844E0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016859C9

Memory Dump Source

Source File: 00000000.00000002.1746774840.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1680000_xJZHVgxQul.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a05fe7ef42691d87cccd955fe72690a21e64d3e7cfc49649ad082c94e71e64ef
Instruction ID: b1afa7ce82085016e3b2a18eee509f75726aeff1cb2deb4b6e77c231e8a6bb37
Opcode Fuzzy Hash: a05fe7ef42691d87cccd955fe72690a21e64d3e7cfc49649ad082c94e71e64ef
Instruction Fuzzy Hash: 6641CFB0C00719CBDB24DFA9C884B9EFBF5BF49304F24816AD409AB255DB756946CF90

Function 0168590D Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016859C9

Memory Dump Source

Source File: 00000000.00000002.1746774840.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1680000_xJZHVgxQul.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6e16080fad84194d8a97015e1ce3dba54b45921d71ec3142bdaf29c53a10ea18
Instruction ID: ca9d8fe16a30d56f97821af3adfef47931f841c67fd93d74281c3fd0b01e01e7
Opcode Fuzzy Hash: 6e16080fad84194d8a97015e1ce3dba54b45921d71ec3142bdaf29c53a10ea18
Instruction Fuzzy Hash: A841DFB0C00719CEDB24DFA9C884ADEFBF5BF49304F24816AD409AB255DB756986CF90

Function 07BB5228 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07BB52C0

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8b52ae45d5bc70247efb4ba216409bf3421bb8ad736c2a735969c0ef51cf2048
Instruction ID: 391c0169083eb2a2714bb7cd377c40679b32735b0aedc915ede22bc626df28f5
Opcode Fuzzy Hash: 8b52ae45d5bc70247efb4ba216409bf3421bb8ad736c2a735969c0ef51cf2048
Instruction Fuzzy Hash: 6A215AB6900319DFDB10CFA9C9857EEBBF5FF48310F10882AE958A7250D7789554CBA1

Function 07BB5230 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07BB52C0

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7127bed116eb2d4c92ebf4446cd130302fe8574431d6ab6951e22e79a3a71624
Instruction ID: 95f16f50d602144a087c4d4ed84dca454b844c30e1b5feb86c2b9657999c26bc
Opcode Fuzzy Hash: 7127bed116eb2d4c92ebf4446cd130302fe8574431d6ab6951e22e79a3a71624
Instruction Fuzzy Hash: F12139B19003599FDB20DFA9C885BEEBBF5FF48310F108429E958A7250C7789954CFA5

Function 07BB5318 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07BB53A0

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 71ddbf9fb85280161461b65e6290a9a2897fcda21d2ca6077d7e1b4a2c77886d
Instruction ID: 1b8c9b1b1dd84661fc0157b78141a86df36eb2978ce9af46a836fe101373d695
Opcode Fuzzy Hash: 71ddbf9fb85280161461b65e6290a9a2897fcda21d2ca6077d7e1b4a2c77886d
Instruction Fuzzy Hash: F52136B18002199FDB10CFA9C981BEEFBF4FF48320F10882AE959A7250C7789544CBA1

Function 07BB4820 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07BB48A6

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8090da596a6eab9d3654298de3864582efdd4e440a4002f7f30b163d6d4f00ba
Instruction ID: 5e47242fe505353b9155b3ae672a927b0578f5a404ffb06def123055e4167535
Opcode Fuzzy Hash: 8090da596a6eab9d3654298de3864582efdd4e440a4002f7f30b163d6d4f00ba
Instruction Fuzzy Hash: E32138B1D002498FDB10DFA9C5857EEBBF4FF48324F14842AD859A7241D7789945CFA4

Function 0168B850 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0168D706,?,?,?,?,?), ref: 0168D7C7

Memory Dump Source

Source File: 00000000.00000002.1746774840.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1680000_xJZHVgxQul.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: acf74200864e92307780ad0eb2a447404f9b82c358045633adafacd2e0b7016e
Instruction ID: 4c40ef2696ef59958df0e2444f4dc1c1e4594e9d62d1deea5d53807a51014cda
Opcode Fuzzy Hash: acf74200864e92307780ad0eb2a447404f9b82c358045633adafacd2e0b7016e
Instruction Fuzzy Hash: 8B21E3B5900248EFDB10DF9AD984AEEBBF4EB48310F14842AE954A7350D374A944CFA4

Function 07BB5320 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07BB53A0

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a581171e18c4086e1ba42b65be503663597b2e9c5e2ad3fd5a8a39a84e2cc02f
Instruction ID: faa7b90722d3acea8b003969bca244385169abccacd0bb533c3b564cb5c6dec9
Opcode Fuzzy Hash: a581171e18c4086e1ba42b65be503663597b2e9c5e2ad3fd5a8a39a84e2cc02f
Instruction Fuzzy Hash: B02128B18002599FDB10DFAAC880AEEFBF5FF48310F108429E959A7250C7789554CBA5

Function 07BB4828 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07BB48A6

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c43288b9eac77f9c31693ccd1ec310798979fb6fabd51509f052bbf2b961f672
Instruction ID: b7490f3c0d88da665da7d4edfd3dcf3ead045a0e5366fcd344bfe3fd7ce422bf
Opcode Fuzzy Hash: c43288b9eac77f9c31693ccd1ec310798979fb6fabd51509f052bbf2b961f672
Instruction Fuzzy Hash: 352138B1D002498FDB10DFAAC8857EEBBF4FF88324F148429D859A7241C7789944CFA4

Function 07BB5168 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07BB51DE

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 90676ba22bf197255ec754cb5417813fea69ac4f600a735e0178709d4781c046
Instruction ID: 71d62d6a7536126e5deab8d2c1f2644c4f52296973e6b065667b4eda3c188918
Opcode Fuzzy Hash: 90676ba22bf197255ec754cb5417813fea69ac4f600a735e0178709d4781c046
Instruction Fuzzy Hash: 2B116AB29002099FDB20DFA9C8457EEBBF5EF48320F108819D555A7250C7759954CF90

Function 07BB5170 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07BB51DE

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ae1348326b36f6e197881b9eb42f72707cd66ab45a267a4ca47b8e6e045540f9
Instruction ID: 62239c2a8e6c4c72724a61836bc01368618c0f1b6be3bc356fcb377e101017aa
Opcode Fuzzy Hash: ae1348326b36f6e197881b9eb42f72707cd66ab45a267a4ca47b8e6e045540f9
Instruction Fuzzy Hash: 7F116AB18002499FDB20DFA9C844BDEBFF5EF88320F108419D555A7250C7759554CFA1

Function 07BB4338 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07BB43A2

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d2bfbad6de14cd7ca2d788eaef9ca2e91fb4e4a8d930cb649a638aefb1d39dfa
Instruction ID: b52aa777dc2863c723bf878f2bbe5f3b503e1c911667e1491e2400f60ccfdbfd
Opcode Fuzzy Hash: d2bfbad6de14cd7ca2d788eaef9ca2e91fb4e4a8d930cb649a638aefb1d39dfa
Instruction Fuzzy Hash: 4C1188B19002498FDB20DFA9C5457EEFBF4EF88320F248829C459A7250C778A944CFA4

Function 07BB4340 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07BB43A2

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 79e2d38dffebb1a92b18861880c1f11f9e25f17967c7e4078ecff8b4246aa047
Instruction ID: 0e7202a03df92ba833d5b884873468c8d34f961c5f8364bffccc0aa29aa44ad0
Opcode Fuzzy Hash: 79e2d38dffebb1a92b18861880c1f11f9e25f17967c7e4078ecff8b4246aa047
Instruction Fuzzy Hash: 28116AB19003488FDB20DFAAC4447EEFBF4EF88324F248429C459A7250C774A544CF94

Function 0168B058 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0168B0BE

Memory Dump Source

Source File: 00000000.00000002.1746774840.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1680000_xJZHVgxQul.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 385d60347a75193434ab48b6cb39e421ce7f3a7a5a85fa91747c60f2e155c7ff
Instruction ID: 6c77764024898d816011229c99500d971a1c939c67d32d4db774039aa4f4fee6
Opcode Fuzzy Hash: 385d60347a75193434ab48b6cb39e421ce7f3a7a5a85fa91747c60f2e155c7ff
Instruction Fuzzy Hash: 8D1110B5C002498FDB10DF9AD844BDEFBF4EF88324F10852AD568A7210D379A545CFA1

Function 07BB62BC Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07BB969D

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 325cb9075d409465a47af028d062f66ae16c77751f9851732445bd72671456aa
Instruction ID: 4ef2403714a24c91e89432be8ef41b13a9ade305760b0e5c1a21df1dd874f227
Opcode Fuzzy Hash: 325cb9075d409465a47af028d062f66ae16c77751f9851732445bd72671456aa
Instruction Fuzzy Hash: C21136B5800309DFDB20DF8AC484BEEBBF8EB48320F108459E959A7210C375A944CFA4

Function 07BB9639 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07BB969D

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2a7b78b90c12af1600a6c631da106e56178ab1b06598980c1acf0355cf1e5d5f
Instruction ID: 59b1950228df43fee510368d66d33d998dd23e38fc597eab43974e56be8aeb97
Opcode Fuzzy Hash: 2a7b78b90c12af1600a6c631da106e56178ab1b06598980c1acf0355cf1e5d5f
Instruction Fuzzy Hash: F31115B6800319DFDB10DF99D585BEEBBF4FB08320F20885AD958A7250D374A684CFA5

Function 0579C998 Relevance: .7, Instructions: 736COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c3cb4d4e78feaa4bab02cdbfa0d1d2a75c8453c945fb5a6f840b9c2f9f42bac
Instruction ID: cbab2140aa02b880f4ee3573f6fb6b7613dc06b78e95c25e2dcc489e966daf34
Opcode Fuzzy Hash: 4c3cb4d4e78feaa4bab02cdbfa0d1d2a75c8453c945fb5a6f840b9c2f9f42bac
Instruction Fuzzy Hash: 8A721C319106098FCF15EF68D898AEDBBB1FF45300F448299D54AA7265EF30AAC5CF91

Function 0579DE60 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed324fd66d1cb7151912b8c124a1b9c4f12f2d5354f409d46d1244103ed06c2
Instruction ID: 09962027f3f86feee3d5480bc83cef4d4d687b1b58b2c46b53cc421a59faa1a0
Opcode Fuzzy Hash: 7ed324fd66d1cb7151912b8c124a1b9c4f12f2d5354f409d46d1244103ed06c2
Instruction Fuzzy Hash: 03221D30A10615CFCF18DF69D888A9DB7B6BF89300F5485A9D80AAB365DB30ED45DF60

Function 0579CAC8 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4004bf00189e8d916f7c8c5cb5f04ee1983a32f680a14b08eca3eb323ae2aa93
Instruction ID: d94fa003d1d24c753f8c1a06123ff29684c59f3ba9423e876f5dff73303c11f0
Opcode Fuzzy Hash: 4004bf00189e8d916f7c8c5cb5f04ee1983a32f680a14b08eca3eb323ae2aa93
Instruction Fuzzy Hash: D5120D319006198FDF25DF68D8986DDB7B1BF45304F408299D94AA7269EF30AEC6CF81

Function 0579BF10 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e5033a20a476c55bf896d1b00b5fbb5f851ba28601f812a65f63144cffe8b7
Instruction ID: 70b13ad45da8b39aac4d2d6ab3f24a317aed4bbf4184938e22c846121c604e70
Opcode Fuzzy Hash: 00e5033a20a476c55bf896d1b00b5fbb5f851ba28601f812a65f63144cffe8b7
Instruction Fuzzy Hash: A291177191060ACFCF05DF68D880999FBF5FF49310B14879AE819AB256E730E985CF90

Function 0579ED80 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f56fcfbac8e1b2522ab00fe5c86a42ad66606e4dd12d5e9272dfa380feccca6
Instruction ID: 95cc3ef375f7763d45842b6e08bf2d47eaa5c05873f490f6d38adde7812b7553
Opcode Fuzzy Hash: 7f56fcfbac8e1b2522ab00fe5c86a42ad66606e4dd12d5e9272dfa380feccca6
Instruction Fuzzy Hash: A9713D31B04658CFCF09DBB8D588AADB7F6BF89300F158569E806AB354DB719C41DB90

Function 0579DE31 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a0445686ee1da2b53550d42eaa6ddd4c07889c9d9cf0c8107a166f240c376c0
Instruction ID: 29fecb840e5094ad63974b6d7acb9ebccac8f734d2b8cfd6695bc8b3a3680b34
Opcode Fuzzy Hash: 1a0445686ee1da2b53550d42eaa6ddd4c07889c9d9cf0c8107a166f240c376c0
Instruction Fuzzy Hash: 826178307106008FCB19DF79D888BA9BBF6BF89310F4485BCD9469B3A1DB319849CB61

Function 0579E5C0 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fdc1d5a244a3b66d7317f931c44eb50948a94a72ee6f805ea785b38e411ec07
Instruction ID: a4f7ddd8ddbf4cdc8a0258c276e277e1fe1b812e3e63baf0626393eadcb72658
Opcode Fuzzy Hash: 7fdc1d5a244a3b66d7317f931c44eb50948a94a72ee6f805ea785b38e411ec07
Instruction Fuzzy Hash: BF51BE347042448FCF19DF69E8989AD7BFABF89604B1840ADD806DB3A1DB35EC01DB61

Function 0579B291 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac8ad0b9d441b204cee966cdc388e69170c8072e232561db73d4d23a1d6edb4
Instruction ID: 7781f9bd8d21b865fbb9fd6aa4eeecf3c3b066fd6b908defd577be642354e9f1
Opcode Fuzzy Hash: 8ac8ad0b9d441b204cee966cdc388e69170c8072e232561db73d4d23a1d6edb4
Instruction Fuzzy Hash: AC71BEB9700A00CFCB18DF29C588A59BBF2BF8920471589A9E54ACB772DB31EC45CB50

Function 0579B0B0 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3b1989d6c418d0656aafb365f995a0f66cf9f81c5ca2e8b0aab2d89935b79a
Instruction ID: 33c278914a184a62eba1b0f07e3446957fe18a453abf2d6b5b67ea9265500aa9
Opcode Fuzzy Hash: fb3b1989d6c418d0656aafb365f995a0f66cf9f81c5ca2e8b0aab2d89935b79a
Instruction Fuzzy Hash: B0718274A056068FCB58CF68E584999FBF1FF48314B1986A9E80ADB312D734EC85CF90

Function 0579ED70 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e29812b1114400a579aba2a746de36e7fe6a42d37e4c0bab662383feba77f7
Instruction ID: b3dcb3502e2c428c7c7beba37797a77b7106285f19167ff3ec9347331e380f90
Opcode Fuzzy Hash: 13e29812b1114400a579aba2a746de36e7fe6a42d37e4c0bab662383feba77f7
Instruction Fuzzy Hash: 1E518031B046588FCF05DBB8D5489ADBBF6BF89300F15816AE806AB360EB319C45DB90

Function 0579A5D0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edb3916cb3a85d729bfc7f11abee1c085c97593044b27e2b13a8b9812bde548
Instruction ID: e019251400d1fe4f65a6fa37da3ce4849459a2b15c22541ac20580555adc3ff6
Opcode Fuzzy Hash: 4edb3916cb3a85d729bfc7f11abee1c085c97593044b27e2b13a8b9812bde548
Instruction Fuzzy Hash: C4415C30A00709CFCB04EF78D89499DBBB6FF89304F008599E515AB365EB71AA46CB81

Function 0579EB54 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f202df9efdec0b61e826c97739e22577184bb8968d8c30d50f520aa34c04ba69
Instruction ID: a84f84094ef53f6a5d1112529444eb4d15073a639b915a93806b32e4c669decb
Opcode Fuzzy Hash: f202df9efdec0b61e826c97739e22577184bb8968d8c30d50f520aa34c04ba69
Instruction Fuzzy Hash: 40316E317001048FCF28EB7DE848AA977F6EF89725B1405BDE51ACB3A1DA31D805DB60

Function 0579A5E0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a073d8154bfa0aec0707f84a07b8309db2321c96215df9aeee8efff9b63155fb
Instruction ID: ebd20448118ae5e6ce82ecc3fbd75743b47f69d400abb6003521b7b58cc71606
Opcode Fuzzy Hash: a073d8154bfa0aec0707f84a07b8309db2321c96215df9aeee8efff9b63155fb
Instruction Fuzzy Hash: F0414E34A10709CFCB14EFB8D8949DDBBB6FF89304F008569E5156B325EB71AA45CB81

Function 0579A4C9 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81960be9cc05d42441ecee4f01ab74eb41e5616a0848896c8de87ed6585e8df
Instruction ID: 46eaca93743aac0a9ee35f3b06b1a866b8ff6ba3ebbc45e9fd295f2e759dea9c
Opcode Fuzzy Hash: b81960be9cc05d42441ecee4f01ab74eb41e5616a0848896c8de87ed6585e8df
Instruction Fuzzy Hash: 38316D35B01219DFCF09EF75E8588DCB7B6FF89614B058169E905AB360EB30AD45CB90

Function 0579F1E0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2756c301cbabc31c9011e46035f9e4f85fc4e030105c6e14d5e0ca4ccc4e03
Instruction ID: 06e3207f6d06597ecd49e4b2aec58dd55499c9c6fd18ac3fe0203554cb841c30
Opcode Fuzzy Hash: 3b2756c301cbabc31c9011e46035f9e4f85fc4e030105c6e14d5e0ca4ccc4e03
Instruction Fuzzy Hash: 7C312F75B005149FDF19DB59D848EAEB7F6EF8C720B1540A9E806EB361DA31EC00DBA1

Function 0579B09F Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a130b60a2000084853b9c99de45d2c24361b6dde7077a8ea09111fe8d44f43
Instruction ID: b9581c0c3b7ed038ed264f9638c289a5ae59149db9428654661b21c2953e56ec
Opcode Fuzzy Hash: 48a130b60a2000084853b9c99de45d2c24361b6dde7077a8ea09111fe8d44f43
Instruction Fuzzy Hash: 64410E75A04606CFCB19CF68E584AA9FBF1FF49300B1986AAD44ADB351D734EC45CB90

Function 0579E6CF Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87ffb41eabead0c8f5fbf77ab5ea87673a740bc6fb23b5a3bded919b27a86b56
Instruction ID: 52a6ab32d5f453cfd41fc47be4e19fdc888ae4c8d8b174280f7cd7191068fa72
Opcode Fuzzy Hash: 87ffb41eabead0c8f5fbf77ab5ea87673a740bc6fb23b5a3bded919b27a86b56
Instruction Fuzzy Hash: FE21A1347087808FCB1ADB79E89897D7FE6BF8621031884BED455CB362CE249C06D761

Function 015DD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746420625.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b1a32cb15caddd8efd59173d33b3e33a3d8c3954a21befda6f59f5f952b3579
Instruction ID: bbf7ea31cee21533ca2e2f2ea515f774901804341350aeda10b449474a5e8244
Opcode Fuzzy Hash: 7b1a32cb15caddd8efd59173d33b3e33a3d8c3954a21befda6f59f5f952b3579
Instruction Fuzzy Hash: CB213671100200DFDB21DF58C9C0B6ABFB5FB84324F20C569D9090F296C376E446C7A1

Function 015ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746484464.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a623a336e53ca1e716349d161cd8ccc818f75b7c910b7cf7fc8c703bd8d0d7
Instruction ID: 229e1e58534fc43a5691f11dbe20dadf5c6892678ba01baeea269dcd479dbe09
Opcode Fuzzy Hash: 44a623a336e53ca1e716349d161cd8ccc818f75b7c910b7cf7fc8c703bd8d0d7
Instruction Fuzzy Hash: 0F210071A04200DFCB19DF58D988B2ABFF5FB84314F28C969D80A4F256D33AD446CA61

Function 015ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746484464.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6428ec5b9f6846f36be8f9a902f921bc5b5894ae9cfc13cdb039d0cb98307ff
Instruction ID: c019297017bbe0e2b46b7f3fc742cd01e60653d686fb9792b9c55b888201bd51
Opcode Fuzzy Hash: e6428ec5b9f6846f36be8f9a902f921bc5b5894ae9cfc13cdb039d0cb98307ff
Instruction Fuzzy Hash: C8210775904200DFDB09DF98D5C8B2ABBF5FB84324F20C9ADD9494F296C33AD446CA61

Function 0579D4D8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4056e579cd52ab34416ae95ac995203f04f44054c1e0bc13c2b5a91c28075d2b
Instruction ID: 3366534b63258378df477cb24d205e3947d94ecf34cc1b78daf3c170475f8e7f
Opcode Fuzzy Hash: 4056e579cd52ab34416ae95ac995203f04f44054c1e0bc13c2b5a91c28075d2b
Instruction Fuzzy Hash: 7E215032A106099FCB11EF6DD84099DFBB5FF99310B50C26AE958A7200EB30E994CB91

Function 0579F1D1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e3afefa7578844a77f1c6c8d258363e4f0d2aa22760bcd5303d1c78d861b78
Instruction ID: 0cea22fccf7fcbd492824ee9f19062373c7415c411527e23bd6b74b08e49348b
Opcode Fuzzy Hash: c1e3afefa7578844a77f1c6c8d258363e4f0d2aa22760bcd5303d1c78d861b78
Instruction Fuzzy Hash: 57118476B045049FCF18DA59E848DAAB7F5FF8D320B1140B9E909E7361DA31EC01DBA0

Function 057970F4 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 222da0dedd40dd74ee2e13eb228dabe2302fb7a267ae356c21fc96130fa16815
Instruction ID: 01e9387556d71bdd1b3b449e84d90a6fc7d225bc0d74c5b1802d5a1afbac6645
Opcode Fuzzy Hash: 222da0dedd40dd74ee2e13eb228dabe2302fb7a267ae356c21fc96130fa16815
Instruction Fuzzy Hash: 2D1186353446018F9F3CDA2AE89497A73EAEFC77213194479E447C7660DA60D841E7A0

Function 015ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746484464.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdc5a824239b9923495965f02a2e176570f9fee3bb4052382dcda8c21f9d12b
Instruction ID: 6f0424496060c4706102e01591a8a5aecba412e0d2977a4b18cbe2d1a7bbf707
Opcode Fuzzy Hash: 9bdc5a824239b9923495965f02a2e176570f9fee3bb4052382dcda8c21f9d12b
Instruction Fuzzy Hash: 69219F755093808FDB07CF24D994715BFB1FB46214F28C5EAD8498F2A7C33A980ACB62

Function 0579FCD0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af7c92a2e8cb426bb44d1a5f749db38eb6b61b0f52e19e2ca8c66c55d2d41171
Instruction ID: f2800586a30b3c93437b5c44ebd2f9a6dce33f6ed99ff3d9a26dd6a719554654
Opcode Fuzzy Hash: af7c92a2e8cb426bb44d1a5f749db38eb6b61b0f52e19e2ca8c66c55d2d41171
Instruction Fuzzy Hash: 0C11A731314A154FD725EB24E851B5FBBDBFBC9700F14852ED187C7785DAB0A5018B91

Function 0579ECE5 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3437dc376dac54f771f8ce05d622b24dbbab1b26ba4d9d3bd383196554e173
Instruction ID: 9cd801679fbb15b52a16305ae68728800415abc007ae779d0bc987b729791a6c
Opcode Fuzzy Hash: fe3437dc376dac54f771f8ce05d622b24dbbab1b26ba4d9d3bd383196554e173
Instruction Fuzzy Hash: 5711A931709A604FCF1ED738E41C56D3BA9AF8791075945EADC45CB362EA25CC0293F1

Function 015DD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746420625.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 4cc11a8ca034a8a9964099dbf87e5e2ede88f5ace7b06aeb4285694e06eabedd
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: DF11DF72404240DFDB12CF48D5C4B5ABF71FB94324F24C2A9D9090F256C33AE45ACBA2

Function 0579FCE0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1435489163593faf8607d007909c434b4c21cab55872475275985e8fbd65016
Instruction ID: 0b8f1d96b76098b71ce59eb00832456bcdb687ef1b5d01cc4ec1395c5a6de3f5
Opcode Fuzzy Hash: c1435489163593faf8607d007909c434b4c21cab55872475275985e8fbd65016
Instruction Fuzzy Hash: 3C118031314A114FE735AA68D891B5FBBDBFBC8B10F10462DD287C7788DAB5A9414B90

Function 0579F590 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894e7dfad47f11ee93149572a19b594176be807f281f19d4a0d74b3d4d41a4b7
Instruction ID: 1a338ce5bea0e43359277317de9c5e99bd5844e0eb0b1306c53a3ba648fbf8ad
Opcode Fuzzy Hash: 894e7dfad47f11ee93149572a19b594176be807f281f19d4a0d74b3d4d41a4b7
Instruction Fuzzy Hash: B9116772A00B5287EB009F6DE844281B365FF95324F1A877ACD4D3F302EB71798487A0

Function 0579FF30 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36a61e8d585264956ed08ff8e3eba283029d2d60426937b4696217d5fbd1f3f
Instruction ID: 9c89f96914f2d280326fa494f7407c20782b77d7b9d57bbd785e7980dda36735
Opcode Fuzzy Hash: d36a61e8d585264956ed08ff8e3eba283029d2d60426937b4696217d5fbd1f3f
Instruction Fuzzy Hash: BB0192B13083848BDF1EE775A50476AB7EBAF46245F04006DD90BC2285EF34C841E775

Function 015ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746484464.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: a570c9cd2bee0fa4d5ae8d94bbd9a5307726d85d150342f19139aa2894bfdb13
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: FE118B75904280DFDB16CF54D5C8B19BFB1FB84224F24C6AAD8494F696C33AD44ACB61

Function 0579F58F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98f72a77f2f09139b346e831af2f9cd9308bae4b889eebf2d1fcabc8869cb79
Instruction ID: 30370fcaf79a65596038a5f78aaf78b6c589faf2195aa8e51787d21d4b34cd6c
Opcode Fuzzy Hash: e98f72a77f2f09139b346e831af2f9cd9308bae4b889eebf2d1fcabc8869cb79
Instruction Fuzzy Hash: AE114972E00B5286EB00DF6CE844281B365FF95324F1A8B7ACD4D3F356EB75698487A0

Function 015DD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746420625.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dccb3145a14d87e506ff31c10cb068346be0196c54a77e5c7db2f5e442291ee5
Instruction ID: d52c89bbeccc02aa0094f37cc5fdc3ca928254be6d6f432fc430c7676e7a3315
Opcode Fuzzy Hash: dccb3145a14d87e506ff31c10cb068346be0196c54a77e5c7db2f5e442291ee5
Instruction Fuzzy Hash: 3B01FC310053809AE7308E5DCD8475BBFE8FF41324F08C969ED090E1C6C2399440C7B1

Function 0579AFDF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4247b8057d2d26acaed2bdcdf4f91b6895bdfa0015c8f7ae537e4304a68eaf27
Instruction ID: 19e2434c456491c4e704ddd1b76566caef84f9ab0331716a57104318dffa5ea2
Opcode Fuzzy Hash: 4247b8057d2d26acaed2bdcdf4f91b6895bdfa0015c8f7ae537e4304a68eaf27
Instruction Fuzzy Hash: DCF0C8B23047415FCB159F6DB89885ABFEAEFC9220305857AF10ACB321CE61DD4A9760

Function 0579A818 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17cf1396c5d9b73cc2ad7c7608ca333840e164418cadc67c8afbe7d0d573adea
Instruction ID: 5b8b0181f3cfa84bb7bf1b01e409bccc01f6b8a60c3b4ab38b444450a34c1484
Opcode Fuzzy Hash: 17cf1396c5d9b73cc2ad7c7608ca333840e164418cadc67c8afbe7d0d573adea
Instruction Fuzzy Hash: 89014031A01B048FDB29EF35D44499A77B6FF85340B50C56ED5464B360EB31D982DB50

Function 0579ABDB Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1799614a724d7668c810736b2481196a73105f4e4cc8634075e8d2dacab09593
Instruction ID: eee2696d325d6b38ef49b61b491931692d6824327dda7565959d5e14c40d1765
Opcode Fuzzy Hash: 1799614a724d7668c810736b2481196a73105f4e4cc8634075e8d2dacab09593
Instruction Fuzzy Hash: 0501D6317047008BEF197674A4095FE7772AFC2211F08456DD6455B350DF30D98297E1

Function 0579DC5F Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4b9b799b50d499b082eed109fd10a48157c61280d20444a219fbb3f6eae27bd
Instruction ID: 48479951b0ddc49d07693c4d21a0972b4f9a00dbf8db6a78b21c18d37e9adcb1
Opcode Fuzzy Hash: c4b9b799b50d499b082eed109fd10a48157c61280d20444a219fbb3f6eae27bd
Instruction Fuzzy Hash: BBF0BB353046104F8F2D9F2AE944D3677E9AF9761131A44A9E806CB371DAA0DC41E7F4

Function 0579A808 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44503ded277d2f59ba6761883ae90ba1cfd11ae04a43e61f397150fbee1068f4
Instruction ID: f1af745ed5b16540b28716296e40b94a71be459695928623201b57f06d64e8b2
Opcode Fuzzy Hash: 44503ded277d2f59ba6761883ae90ba1cfd11ae04a43e61f397150fbee1068f4
Instruction Fuzzy Hash: DD017131A01B048FDB19DF35D10469A77B2AF85300F54856DD5469B3A0EB30D982EB50

Function 0579B047 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 470ee6920c51afeab97ec8d716ca808527b1b18d6fe4f6af534dd1a12ca45270
Instruction ID: 59bca7f1fd153953d9177dc490aa9b8e1707d9ffea5921722e9db2959c2723cb
Opcode Fuzzy Hash: 470ee6920c51afeab97ec8d716ca808527b1b18d6fe4f6af534dd1a12ca45270
Instruction Fuzzy Hash: A50119302146548FCB198B2CD598E587BF5EF0A61570644E9E94ACB7B2CB72EC45CB50

Function 0579ABE8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5ab875cf3b90826ee713678d5e0c51693e234fd989aa84f6be21458d537aee
Instruction ID: 96f1c15042ecd5054a083e7c6d3493e16862c6f187578a4b9ac1dbaefc63a8e9
Opcode Fuzzy Hash: 8c5ab875cf3b90826ee713678d5e0c51693e234fd989aa84f6be21458d537aee
Instruction Fuzzy Hash: 50F0C2317047048BEF197A79A4084EFB776EFC1211F04466DDA4527250EF30A58197E5

Function 015DD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746420625.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7a7a7ee2f98e62b221a3b8909195e33be74331c301a8ffff186b08f55adfd0
Instruction ID: 7aedb94d55d67c400c8b311dda8bac4bc3eed0217f154c4a37faf9324651ff46
Opcode Fuzzy Hash: 4c7a7a7ee2f98e62b221a3b8909195e33be74331c301a8ffff186b08f55adfd0
Instruction Fuzzy Hash: 2FF062714053849AE7218E1AC8C8B66FFA8FB51734F18C45AED084F286C2799844CBB1

Function 0579AC68 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1bf6b58380bfcc1f7041521d97891a55bba6f0796a9b3741d10e3df203ea86
Instruction ID: 0a604bf6e75a31402c47fd45aac3461a8a02363f1e2e0a8ca8288cffe6ab6183
Opcode Fuzzy Hash: 1d1bf6b58380bfcc1f7041521d97891a55bba6f0796a9b3741d10e3df203ea86
Instruction Fuzzy Hash: 93F0B4313006108FCB25AB29E84492AB7BBFFC9321759056EE40A8B360DF35AC46C794

Function 0579FDB8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 624df947baa5b62be80a30b179a6b0327c24d5b2a9dcbe422878218ef2074604
Instruction ID: 6f9463991fdcc3010d9959accec4898e593a90f503dacf692eac7dd1f2a415dd
Opcode Fuzzy Hash: 624df947baa5b62be80a30b179a6b0327c24d5b2a9dcbe422878218ef2074604
Instruction Fuzzy Hash: 88F0F636A046699FCF12DF29D8089DABFF4EB85210F0584A6D885D7241D7306A09CBA1

Function 0579AC67 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adfce1fde677ff21db6e86cf8f9a0453b76770e34faf3ddee29af463010e413a
Instruction ID: bfe2dd43175621fa2b10eb9f49be4177811dce538797492d53a2fe651f94988c
Opcode Fuzzy Hash: adfce1fde677ff21db6e86cf8f9a0453b76770e34faf3ddee29af463010e413a
Instruction Fuzzy Hash: 30F0B4313006108FCB25AB29E444929B3B7FFC8321719095EE40A8B760DB35AC46C790

Function 0579B058 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d67f5364090c073963e49dbd69ae18096b8d4994f76f30facebc8a0d5b4b77f
Instruction ID: 43f3105b00abb7983a686dae1a334e74f6b0e79b705adbe39802f112acfdfbaa
Opcode Fuzzy Hash: 7d67f5364090c073963e49dbd69ae18096b8d4994f76f30facebc8a0d5b4b77f
Instruction Fuzzy Hash: 52F0DF34240610CFC718DB2CE598D59BBE6FF49B1971185A9E10ACB372CB72EC40CB80

Function 0579F2DE Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76efb86478ed585aa3c42f5ad032f6160e85d6d8c10c8dcfeb221de0f3c143d
Instruction ID: 30dc6911db46470e4527f7a7c49a355580e6fdf0d686f8bc37f4175223388bba
Opcode Fuzzy Hash: b76efb86478ed585aa3c42f5ad032f6160e85d6d8c10c8dcfeb221de0f3c143d
Instruction Fuzzy Hash: 27E0ED357001049FCB08CF5DD484DAEF7F5FB8C324B2140A9E519D7321E6319D05CA50

Function 0579FDC8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ee50bb065c664d8edb75d1c533df0a7b817d603a4094666165896a75fca222
Instruction ID: 966d7695c30d3e2c9016eba65d7efd235a7d8b333ff5d0de5b79c8b2fb576767
Opcode Fuzzy Hash: 09ee50bb065c664d8edb75d1c533df0a7b817d603a4094666165896a75fca222
Instruction Fuzzy Hash: A2E06535A101299FCB14DA6DE8085DEB7F4FB84311F004565D956D3344D7306A19CF90

Function 0579FCB0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0c414975f741c5ad68f201b234d109336f8e75fdcd3dda4b7a77eff68645a3
Instruction ID: bf3111283737ef50699cc34243e3f4a5028ce8c65eca76b5e98177377adddf00
Opcode Fuzzy Hash: 9a0c414975f741c5ad68f201b234d109336f8e75fdcd3dda4b7a77eff68645a3
Instruction Fuzzy Hash: 27E0C26A51A7845EDF0B9B389008790BFA1BB13295F6AD9DBC4804E053C76A140EAB62

Function 0579FD93 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3014211d34d1189477bc5bd54b5c4c868c4c5aa400937c0883da00f435c30208
Instruction ID: 9809b546c016261c8de7eedd4731dd7c7ddbacd80f1d6dac6656dc520c5362c6
Opcode Fuzzy Hash: 3014211d34d1189477bc5bd54b5c4c868c4c5aa400937c0883da00f435c30208
Instruction Fuzzy Hash: 2DC08CB34083A086EB24DF24E486381AAE4CF90200F0DC8BD8C9587786E138C801D790

Non-executed Functions

Function 07BB26F8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2538afab48dee65720bdffb6bf2e9f8ebb6ac5fbfd9ecc34201a8f9da473230
Instruction ID: 3caf2e50a31757283055331556fb82571db4880dada969fe43b5bd7ed218e607
Opcode Fuzzy Hash: a2538afab48dee65720bdffb6bf2e9f8ebb6ac5fbfd9ecc34201a8f9da473230
Instruction Fuzzy Hash: 8DE1EAB4E001198FDB24CFA9D5849AEBBF2FF89304F2481A9D814AB355DB74AD41CF61

Function 07BB4D38 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de9785e6ac440441eade4a85538c83e92dbe4cc1213730d4e3c2a3e75f4cd4ae
Instruction ID: fbba86afe803c5ce6fc7882e7c79de7f83b68c64ed039e04a769b71019ad9a65
Opcode Fuzzy Hash: de9785e6ac440441eade4a85538c83e92dbe4cc1213730d4e3c2a3e75f4cd4ae
Instruction Fuzzy Hash: CDE1E9B4E001598FDB24CFA9D5809AEBBF2FF89304F248199D818A7356DB70AD41CF61

Function 07BB43F0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cbbc9900d267c6bc04efbdbe1ef17078486eab41b72240888dd6acb3101b0ed
Instruction ID: bf87905026a1cd1f17df28aa73fcacb7a635503f7f325947ae882b425e4d7844
Opcode Fuzzy Hash: 2cbbc9900d267c6bc04efbdbe1ef17078486eab41b72240888dd6acb3101b0ed
Instruction Fuzzy Hash: 73E1EAB4E001598FDB24CF99D5849AEBBF2FF89304F2481A9D815AB356DB70AD41CF60

Function 07BB22C0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a447ff108b321dfa5ec4bfed6c5a264fa2786bdd193fc8523d7b150d8fa5f141
Instruction ID: a1e13aa8541b6aff58aceb9a744194162dd1749ccf83f6574dde8e88af661fb7
Opcode Fuzzy Hash: a447ff108b321dfa5ec4bfed6c5a264fa2786bdd193fc8523d7b150d8fa5f141
Instruction Fuzzy Hash: FAE1E8B4E001198FDB24DF99D5809AEBBF2FF89304F2481A9D815AB356DB70AD41CF61

Function 07BB4900 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09541727e8625f840acfd390ba7998f853506d56cd18010b8b6911b2bdcd5e73
Instruction ID: fe20a4d73bba69fa867664bc6954f8045fc123beca48200d0e8aa23d2cdce36e
Opcode Fuzzy Hash: 09541727e8625f840acfd390ba7998f853506d56cd18010b8b6911b2bdcd5e73
Instruction Fuzzy Hash: 7DE1DBB4E001598FDB24CFA9D5809AEBBF2FF89304F248199E814A7356D771AD41CF61

Function 0168D424 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746774840.0000000001680000.00000040.00000800.00020000.00000000.sdmp, Offset: 01680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1680000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab83b400220efa01e467e66e4477b27ae9b23b81b05c22fd83bfd95d0d05ccd
Instruction ID: 7c624b8b6d387772828a9457d7b2e8cd0088b065fa1420267663a53b5b5b13b6
Opcode Fuzzy Hash: 7ab83b400220efa01e467e66e4477b27ae9b23b81b05c22fd83bfd95d0d05ccd
Instruction Fuzzy Hash: 87A18032E002168FCF15EFB4CC8059EBBB2FF85301B1586AAE905AB265DB75D955CF40

Function 07BB43E0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768128457.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bb0000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1f03bcec7e6f97e41a82ec40750717333e1a18cb7d5989b24f37f59cceca7c
Instruction ID: 333bba7c5a7eff13523d1e222e8b6387e8bc763ce4bf634b6923704eaa4d0110
Opcode Fuzzy Hash: 5a1f03bcec7e6f97e41a82ec40750717333e1a18cb7d5989b24f37f59cceca7c
Instruction Fuzzy Hash: CD5119B4E006198FDB14CFA9D5855AEFBF2FF89304F2481A9D818A7216DB309941CFA1

Function 05791418 Relevance: 41.7, Strings: 33, Instructions: 441COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05791817
4'^q, xrefs: 0579174D
4'^q, xrefs: 05791843
4'^q, xrefs: 057919A3
4'^q, xrefs: 0579167B
4'^q, xrefs: 057918F3
4'^q, xrefs: 0579194B
4'^q, xrefs: 0579172A
4'^q, xrefs: 0579191F
4'^q, xrefs: 057919CF
4'^q, xrefs: 057916C1
4'^q, xrefs: 05791977
4'^q, xrefs: 0579151D
4'^q, xrefs: 05791770
4'^q, xrefs: 057918C7
4'^q, xrefs: 05791586
4'^q, xrefs: 057916E4
4'^q, xrefs: 0579169E
4'^q, xrefs: 05791793
4'^q, xrefs: 05791612
4'^q, xrefs: 057917EB
4'^q, xrefs: 05791563
4'^q, xrefs: 057915EF
4'^q, xrefs: 05791707
4'^q, xrefs: 057915CC
4'^q, xrefs: 05791540
4'^q, xrefs: 057917BF
4'^q, xrefs: 0579189B
4'^q, xrefs: 057915A9
4'^q, xrefs: 05791658
4'^q, xrefs: 05791635
4'^q, xrefs: 057914FA
4'^q, xrefs: 0579186F

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
API String ID: 0-2697097662
Opcode ID: f3899aa6f9c5855c92096b06eff87caacdae33f0e946c5b6d6283acd8e9c0d6a
Instruction ID: be82fdba9e89235927d022a6790ab353ef69a74b7ce865c8eb622bd4533dc7ef
Opcode Fuzzy Hash: f3899aa6f9c5855c92096b06eff87caacdae33f0e946c5b6d6283acd8e9c0d6a
Instruction Fuzzy Hash: 4C12F470E0121A8FCB58EF79E89469DB7B2FF90304F5045A9D049AB268EF306D4ACF51

Function 05791428 Relevance: 41.7, Strings: 33, Instructions: 434COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05791817
4'^q, xrefs: 0579174D
4'^q, xrefs: 05791843
4'^q, xrefs: 057919A3
4'^q, xrefs: 0579167B
4'^q, xrefs: 057918F3
4'^q, xrefs: 0579194B
4'^q, xrefs: 0579172A
4'^q, xrefs: 0579191F
4'^q, xrefs: 057919CF
4'^q, xrefs: 057916C1
4'^q, xrefs: 05791977
4'^q, xrefs: 0579151D
4'^q, xrefs: 05791770
4'^q, xrefs: 057918C7
4'^q, xrefs: 05791586
4'^q, xrefs: 057916E4
4'^q, xrefs: 0579169E
4'^q, xrefs: 05791793
4'^q, xrefs: 05791612
4'^q, xrefs: 057917EB
4'^q, xrefs: 05791563
4'^q, xrefs: 057915EF
4'^q, xrefs: 05791707
4'^q, xrefs: 057915CC
4'^q, xrefs: 05791540
4'^q, xrefs: 057917BF
4'^q, xrefs: 0579189B
4'^q, xrefs: 057915A9
4'^q, xrefs: 05791658
4'^q, xrefs: 05791635
4'^q, xrefs: 057914FA
4'^q, xrefs: 0579186F

Memory Dump Source

Source File: 00000000.00000002.1755432033.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
API String ID: 0-2697097662
Opcode ID: 0694811388147e9b2a5ad113ed2d037e71e589becea0fbce9a786a498e88bced
Instruction ID: 49fa8bdc69b095a4c29098e94a1d96647664822c018f1ade9d29c61c209e296d
Opcode Fuzzy Hash: 0694811388147e9b2a5ad113ed2d037e71e589becea0fbce9a786a498e88bced
Instruction Fuzzy Hash: F812F370E0121A8FCB58EF79E89469DB7B2FF90704F504569D049AB268EF306D4ACF91

Analysis Process: xJZHVgxQul.exePID: 7276, Parent PID: 6508COMMON

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	5

Executed Functions

Function 06692358 Relevance: 9.0, Strings: 6, Instructions: 1487COMMON

Download Yara Rule

Strings

$^q, xrefs: 0669374B
$^q, xrefs: 06693722
$^q, xrefs: 0669373F
$^q, xrefs: 0669376F
$^q, xrefs: 06693763
$^q, xrefs: 06693716

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: c72cea350e546619dfcf14881e5d3b0157c893b48920f8b4316bb11f2c993e12
Instruction ID: 02d5a1ec0752f76d0ef430fe088ab6ad92bb7033526d570f084399019129a6b2
Opcode Fuzzy Hash: c72cea350e546619dfcf14881e5d3b0157c893b48920f8b4316bb11f2c993e12
Instruction Fuzzy Hash: 7CD27B34E10209DFCB64DF68C594A9DB7B6FF85314F1485A9D809AB364EB30ED86CB90

Function 06697D68 Relevance: 3.0, Strings: 2, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0669830F
$^q, xrefs: 06698303

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 3118586323b26e19e3e918e9da0cc0d603f3c64fcaaa3210bae4e4291504f7dd
Instruction ID: 19a6295dc8cded14ad491e794fd6cc260ba380011ba70c993aec54ead0e4f51c
Opcode Fuzzy Hash: 3118586323b26e19e3e918e9da0cc0d603f3c64fcaaa3210bae4e4291504f7dd
Instruction Fuzzy Hash: 3902AD30B102098FDF54DF68D590A6EB7E6FF85314F148929D80ADB394DB35EC868BA1

Function 066965E0 Relevance: .8, Instructions: 807COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0759381955af63a4121e0f5fe7b6c1ab0d0ca9a19fdb97eaa1e3d1b6e2584156
Instruction ID: 7cd1bf598746804cc1526b143703a757db4a0cda65b086ba4220d60508d9fd78
Opcode Fuzzy Hash: 0759381955af63a4121e0f5fe7b6c1ab0d0ca9a19fdb97eaa1e3d1b6e2584156
Instruction Fuzzy Hash: 2D62AF34B102049FEF54DB68D594AAEB7F6EF84314F148469E80ADB394DB35EC46CBA0

Function 06695588 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fbad539183b5af5bb3594720c9dce88914fe733dd6f79aedd5dea123fe3d3c
Instruction ID: 097678002b4c341fe4e14cbde0f577e925081a451f93a82de20eb9390a899bc0
Opcode Fuzzy Hash: 08fbad539183b5af5bb3594720c9dce88914fe733dd6f79aedd5dea123fe3d3c
Instruction Fuzzy Hash: B922E131F002189FDF65DB68C5907AEBBB6EF85310F248469D85AAB344DB31DD42CBA1

Function 0669B20F Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1864c81a89962712a1d3b82302bce15ff6a199bbf1d6b163c3fab60a4e4f2d7e
Instruction ID: 33d073fb1e5fd8b5d00f76145bb795308146570d60376f4aee08eaa5d7af937d
Opcode Fuzzy Hash: 1864c81a89962712a1d3b82302bce15ff6a199bbf1d6b163c3fab60a4e4f2d7e
Instruction Fuzzy Hash: 30229430E101099FDF64DB68E5847AFB7EAEB85710F148826E809EB395CA35DC81CB61

Function 0669ACB8 Relevance: 10.4, Strings: 8, Instructions: 391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0669AE90
$^q, xrefs: 0669AE67
$^q, xrefs: 0669ADE5
$^q, xrefs: 0669AE38
$^q, xrefs: 0669AE2C
$^q, xrefs: 0669ADD9
$^q, xrefs: 0669AE5B
$^q, xrefs: 0669AE84

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: ca207ef94e524d4684b0b16c5f6ad4180189c0396897529bcd7126675e51139b
Instruction ID: 94632ea699b54e6ad915e76bcb2e0a352a427405063ad402854c5a14499218ed
Opcode Fuzzy Hash: ca207ef94e524d4684b0b16c5f6ad4180189c0396897529bcd7126675e51139b
Instruction Fuzzy Hash: 69E14D30E1020A8FDF69DFA8D4846AEB7F6EF85304F208529D805EB354DB75D846CBA1

Function 0669B630 Relevance: 8.0, Strings: 6, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0669BBA3
$^q, xrefs: 0669BB6F
$^q, xrefs: 0669BB63
$^q, xrefs: 0669BBCB
$^q, xrefs: 0669BB97
$^q, xrefs: 0669BBD7

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 79f0e2e821afdb388f794c1b4fb049bee07e849729af08f7028483a4a8bbdebd
Instruction ID: ca05916162f5023d433b11a9be1d85b76011df33a94acac49f11f5cbd37e186b
Opcode Fuzzy Hash: 79f0e2e821afdb388f794c1b4fb049bee07e849729af08f7028483a4a8bbdebd
Instruction Fuzzy Hash: 0C027F30E102098FDF64DF68E5846AEB7B5EB85310F14856AE809DB395DB70EC46CBA1

Function 06699138 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0669918B
$^q, xrefs: 0669917F
$^q, xrefs: 066991BA
$^q, xrefs: 066991C6

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: ff31dad1748d173eec82ae3efe7ac2539b03aaa6469d8923ee63d9e554570022
Instruction ID: 6387df3f38ff64483ed2cb9eb100ea166a03e664e4d881020a4fc7bc74aa2ae5
Opcode Fuzzy Hash: ff31dad1748d173eec82ae3efe7ac2539b03aaa6469d8923ee63d9e554570022
Instruction Fuzzy Hash: C1915130B1020A9FDF54DF65D9507AEB3F6FB89344F148569C80DEB388EA709D468BA1

Function 0669CF28 Relevance: 4.5, Strings: 3, Instructions: 798
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0669D31F
$^q, xrefs: 0669D333
$^q, xrefs: 0669D327

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 35ee93ba5882fc8a3af0a83fe8b0a415018409663d6961fbdb63868dea1984d9
Instruction ID: be2075d6fc1ce4a2e10ba6cc5eb43319dbb88a5f5a8241e8ce7fa10119ec3372
Opcode Fuzzy Hash: 35ee93ba5882fc8a3af0a83fe8b0a415018409663d6961fbdb63868dea1984d9
Instruction Fuzzy Hash: A4624E30A006069FCB55EF68D590A5EB7B2FF84304F248939D4099F369DB71ED8ACB91

Function 06694B50 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ocq, xrefs: 06694D07
XPcq, xrefs: 06694C7D
fcq, xrefs: 0669525D

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 02ff978bd1f42900db3a42061b7d5889cba4f9ea249c2937cb39b44db1903ab3
Instruction ID: 7c045c0c3b326451de10f13e5dd77659d3f475633ace2ecfda403ca4b830dacb
Opcode Fuzzy Hash: 02ff978bd1f42900db3a42061b7d5889cba4f9ea249c2937cb39b44db1903ab3
Instruction Fuzzy Hash: 80617330F002089FDF549FA8C4547AEBAF6EF88700F208429D506EB395DF754D468BA5

Function 06699127 Relevance: 2.7, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0669917F
$^q, xrefs: 066991BA

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: d883da8fb3f331983044d1c11c04689d0bf5691b6627a50a406ec79094d52a89
Instruction ID: 59caef9d28ea7853113160f1fc09bc8761104a5880feabd47a6036814cbd9f98
Opcode Fuzzy Hash: d883da8fb3f331983044d1c11c04689d0bf5691b6627a50a406ec79094d52a89
Instruction Fuzzy Hash: 95513F30B101099FDB54DB65D990B6E73FAEB89744F148569C809EB388EA309C43CBA6

Function 0107EC07 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0107EC87

Memory Dump Source

Source File: 00000008.00000002.2966564210.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1070000_xJZHVgxQul.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2fe6bda9926c0fa2dc3c592e5880246148fd3311404932f6040761c8fcbe69fd
Instruction ID: 2f8fbc05d6109f9174351a1a4cd70e5d76ee384f4565b561bc5cbaf39fa27c71
Opcode Fuzzy Hash: 2fe6bda9926c0fa2dc3c592e5880246148fd3311404932f6040761c8fcbe69fd
Instruction Fuzzy Hash: 181142B2C006599FCB10CFAAC5447DEBBB4AF08320F20816AD518B7251D338A945CFA4

Function 0107EC20 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0107EC87

Memory Dump Source

Source File: 00000008.00000002.2966564210.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1070000_xJZHVgxQul.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2dd54e53cc045db8e1f3b24613cb8453a7cf380c169e836933d207d2a0a7b98d
Instruction ID: ea380493593971d28e98a7961d37ddff7591f438bfee0d0b6ca4a650fec0cdd4
Opcode Fuzzy Hash: 2dd54e53cc045db8e1f3b24613cb8453a7cf380c169e836933d207d2a0a7b98d
Instruction Fuzzy Hash: 5411EFB1C006699BCB10DF9AC544BDEFBF4EB48320F14816AD858A7251D378A945CFE5

Function 06694B40 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

XPcq, xrefs: 06694C7D

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: XPcq
API String ID: 0-714321711
Opcode ID: 4a63b7f263b733ced207312abf6e93628aa9532b95281a6d0d65df341ece236f
Instruction ID: 1816a9fdc43d1313131672fba24e807e4a49a8777c72ffaae6b42421c41db4d7
Opcode Fuzzy Hash: 4a63b7f263b733ced207312abf6e93628aa9532b95281a6d0d65df341ece236f
Instruction Fuzzy Hash: EC416231B002089FDB459FA9C454BAEBBF6EF88700F208529E505EB395DF758C06CBA5

Function 0669DAB0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0669DBF9

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 65331c335fe02f72c446d120af0390a8d19994165d7f14080825b8d026711ca5
Instruction ID: a73cc371de5be02a7e4af5eadd03248cb8e9d1650ff7bbf39aaa686733a21315
Opcode Fuzzy Hash: 65331c335fe02f72c446d120af0390a8d19994165d7f14080825b8d026711ca5
Instruction Fuzzy Hash: 1A418C70E007099FDF559FA5C8946AEBBB6AF85300F204429D805EB344EB719946CBA1

Function 0669DA9D Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0669DBF9

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: f31fccc1cb869fda4b16a022a1237f8e9c871bd4ddc6d577b6a84aaed9f66f81
Instruction ID: c459f66dab8f3e328d058d8cf70a9341e6c600c6de06e34a0668390716001885
Opcode Fuzzy Hash: f31fccc1cb869fda4b16a022a1237f8e9c871bd4ddc6d577b6a84aaed9f66f81
Instruction Fuzzy Hash: 06419D70E007059FDF11DFA5C8906AEBBB6BF86300F14452AE805DB344EB74D946CBA1

Function 066921BD Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0669230B

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 8ec908df83e45e540904b6c9a18172f1058903de648bcb8eb32397b11e5f4a01
Instruction ID: 4e78f43d20567a7c8fcf820f312847e34406f04d508bd127f70eb53793f25404
Opcode Fuzzy Hash: 8ec908df83e45e540904b6c9a18172f1058903de648bcb8eb32397b11e5f4a01
Instruction Fuzzy Hash: 0531E330B202019FDF45AB74C56476E7BAAAF86700F248428D806DB395DF75DE46C7B1

Function 066921D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0669230B

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 2edbff61ab50229574b831a1f94299e881df75d526052e06d91e5d3358260926
Instruction ID: dd6b8f223ee840f389ab2527ec37a038697ef8ebaea329426f13932aa7c584ef
Opcode Fuzzy Hash: 2edbff61ab50229574b831a1f94299e881df75d526052e06d91e5d3358260926
Instruction Fuzzy Hash: 4931D030B202019FCF45AB74C52466F7BAAAF89700F204428D806DB395DF36DE46C7B5

Function 066982DE Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$^q, xrefs: 06698303

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: c0836775f66461399fa3ff70667b9dc66ba79015f031d06d4d8e6415167509e4
Instruction ID: 02d78e6c83cfe1de3f2bf0024928a8e075da35242eaa01e5aa7bc286b9bc6e4c
Opcode Fuzzy Hash: c0836775f66461399fa3ff70667b9dc66ba79015f031d06d4d8e6415167509e4
Instruction Fuzzy Hash: 7FF0A036E14204DBDF645EE5E9402B873ACEB42290B040C6ECD00C7244C735CE16C6B0

Function 0669C170 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467004d7ace14685abad6c05ce5e2a131dbd4ecdbd1e935d276ec707cefd5a16
Instruction ID: ffdad15da10fa2b77f529330fc77a2437c5213925257c0083aa375e58d0d99a8
Opcode Fuzzy Hash: 467004d7ace14685abad6c05ce5e2a131dbd4ecdbd1e935d276ec707cefd5a16
Instruction Fuzzy Hash: 9132B534B102099FDF54DB68D980BAEB7B6FB88310F108529E805DB394DB35EC46CBA1

Function 066961E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239755902d479be49fec2a674b2b915e74fd25ac68445c7aadc7534b8b99ff15
Instruction ID: f58f4092c543a9ac267cf395690d6ea9c618ec8165b85a5c957ec81fbfd61814
Opcode Fuzzy Hash: 239755902d479be49fec2a674b2b915e74fd25ac68445c7aadc7534b8b99ff15
Instruction Fuzzy Hash: EE61BC71F001114FDF549B7AC88466FAADBAFC4620B25443AD80EDB364DEB6ED0287D2

Function 06694280 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f8a573482dfdbcafa9b122f3e0804875e16f96bde909138465295b03165c45
Instruction ID: c748052dd6774b51ed1bd2bbcffb50f2070145fd5a9e96070b2906217134692f
Opcode Fuzzy Hash: e3f8a573482dfdbcafa9b122f3e0804875e16f96bde909138465295b03165c45
Instruction Fuzzy Hash: B6812A30B102099FDF44DBB9D5546AEB7F6AB89304F148529D80AEB394EF35EC438B91

Function 066945A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa6463b80405d53e70f02b999c60a7a0cefec1ebc4d6a7c1002f89b3746c2e2
Instruction ID: e13007e768f28a85e23b488419815d774890caa0db142b741bc7aea71a2fbe6f
Opcode Fuzzy Hash: cfa6463b80405d53e70f02b999c60a7a0cefec1ebc4d6a7c1002f89b3746c2e2
Instruction Fuzzy Hash: 0A915D30E102198FDF64DF68C890B9DB7B1FF89314F208695D449AB395DB70AA86CF91

Function 06694290 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98af86beb6e8f2f355d4154195afca867b6b5c6427dbd237ec90c5e785e694a0
Instruction ID: 8b7446ae47c6dc1f7d27628aa2b19ffaa318eda33060fecad6cf44049e1577f1
Opcode Fuzzy Hash: 98af86beb6e8f2f355d4154195afca867b6b5c6427dbd237ec90c5e785e694a0
Instruction Fuzzy Hash: 9E812A30B102099FDF54DBB9D5546AEB7E6AB89304F148429D80AEB394EF31EC438B91

Function 066945B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce37d10523f5e251190f8cfcc14b675f06c96d5a4a7ace503a6f501899a6479
Instruction ID: 5ef7057e9ce24748d2a16bcab954ff1632f6028d78dbd1299e7f57c727ad5262
Opcode Fuzzy Hash: 7ce37d10523f5e251190f8cfcc14b675f06c96d5a4a7ace503a6f501899a6479
Instruction Fuzzy Hash: 07915D30E102198BDF64DF68C880B9DB7B1FF89310F208695D44DAB355EB70AA86CF91

Function 0669EEF0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc60f46d056568e7eaff031ba79b292f6088d043561d153a7275c700acde3ea
Instruction ID: 4a7f12affcac6270fc57831ead9b329374bd7a7a0f25c41f4a7c1f8f4695728d
Opcode Fuzzy Hash: 7bc60f46d056568e7eaff031ba79b292f6088d043561d153a7275c700acde3ea
Instruction Fuzzy Hash: 02815F70A002099FDF54DFA8D990A9DBBFAFF84300F148429E409EB355DB31E946CB60

Function 0669EF00 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f7045b9b893a56617c74f426d65b149a2bcef8f47558b0d32fc439c2143c22
Instruction ID: ddd52ea3eee9a7706561ba6edcb4b21103d501eddbdf70552210aabebc632d9e
Opcode Fuzzy Hash: c9f7045b9b893a56617c74f426d65b149a2bcef8f47558b0d32fc439c2143c22
Instruction Fuzzy Hash: 64711E70A002099FDB54EBA8D990A9EBBFAFF84314F158429E409DB355DB31E946CB60

Function 0669FC68 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0696503ccdc5f121d3caa85b03ff6d46719778906834fff94fb936d707aed9b3
Instruction ID: d74959982286e462a35a197a8f95e3ee2fd380cb245c5b4fdab92a822c38018e
Opcode Fuzzy Hash: 0696503ccdc5f121d3caa85b03ff6d46719778906834fff94fb936d707aed9b3
Instruction Fuzzy Hash: 4A51E331F00105DFCF14EFB8E4446AEBBB6EB84315F118829E90AD7350DB319955CBA5

Function 0669FA0A Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82664b706a750d50ddd5218e88c9793d7b3683c8b2aad12d425993d6425e0cdf
Instruction ID: 35449df4cd27c963d33154a1f6b047ab8cf99f15f8ac66f2bd2c27ab70935cdc
Opcode Fuzzy Hash: 82664b706a750d50ddd5218e88c9793d7b3683c8b2aad12d425993d6425e0cdf
Instruction Fuzzy Hash: F351B934B10305DFEF646A6CD99476F365ED789710F21482AE80AD73D8CA79CC4687B2

Function 0669FA18 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 959d5ff16c205ab41c6c65b70a34c6ae65a422d463e302246ffdb4b39ca72dbb
Instruction ID: a34f7b1c2ae04f8361807a95c2782f53f7060050a3a75230576d96c5c88d5a87
Opcode Fuzzy Hash: 959d5ff16c205ab41c6c65b70a34c6ae65a422d463e302246ffdb4b39ca72dbb
Instruction Fuzzy Hash: 6451B834B20314DFEF646A6CD954B3F265ED789710F21482AE90AD73E8CA79CC4643B2

Function 06695408 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f0fa0de7e0435f99a350c40f62cf7acfdf68916ea66e64ecea6716cc4ec8af
Instruction ID: 2f956d62f7776469c7f6810683af6d1861a05624946cbb2a65b07d0272ba4936
Opcode Fuzzy Hash: a0f0fa0de7e0435f99a350c40f62cf7acfdf68916ea66e64ecea6716cc4ec8af
Instruction Fuzzy Hash: 5C415E71E006098BDFB1CEA9D8C0AAFFBF6FB84310F10492AD51AD7651D730E9558BA0

Function 0669FC58 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9824bf3af89804caeed88392894617f83cb0fcc113c6a87619a7edaa4af7f5
Instruction ID: 260919fef0ff18277609d7a0c67dfc1a5230bfaa33ebedbeb6c34acbd8584a39
Opcode Fuzzy Hash: cf9824bf3af89804caeed88392894617f83cb0fcc113c6a87619a7edaa4af7f5
Instruction Fuzzy Hash: 78310132E01205DFCF14ABB8E5142AEBBB7EB84311F118879E50AD7350DF31985AC7A5

Function 0669D950 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177fd8fe99c3ecdfac1be0291619b4485760fb0c33531a5ec5ccc38f28271530
Instruction ID: 90f9411c555901f01609be0d11cd2ff0b6311d72f5f8094af8af761dfcc0b8b2
Opcode Fuzzy Hash: 177fd8fe99c3ecdfac1be0291619b4485760fb0c33531a5ec5ccc38f28271530
Instruction Fuzzy Hash: B3319031E1060A8FCF25DF68C89069EBBB5FF85304F144929E815EB354EB71E946CB60

Function 06692083 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d48d8344e6b6e3abb70f2fecf57196dd09734260d0e5a50ad35aa28ed7a4aa2c
Instruction ID: 41b3f106c8c0c66bdd5551a504020b6f912941d310cb06550ff190514eac763f
Opcode Fuzzy Hash: d48d8344e6b6e3abb70f2fecf57196dd09734260d0e5a50ad35aa28ed7a4aa2c
Instruction Fuzzy Hash: E0318F34E10205AFCF59CF65D8A46AEBBB6FF8A300F148529E906E7350DB71AD46CB50

Function 06692090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56b1802865bedc5ee07b4bef7dfd291246fa3e3d6eeef8716288162a3ad51b07
Instruction ID: 080d271fe70c2a0ca76cb71fc68a898d22fe3d510dd7d7fa7a48653124b2e6a4
Opcode Fuzzy Hash: 56b1802865bedc5ee07b4bef7dfd291246fa3e3d6eeef8716288162a3ad51b07
Instruction Fuzzy Hash: FB318134E10209AFCF59CF65D8646AEB7BAFF89300F148529E906E7340DB71AD46CB50

Function 06693A80 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e1f12c68c9ea5af81275cc225296ef32ec16bb16c8c4fd14888f124a574ba2
Instruction ID: 21c68e27e112c6b569f428989954d6e00b601fa738ae66e83f1d0383660f1422
Opcode Fuzzy Hash: 77e1f12c68c9ea5af81275cc225296ef32ec16bb16c8c4fd14888f124a574ba2
Instruction Fuzzy Hash: 6E21AC75F102059FDF00DF69D880AAEBBF9FB48710F148029E904E7384E734D9028B94

Function 06693A90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2c2839525803eaa35554de7cae51596829b7131ee17525d3d6fc28e0a5e7c4
Instruction ID: d55b6b9be6b6681d79978231def420e1831fddc534096244a421aa8261c34ade
Opcode Fuzzy Hash: 2f2c2839525803eaa35554de7cae51596829b7131ee17525d3d6fc28e0a5e7c4
Instruction Fuzzy Hash: 93217A75F106159FDF40DF69D880AAEBBF9FB48710F148029E905E7384E734D9028BA4

Function 00D9D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2966022900.0000000000D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d9d000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fdbbadcbb01c5f30ff024a8f0259ae8bfe1ea3c82155ec1c8fa45a865fdbbc0
Instruction ID: 962e53f7ddc3617adb69298b7d928ac736596fa842a0975796241981b0a3fc8f
Opcode Fuzzy Hash: 3fdbbadcbb01c5f30ff024a8f0259ae8bfe1ea3c82155ec1c8fa45a865fdbbc0
Instruction Fuzzy Hash: 1D21F271604204DFDF14DF14D9C4B26BBA6FB84314F24C669E84D4B296C33AD846CA72

Function 00D9D005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2966022900.0000000000D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d9d000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b985c1eebda45ffe57817a65c659df784228be320b61282435abed0668a635d3
Instruction ID: aed745690278a3477a9c7239a7813e66de5691a75e09802f6c817bf08f3d188c
Opcode Fuzzy Hash: b985c1eebda45ffe57817a65c659df784228be320b61282435abed0668a635d3
Instruction Fuzzy Hash: 05212C7550D3C09FCB07CB24D994711BF71AB46214F29C5EBD8898F2A7C23A985ACB62

Function 066953F8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c75ad6947be4ef69fad3a2bc79b282182ad7b886feb2f0897806d147ca95b6
Instruction ID: e1c71b091f6c1fb6c814d4c84f0ef982c4ec913c7c503a5a9785bb61841ac539
Opcode Fuzzy Hash: e1c75ad6947be4ef69fad3a2bc79b282182ad7b886feb2f0897806d147ca95b6
Instruction Fuzzy Hash: 6721BE71A007058FCF61CFA9CDC1AAFFBB6FF84300F148929D51697655D730A8568BA0

Function 06693BA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0967fc8de17cb8d91f3a9c51a39500ed238009fa3037d2e7964e608663cb9f75
Instruction ID: a19bc4e13f459098fef0030e55f8a4f44e1c71ec9c1b99b083da6b784ea3aead
Opcode Fuzzy Hash: 0967fc8de17cb8d91f3a9c51a39500ed238009fa3037d2e7964e608663cb9f75
Instruction Fuzzy Hash: 47118E32B145299FDF549668C814AAF73AAEBC8310F04447AD80AE7344EE24DC438BE5

Function 0669F171 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d634e116f8874801e2722d900ac59b293954917990e97753c70e459458ca64
Instruction ID: 321b629ccd233ddf3630bee97e6c71a9aad1de566898e6347a81ad5f027fb5d6
Opcode Fuzzy Hash: 68d634e116f8874801e2722d900ac59b293954917990e97753c70e459458ca64
Instruction Fuzzy Hash: 6601B135B001115FCBA5A66DD850B2EB7EAEB8A710F158569EA0ACB381DA34DC4343E6

Function 06693859 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6064d9191392fba6a173d5fac65ee42147ce37b96d7e24772a812d7f3506153e
Instruction ID: 1e81f8b1fe500ccfe40bab7d4657bd6abfb70fd4f2b28090c89c87c1edbc0995
Opcode Fuzzy Hash: 6064d9191392fba6a173d5fac65ee42147ce37b96d7e24772a812d7f3506153e
Instruction Fuzzy Hash: 2921C3B5D01219EFCB00DF99D985ADEFBB4FB08310F10852AE918B7200D374A554CFA5

Function 066941E2 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec385228959f1a7d746927122756ff9c75ca1cb16a7ace0b4dfc0dd10274338
Instruction ID: 8786ef4ec6b7031f228d7600483dababc757ae69c90e272d29919693f9d5980f
Opcode Fuzzy Hash: 0ec385228959f1a7d746927122756ff9c75ca1cb16a7ace0b4dfc0dd10274338
Instruction Fuzzy Hash: 3F015E35B101101FDF6496ADE49572AB7DAEBCA720F14843AE50AC7390DE65EC8343A5

Function 06693860 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144efbf02e461965c8c6bff6da2ce72388d6f24375c7295cbb6f46e4843eddc3
Instruction ID: 77bad560dd6c59d8170eeea6fc6c018c23102b0b7a04f201ba04941dfc745456
Opcode Fuzzy Hash: 144efbf02e461965c8c6bff6da2ce72388d6f24375c7295cbb6f46e4843eddc3
Instruction Fuzzy Hash: E311C2B5D01219AFCB00DF9AD984ADEFBB8FB48310F10812AE918B7300C375A944CFA5

Function 0669A2F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d188a1e7c55f1eaf86fbdec6016bf5d33143b99527d3a2ea2f862ef6a00fe18b
Instruction ID: d802dbd54daf1b1caf500d623bf62083c8cb5fbe3257d0abd7ee6ac44d16ff02
Opcode Fuzzy Hash: d188a1e7c55f1eaf86fbdec6016bf5d33143b99527d3a2ea2f862ef6a00fe18b
Instruction Fuzzy Hash: 27016775B100145FDB94DABCE494B2E73D9E78A714F108829EA0EC73D4DA25DC0287A5

Function 066941F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298a2e802bd3afee98baa3c3e4ed8f76a0023c0e37b840498f250a1877a9fc9b
Instruction ID: 8eb7905167c07c9ffecfd23eabf75050d20c571cac100234e61fa317cb299f97
Opcode Fuzzy Hash: 298a2e802bd3afee98baa3c3e4ed8f76a0023c0e37b840498f250a1877a9fc9b
Instruction Fuzzy Hash: 0A01D130B101101BDFA495ADE45472BB3CEEBC9720F14843AE50EC7390DD65DC4303A5

Function 06693B8F Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3c66075638b88cfa4c13c01f671a76c641bbd127688c2ae9a5420c0c43970c
Instruction ID: 3958c613b55265bef6b5dcc62d1ae32c2f0fab8a7fcc46a93513ed1087d5c2c3
Opcode Fuzzy Hash: 2f3c66075638b88cfa4c13c01f671a76c641bbd127688c2ae9a5420c0c43970c
Instruction Fuzzy Hash: 5F01B132B144254BDF849668D8556AB73AE9B88210F04407AD80AE7384EE60984387A1

Function 0669F180 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e030ed44d051023ca7805e3e387866a3d599267d3b31d87ffbc211a00ac604e2
Instruction ID: f7956e64cba39f8456f539bd7fc13c431239f963f182f70842bb4bef35fab68b
Opcode Fuzzy Hash: e030ed44d051023ca7805e3e387866a3d599267d3b31d87ffbc211a00ac604e2
Instruction Fuzzy Hash: CE018C75B000101BDFA9966DE890B2F63DAEBCA610F208839EA0EC7380DE25DC0343E5

Function 0669A300 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee5b9a86e60d08f8cfd2cd7710d96d88661f4ba1a13cd5fb74845d7e1376d438
Instruction ID: 78cdf59602ae40d88428225928bfdbe367dfbf08ced7ff9eea153f0f576db1eb
Opcode Fuzzy Hash: ee5b9a86e60d08f8cfd2cd7710d96d88661f4ba1a13cd5fb74845d7e1376d438
Instruction Fuzzy Hash: 81014434B100145FDBA4EABDE454B2EB3D9E78A714F108839EA0FC7384EA21DC0287D5

Function 06696461 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ca53e5d2ff69acd944e70328ad99bb15fcfa8547c6b8da0198539c081d4a00
Instruction ID: 24fec3e8d2c653d0753ae1d33921e4ef1fda762b7ab1dae2ea2461ff2912ad79
Opcode Fuzzy Hash: a5ca53e5d2ff69acd944e70328ad99bb15fcfa8547c6b8da0198539c081d4a00
Instruction Fuzzy Hash: 66E04871E547489BEF90CFF4C95576A77AEE701608F2488A5D805CB341E637DD018BA1

Function 06696470 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction ID: 9f4cb87fa4c068fb2e3af31b37d4b6b65b11820edc6fffd6068c2dc651c364b8
Opcode Fuzzy Hash: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction Fuzzy Hash: 7FE01271E14208ABEF50DEF4CA5575A77ADD701618F20C8A5DC09DB301E576DE014BA0

Non-executed Functions

Function 06697688 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06697C2E
$^q, xrefs: 06697C18
$^q, xrefs: 06697C24
$^q, xrefs: 066977BC
$^q, xrefs: 066977F9
$^q, xrefs: 066977C8
$^q, xrefs: 066977ED
$^q, xrefs: 06697B79
$^q, xrefs: 06697B85
$^q, xrefs: 06697C3A

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 0840fc0885683f2bf686c3b5eaa0e278dac17eea48fa660521a084295e321a40
Instruction ID: dd589000d408e697deeb0d381a820e9f30b5b64774454e28bc87682659aeb155
Opcode Fuzzy Hash: 0840fc0885683f2bf686c3b5eaa0e278dac17eea48fa660521a084295e321a40
Instruction Fuzzy Hash: 28121D30E10219CFDF68DF65D954A9EBBB6FF88304F208569D409AB354DB309D86CB91

Function 0669A920 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 0669AA9C
$^q, xrefs: 0669AAA8
$^q, xrefs: 0669AADE
$^q, xrefs: 0669AA71
$^q, xrefs: 0669AAD2
$^q, xrefs: 0669AA7D
$^q, xrefs: 0669AA22
$^q, xrefs: 0669AA16

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 08eb42e7270e352d43d26e8d5b02dff8421e31541c8e6e91a606c9dce557f235
Instruction ID: d2f2a73a07b362547d939ffebbdf0a9700959578b30f59bdd1174912b175a97a
Opcode Fuzzy Hash: 08eb42e7270e352d43d26e8d5b02dff8421e31541c8e6e91a606c9dce557f235
Instruction Fuzzy Hash: E9914E30E10209DFDF68DFA5D654B6E77FAEF84304F108529E8059B398DB749946CBA0

Function 06697088 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

.5vq, xrefs: 066970E3
$^q, xrefs: 06697524
$^q, xrefs: 066973D0
$^q, xrefs: 0669736A
$^q, xrefs: 066973C4
$^q, xrefs: 0669759C
$^q, xrefs: 06697590

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: a43db867bbf49240c78a5dbd89f2f4243971fa6875be803590b54d2b9e3de2f6
Instruction ID: 1059f10c667740ee7d7cec2abb828f76c36eca154e56ce585c81ab78f7e36607
Opcode Fuzzy Hash: a43db867bbf49240c78a5dbd89f2f4243971fa6875be803590b54d2b9e3de2f6
Instruction Fuzzy Hash: 94F14C30B10209CFDB59EF69D594A6EBBB6FF84300F248569D8459B398DB31EC42CB94

Function 066983C0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 0669867F
$^q, xrefs: 0669861A
$^q, xrefs: 0669868B
$^q, xrefs: 06698626

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 4b0b2ee7f6ceab74f36bacd5cdb4a942b51f3ebc8168758bd7826eff6a6d86f0
Instruction ID: fbfc020ba6d969e7665cd47a8d4bbf5fb538b0ddd7fbd21d23705a801a9860f2
Opcode Fuzzy Hash: 4b0b2ee7f6ceab74f36bacd5cdb4a942b51f3ebc8168758bd7826eff6a6d86f0
Instruction Fuzzy Hash: 6EB13930B102098FDB54EF68D5946AEB7B6FF85300F248929D406DB399DB75DC86CBA0

Function 066987D8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 06698863
$^q, xrefs: 06698857
LR^q, xrefs: 066988CB
LR^q, xrefs: 0669891A

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: 274a9a47fa4d12bd9ab4534d4a27d8590741a5dd64a7b179f83faa16946ab80a
Instruction ID: 645807f30df8b72df109d600162dfd5cbb7f3cb1fb10e9ba859c8f200dae816b
Opcode Fuzzy Hash: 274a9a47fa4d12bd9ab4534d4a27d8590741a5dd64a7b179f83faa16946ab80a
Instruction Fuzzy Hash: 5351B130B102059FDF58EB28D540A6AB7A9FF85704F14896DE805DB399DB31EC46CBA1

Function 0669ACA8 Relevance: 5.2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

$^q, xrefs: 0669AE2C
$^q, xrefs: 0669ADD9
$^q, xrefs: 0669AE5B
$^q, xrefs: 0669AE84

Memory Dump Source

Source File: 00000008.00000002.2980222691.0000000006690000.00000040.00000800.00020000.00000000.sdmp, Offset: 06690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6690000_xJZHVgxQul.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: e4e8a6b1db76108477d6259f6fa005bc064dafe6f504191930de502fe42ea4c8
Instruction ID: 1f545b4496d48e3c7bc02056f8674e5887b4459e3c49677f442fb9c6f50caa78
Opcode Fuzzy Hash: e4e8a6b1db76108477d6259f6fa005bc064dafe6f504191930de502fe42ea4c8
Instruction Fuzzy Hash: 0D518134E102099FDF65DBA8D5806AEB7FAEB85310F24852ADC05DB358DB31DC46CB64

Analysis Process: eWJxJJ.exePID: 7388, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	446
Total number of Limit Nodes:	41

Executed Functions

Function 0174D4E8 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0174D576
GetCurrentThread.KERNEL32 ref: 0174D5B3
GetCurrentProcess.KERNEL32 ref: 0174D5F0
GetCurrentThreadId.KERNEL32 ref: 0174D649

Memory Dump Source

Source File: 00000009.00000002.1792133113.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1740000_eWJxJJ.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 171b2a3f21faa31e8cc3a76d2dbafd148b0256f45cefd16b48a25449ddc7544b
Instruction ID: 1497cad2005fe2f9d736757647b6bcc2de89fc8c150e4ea10e3cce3b161d5fa1
Opcode Fuzzy Hash: 171b2a3f21faa31e8cc3a76d2dbafd148b0256f45cefd16b48a25449ddc7544b
Instruction Fuzzy Hash: 895128B09002098FDB18DFA9D548BEEFBF1FB48314F208469E459A7360DB35A984CF65

Function 0174D4F8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0174D576
GetCurrentThread.KERNEL32 ref: 0174D5B3
GetCurrentProcess.KERNEL32 ref: 0174D5F0
GetCurrentThreadId.KERNEL32 ref: 0174D649

Memory Dump Source

Source File: 00000009.00000002.1792133113.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1740000_eWJxJJ.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: eacde3f89708b04b075a26e79161281ce0d951fdeb1ef6036bee06368d93ff38
Instruction ID: 0d0925c1ad3ffce420198373b3bee5b1cb3a7ec63ea375bcd8c552f04816f841
Opcode Fuzzy Hash: eacde3f89708b04b075a26e79161281ce0d951fdeb1ef6036bee06368d93ff38
Instruction Fuzzy Hash: 1D5125B09002098FDB18DFA9D548BDEFBF1BB48314F208469E459AB360DB75A984CF65

Function 072A6468 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 072A66D9
Hbq, xrefs: 072A670C

Memory Dump Source

Source File: 00000009.00000002.1801635811.00000000072A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_72a0000_eWJxJJ.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 945ca3cc818b251e094ab57af83df2f1e4a42e3e409b6e0e51153f2547078047
Instruction ID: 89dbaf2f14f166a59fbf40637d168b8e3c02fdbcf98ad8d606db2503592dccf9
Opcode Fuzzy Hash: 945ca3cc818b251e094ab57af83df2f1e4a42e3e409b6e0e51153f2547078047
Instruction Fuzzy Hash: 72A12875A102199FCB15EFA8C5589AEBBF2FF89350F2440A9D405AB360CB35ED41CFA1

Function 073B54AC Relevance: 1.8, APIs: 1, Instructions: 251processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073B56EE

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 54e36a0984bb4b84e64c0932a92c335c69efeba203a131b7ca9da9ac67d6ae20
Instruction ID: 89e5ae83d29c383708ce1217ed144be5ed07dcafdf1449c30b5fe5036c8a5383
Opcode Fuzzy Hash: 54e36a0984bb4b84e64c0932a92c335c69efeba203a131b7ca9da9ac67d6ae20
Instruction Fuzzy Hash: 6AA190B1D0025ADFEF20DF68C8417DDBBB2BF48310F1485AAE849A7640DB749995CF92

Function 073B54B8 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073B56EE

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4cf68c60137a5b439eb1d957b64c911f433b72881f96c4ed956c4276ad120bfe
Instruction ID: b5c32a630a7790374c743450a7137becf37e0375643b54eebf3caa38b1022604
Opcode Fuzzy Hash: 4cf68c60137a5b439eb1d957b64c911f433b72881f96c4ed956c4276ad120bfe
Instruction Fuzzy Hash: 7A918FB1D0025ADFEF20DF68C8417DDBBB2BF48310F1485AAE809A7640DB749995CF92

Function 0174AE59 Relevance: 1.7, APIs: 1, Instructions: 236COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0174B0BE

Memory Dump Source

Source File: 00000009.00000002.1792133113.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1740000_eWJxJJ.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2694e787573d1ebcb57dac2d64d60267a0d60649b59eb54e4351dfa3a6c5a2a9
Instruction ID: d8dae63a24cd20a3f75f6a5b584e9d965db81961065b00a07734730a151b2a98
Opcode Fuzzy Hash: 2694e787573d1ebcb57dac2d64d60267a0d60649b59eb54e4351dfa3a6c5a2a9
Instruction Fuzzy Hash: 4C9166B0A00B458FE725DF29D45479ABBF1FF88300F008A6ED59ACBA51D735E849CB90

Function 017444E0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 017459C9

Memory Dump Source

Source File: 00000009.00000002.1792133113.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1740000_eWJxJJ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f6259e05a3006c04819e27663799c97b1ea9cc6deaf644a3274c2287a9aaa6ed
Instruction ID: 3b5138e190275443d7bef02094eddbd6cd4fa30e69def1b17a9cd10f15d536bf
Opcode Fuzzy Hash: f6259e05a3006c04819e27663799c97b1ea9cc6deaf644a3274c2287a9aaa6ed
Instruction Fuzzy Hash: CF41DFB0D00719CFDB24DFA9C884A9EFBB5BF49304F2480AAD418AB255DB756985CF90

Function 0174590D Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 017459C9

Memory Dump Source

Source File: 00000009.00000002.1792133113.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1740000_eWJxJJ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0f534a0eadce522a5140d29f17a8d925de5e3c449e80f39ba933d5fca7ba5b34
Instruction ID: 509be19615cc7ed66444a58e5e8ff7d5cdf2a9cae4ae015791341900865c662f
Opcode Fuzzy Hash: 0f534a0eadce522a5140d29f17a8d925de5e3c449e80f39ba933d5fca7ba5b34
Instruction Fuzzy Hash: 8F41E0B0C00719CFDB24DFA9C884ADEFBB5BF49304F24806AD408AB255DB755989CF90

Function 0778BC80 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,0778BC6D,?,?), ref: 0778BD1F

Memory Dump Source

Source File: 00000009.00000002.1803162725.0000000007780000.00000040.00000800.00020000.00000000.sdmp, Offset: 07780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7780000_eWJxJJ.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 048c660c86ac7e9326fe1718daf2030b4807d6b5584c5fcef04cf09d0eed7870
Instruction ID: 0564ce8a48b21f94fdeb9ff6a719e529ac430fa40636fe03a7cb702b3c0cbdcd
Opcode Fuzzy Hash: 048c660c86ac7e9326fe1718daf2030b4807d6b5584c5fcef04cf09d0eed7870
Instruction Fuzzy Hash: F031F2B59003099FDB10DF9AD8846DEBBF5FF48320F14842AE819A7320D775A944CFA0

Function 073B5228 Relevance: 1.6, APIs: 1, Instructions: 74injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 073B52C0

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3184f32e811337703393818bd9a7271a5b2789aac7f2f302db994c41180a5489
Instruction ID: 018e94124324803b4846e571a036c34645103e0cba7aed7af624827937a900e4
Opcode Fuzzy Hash: 3184f32e811337703393818bd9a7271a5b2789aac7f2f302db994c41180a5489
Instruction Fuzzy Hash: 932148B19003599FDB10DFA9C881BDEBBF5FF48310F10842AE958A7250D778A595CFA4

Function 0778A4EC Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,0778BC6D,?,?), ref: 0778BD1F

Memory Dump Source

Source File: 00000009.00000002.1803162725.0000000007780000.00000040.00000800.00020000.00000000.sdmp, Offset: 07780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7780000_eWJxJJ.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 530d917b87ccd7f716e09c9025860d7c4fd6ab3bb0e9c7a34f838080e1af2462
Instruction ID: 98badc04405c3cde947efc723896f814a9c6f872c813536d4437c5b5c0a8568a
Opcode Fuzzy Hash: 530d917b87ccd7f716e09c9025860d7c4fd6ab3bb0e9c7a34f838080e1af2462
Instruction Fuzzy Hash: FF31E2B59003099FDB10DF9AD884AAEBBF4FB58310F14842AE819A7220D775A944CFA0

Function 073B5230 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 073B52C0

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ce5067f5b68b82f4342d5ce3cd682d5c25af41ec9627f5e310fe7a83c510ada1
Instruction ID: 89e5f338393335daa7b4879709a7179b7f320c6881f72c4119347baff94743b4
Opcode Fuzzy Hash: ce5067f5b68b82f4342d5ce3cd682d5c25af41ec9627f5e310fe7a83c510ada1
Instruction Fuzzy Hash: D22136B19003599FDB10DFAAC885BDEBBF5FF48310F10842AE958A7250C778A954CFA4

Function 073B5318 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073B53A0

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7514d4618ef97797c1ca260a54266f95f97880d1876284408b9cd680e27dbf0d
Instruction ID: c0525d4c1706ebfff575603f8f55ff28d8bec35fba47fb4830b5c27842e9aede
Opcode Fuzzy Hash: 7514d4618ef97797c1ca260a54266f95f97880d1876284408b9cd680e27dbf0d
Instruction Fuzzy Hash: 0C2157B18002599FCB10CFAAC880AEEFBF4FF48320F10842AE958A7250C7759545CFA5

Function 073B4820 Relevance: 1.6, APIs: 1, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 073B48A6

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 397ec3ceb1469956a1d16be9a2bae8cd268ed2b2897b50be12e63c367894e50b
Instruction ID: 02ae9c2f3a6a8e6048e9b957be5af2f7c4a164b2e764d9d86522bb4b3d6db29b
Opcode Fuzzy Hash: 397ec3ceb1469956a1d16be9a2bae8cd268ed2b2897b50be12e63c367894e50b
Instruction Fuzzy Hash: AF2178B1D002499FDB10DFAAC4857EEBFF4EF48324F14842AD558A7241CB799985CFA4

Function 073B5320 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073B53A0

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: bcb51672942deb1f87c5c35907828159ccbd472c359207c0adc45de5cf1cbe24
Instruction ID: b35c9b60d58de711a1e6c152c7e19d301ce9989b9840f841b976089898212500
Opcode Fuzzy Hash: bcb51672942deb1f87c5c35907828159ccbd472c359207c0adc45de5cf1cbe24
Instruction Fuzzy Hash: B62128B1C002599FDB10DFAAC880BDEFBF5FF48310F10842AE558A7250C7799554CBA4

Function 073B4828 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 073B48A6

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 70f807b95030927028ecbfb6e2d47500a3218c69016ba0f3ffce25ee01d627e8
Instruction ID: ce146a44cb475bf84bd67785dc5ac2d5a9b0f307e4602f5ebb2c809495732fb0
Opcode Fuzzy Hash: 70f807b95030927028ecbfb6e2d47500a3218c69016ba0f3ffce25ee01d627e8
Instruction Fuzzy Hash: 8D2138B1D002498FDB10DFAAC4857EEBBF4EF88324F14842AD559A7241C7799984CFA4

Function 0174D740 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0174D7C7

Memory Dump Source

Source File: 00000009.00000002.1792133113.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1740000_eWJxJJ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 02d70c53f54fa310e5c53353adcbdf62cf84dff34b61665132e30d5e3f3a573a
Instruction ID: 7b810c91694206e7b53c821762c0a16d9e4d67b401621ba6f7949e5d5b0cc5ad
Opcode Fuzzy Hash: 02d70c53f54fa310e5c53353adcbdf62cf84dff34b61665132e30d5e3f3a573a
Instruction Fuzzy Hash: 2121C4B59002589FDB10CF9AD584ADEFFF8FB48320F14841AE958A7350D375A944CFA5

Function 0174D738 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0174D7C7

Memory Dump Source

Source File: 00000009.00000002.1792133113.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1740000_eWJxJJ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0d28e1db50ded27a2a3dfbbcecc183472635c7db07de515bf0bab0a0177babe7
Instruction ID: 952a6aaf0a61f050f724ed96f08892298fe1c0dcbbaee4bc89a0c098162f398a
Opcode Fuzzy Hash: 0d28e1db50ded27a2a3dfbbcecc183472635c7db07de515bf0bab0a0177babe7
Instruction Fuzzy Hash: 9521E3B59002489FDB11CFA9D984ADEBFF4EB08320F14841AE958A7250D374A940CF64

Function 073B5168 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073B51DE

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a2b05f438bcc867810f9d824430381428ec7de5e8b3a1f72008e7de2a0500fa1
Instruction ID: afdaf993bf462b895222b6cd97b8b83b0feeb5a81e488b0f6fab9170c5047411
Opcode Fuzzy Hash: a2b05f438bcc867810f9d824430381428ec7de5e8b3a1f72008e7de2a0500fa1
Instruction Fuzzy Hash: A3116AB18002499FDB20DFA9C8447DEBFF5EB88324F148419D559A7250C775A540CFA0

Function 073B5170 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073B51DE

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 44b7202b96c29a93220514da78d4879cecf0f024e23c91cbba7108e6c2d5ecf0
Instruction ID: 13c3174ac595b8c2a4826f0249aa7ecefb316bf1bb7e4b9dacb98119b7895dde
Opcode Fuzzy Hash: 44b7202b96c29a93220514da78d4879cecf0f024e23c91cbba7108e6c2d5ecf0
Instruction Fuzzy Hash: 2E1137B19002499FDF20DFAAC844BDEBFF5EF88324F108419E559A7250C775A554CFA4

Function 073B433F Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 073B43A2

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6285ca02c681e2a4d2af17a75e902a2c6ba44035f0c141bf89447d2bf5ab2968
Instruction ID: a1d0a415293fbf078897b9bfed42e889c099e3da95811616e80a4b3612a15a2c
Opcode Fuzzy Hash: 6285ca02c681e2a4d2af17a75e902a2c6ba44035f0c141bf89447d2bf5ab2968
Instruction Fuzzy Hash: 7D1158B19002488BDB20DFAAC4457DEFBF4EB88324F24841AD519A7250CA35A544CFA4

Function 073B4340 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 073B43A2

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ccb824fb530594c8e30ca60ccdb6eae6d4dda0da5d0a14c4e392873b350706bb
Instruction ID: db1a8f140f03bbeb55cb132ae2a1ce681f6a30ee13047731f8124b0ffd5caa53
Opcode Fuzzy Hash: ccb824fb530594c8e30ca60ccdb6eae6d4dda0da5d0a14c4e392873b350706bb
Instruction Fuzzy Hash: 251125B19002598BDB20DFAAC4457DEFBF4EB88324F24842AD559A7250CA79A944CFA4

Function 073B8929 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 073B898D

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4ddb4fb89703d9e30f6191133779ffd5b75996e98aebb364fa33f5b292687857
Instruction ID: 4f5fc8728c1f31a489d9d92ed0da0d8f8eadc5245b860404c2d175e57645bf62
Opcode Fuzzy Hash: 4ddb4fb89703d9e30f6191133779ffd5b75996e98aebb364fa33f5b292687857
Instruction Fuzzy Hash: 5C1122B5800249DFDB20DF9AD885BDEFFF8EB48320F10845AE558A7600C375A584CFA5

Function 0174B058 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0174B0BE

Memory Dump Source

Source File: 00000009.00000002.1792133113.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1740000_eWJxJJ.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f661f1eb8f58ecc134f76e276c649076bae07bce76796a4a79f53fd541fef660
Instruction ID: 3338a55fcc2d7b9e57996428bfeb8a2c488627608f7591015148226a7bb24c93
Opcode Fuzzy Hash: f661f1eb8f58ecc134f76e276c649076bae07bce76796a4a79f53fd541fef660
Instruction Fuzzy Hash: 561110B5C002498FDB10CF9AC444BDEFBF8EF88324F10842AD528A7210D379A545CFA1

Function 073B6820 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 073B898D

Memory Dump Source

Source File: 00000009.00000002.1802997771.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_73b0000_eWJxJJ.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1174b4a81e25e9783cc7d6cd4278a3567f108d767b6058e42dfa077649fadc13
Instruction ID: 1a12ab148f0af6338c05620c9ad93eb64c73103787e1a6cffc15f36bd3754a19
Opcode Fuzzy Hash: 1174b4a81e25e9783cc7d6cd4278a3567f108d767b6058e42dfa077649fadc13
Instruction Fuzzy Hash: CA11F2B58003499FDB20DF9AD884BDEBBF8EB58320F10841AE558A7610C375A984CFA5

Function 016DD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1790674853.00000000016DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_16dd000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d34628c2ebd1e792379c031cefe489a1f93fbe324a3bbb5612f9d277a05797e
Instruction ID: 958162c9dc48d9c7104da6b74c52686f1bfc2314bbacedfa2f0b3b7bf1760a51
Opcode Fuzzy Hash: 4d34628c2ebd1e792379c031cefe489a1f93fbe324a3bbb5612f9d277a05797e
Instruction Fuzzy Hash: 08210371940240EFDB05EF58DDC0B2ABF65FB88318F60C569E9090B296C336D456CBA1

Function 016DD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1790674853.00000000016DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_16dd000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b00996b04c2c030edd8b08c972eca81c0a218b471763c009ff91df22c80a900
Instruction ID: c10a45c7336bd9ae39659acdfbbe7972b5cdb0fdce43d82dd56357dba446f3f9
Opcode Fuzzy Hash: 0b00996b04c2c030edd8b08c972eca81c0a218b471763c009ff91df22c80a900
Instruction Fuzzy Hash: 99212871901204DFDB15EF58DDC0B6ABF65FB94324F20C16DD9094B396C336E456C6A1

Function 016ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1790958165.00000000016ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 016ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_16ed000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b175ac70aee258778548af68851cdd28eeabdfd764128b9c45fe4ebf11e147
Instruction ID: dba0298f71c02142553bef4adc3da80167892edad3107ab5dbb464571fc4f611
Opcode Fuzzy Hash: e4b175ac70aee258778548af68851cdd28eeabdfd764128b9c45fe4ebf11e147
Instruction Fuzzy Hash: 7E21F271604200DFDB15DF58D988B26BFA5FB84354F28C66DD90A4B396C33AD447CA61

Function 016ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1790958165.00000000016ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 016ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_16ed000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63004e8751d3e5a7be2807158a3ecb5af1d25e02b5a75cd906809161049a024f
Instruction ID: dba62b3aa754bccb34cf3003d45c9c2257e60173958c34524b49ee67999b3b38
Opcode Fuzzy Hash: 63004e8751d3e5a7be2807158a3ecb5af1d25e02b5a75cd906809161049a024f
Instruction Fuzzy Hash: D0210475504200EFDB05DF98DAC8B26BBE5FB84324F20C66DEA094B396C336D446CA61

Function 016ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1790958165.00000000016ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 016ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_16ed000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a19a076a561bf763c82a875b7658db4fb8a4a3e4c103239a167ea0af56bb638
Instruction ID: 8e4387d553dd8af31e00eae37b0c29ca81f4e59fb91c2f2b0757924da6516e25
Opcode Fuzzy Hash: 4a19a076a561bf763c82a875b7658db4fb8a4a3e4c103239a167ea0af56bb638
Instruction Fuzzy Hash: 212162755093808FDB13CF64D994715BFB1FB46214F28C6DAD8498F6A7C33A980ACB62

Function 016DD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1790674853.00000000016DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_16dd000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: eb4823a4ad08cdb06fe23fb52818ec359966f4b798d335f3a1a20ae19a9f5406
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 2911E172804280DFCB12DF54D9C4B16BF71FB84318F24C6A9D8090B256C336D45ACBA1

Function 016DD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1790674853.00000000016DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_16dd000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 6328c3858b1bcbf41f4be1e7373d4f3ed7b703dcac315b7a5538f1b31e40c224
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: E011DF72804240DFDB12DF44D9C4B56BF71FB94324F24C2A9D9090B296C33AE45ACBA1

Function 016ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1790958165.00000000016ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 016ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_16ed000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: be7b7b679fa2916ac839d7e68788a7231e3c8a4cef4542522b25c36b78533f5f
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 6111BB75504280DFDB02CF54C9C8B15BFA1FB84224F24C6AAD9494B396C33AD40ACB61

Function 016DD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1790674853.00000000016DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_16dd000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e45984aa89ebe5a69622ed1a735bf422aec763e45916130b2b9a2559d9fe38a
Instruction ID: cb82d62cdbb628302e11bf13c77e142a79382dbbbe9777fbcfbad10f994f33c1
Opcode Fuzzy Hash: 2e45984aa89ebe5a69622ed1a735bf422aec763e45916130b2b9a2559d9fe38a
Instruction Fuzzy Hash: 4001F7318083809AE7116A69CD84B77BF9CDF41324F09C5AAED080A2C6C339D841CAB1

Function 016DD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1790674853.00000000016DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_16dd000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08b6698655b9a55876dbd1b96aa37a889c2f6773ab9068b64de59aa948110d2
Instruction ID: 6cd697fb823d0ebad839dc5f64ae2af80bc25bd9775d310b4635946637b1120e
Opcode Fuzzy Hash: b08b6698655b9a55876dbd1b96aa37a889c2f6773ab9068b64de59aa948110d2
Instruction Fuzzy Hash: E5F062718083849AE7119E1ACC88B62FFA8EB95634F18C45AED0C5E3C6C3799844CAB1

Analysis Process: eWJxJJ.exePID: 7668, Parent PID: 7388COMMON

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06B03040 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B0376F
$^q, xrefs: 06B03763
$^q, xrefs: 06B03722
$^q, xrefs: 06B0374B
$^q, xrefs: 06B03716
$^q, xrefs: 06B0373F

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 8d8c64260e3aed9b8d27e0efad6a216c97a021d20d7ef8a272b9801d6fa06d80
Instruction ID: d3100cbdc1aef0b7d77c3fa823528d0cf04df40cb44b47d4fd8d2e6ba86c0c30
Opcode Fuzzy Hash: 8d8c64260e3aed9b8d27e0efad6a216c97a021d20d7ef8a272b9801d6fa06d80
Instruction Fuzzy Hash: 92322031E1061ACFDB14EF75C8945ADB7F6FF89300F11C6A9D409AB264EB30A985CB81

Function 06B07D68 Relevance: 3.0, Strings: 2, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B0830F
$^q, xrefs: 06B08303

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 33701a2ac9dcdad86b3431579423dcacce64cf45741fe8ed56dc1cc3787a0e38
Instruction ID: 097f521481b38bc0dad815a2f66ae6b422a991799d67b7531b2bc565f14e0b9d
Opcode Fuzzy Hash: 33701a2ac9dcdad86b3431579423dcacce64cf45741fe8ed56dc1cc3787a0e38
Instruction Fuzzy Hash: 6902AD70F002158FEF54DB65D590AAEBBA2FF84314F1485A9E409DB395EB31ED82CB81

Function 06B02349 Relevance: 1.0, Instructions: 1007COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a091ed75d034a582432d0310ca1959af5eceb62f08f97f0be898e710a444307
Instruction ID: 8c50d056b074d23368f8a540d704d98ee4fd76eec3601f48d1f46dd630e91e47
Opcode Fuzzy Hash: 3a091ed75d034a582432d0310ca1959af5eceb62f08f97f0be898e710a444307
Instruction Fuzzy Hash: D1926874E002048FEB64DB68C588A5DBFF2FF44314F5494A9D44AAB3A5DB35ED89CB80

Function 06B065E0 Relevance: .8, Instructions: 809COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a0bdc179eff96f6ef9571540c14dc9ceef1a7e4db36a6bfc1dedce002e4d81
Instruction ID: 1fa4b468e871255b6b0a2204535db3d7b23607bb35caf84a99c381506b873924
Opcode Fuzzy Hash: 07a0bdc179eff96f6ef9571540c14dc9ceef1a7e4db36a6bfc1dedce002e4d81
Instruction Fuzzy Hash: 6D628F74E002058FEB54DB68D544BADBFB2EF88314F1485A9E40ADB395EB35EC42CB80

Function 06B05588 Relevance: .6, Instructions: 604COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 202880895e1d6258950eb003d9442a098906c4c9fbbb8bc3cdf90b8c8967f4d0
Instruction ID: dc48835b74057bae8f32caf77bf5d88bf323821896ed4ef81a9906adeb3e37e5
Opcode Fuzzy Hash: 202880895e1d6258950eb003d9442a098906c4c9fbbb8bc3cdf90b8c8967f4d0
Instruction Fuzzy Hash: 0922E2B2E002058FEF74DB64C5806AEBFB2EF85314F1084A9D845AB785CB31DC42CB91

Function 06B0B20F Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a58be61c32da99c48126eb07d96f9e69a6adacf0f33812aa4186f9762dcad49
Instruction ID: d55b92482f549f76d3f0876be2d7ba37aaff86e2d9745d6d105faa5b05414615
Opcode Fuzzy Hash: 0a58be61c32da99c48126eb07d96f9e69a6adacf0f33812aa4186f9762dcad49
Instruction Fuzzy Hash: F4228270E101098FEF64DB69D584BAEBFA2EB45310F2099A6E409DB3D5CB36DC81CB51

Function 06B0ACB8 Relevance: 10.4, Strings: 8, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B0AE38
$^q, xrefs: 06B0AE84
$^q, xrefs: 06B0AE67
$^q, xrefs: 06B0ADE5
$^q, xrefs: 06B0ADD9
$^q, xrefs: 06B0AE5B
$^q, xrefs: 06B0AE90
$^q, xrefs: 06B0AE2C

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: fb2e618a63704fefd3f4516410ac4add13723f83d67040cdd5e5bc8dea324197
Instruction ID: f37954eda504520616b2ef60cc6a16102bdb99b97acc72fd4d5b49b060f6b412
Opcode Fuzzy Hash: fb2e618a63704fefd3f4516410ac4add13723f83d67040cdd5e5bc8dea324197
Instruction Fuzzy Hash: 0DE18070E103198FDB69DF69D8806AEBBB2FF84304F208A69D4059B395DB71DC46CB91

Function 06B0B630 Relevance: 8.0, Strings: 6, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B0BB6F
$^q, xrefs: 06B0BB97
$^q, xrefs: 06B0BBD7
$^q, xrefs: 06B0BB63
$^q, xrefs: 06B0BBA3
$^q, xrefs: 06B0BBCB

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 513affa34ef6fa0cfdd9726aa8b6ba5d063b08ad3f7507a2d1d2c5e26e6a1f1b
Instruction ID: c6ed99d674736c0e921dc97f6d14bd3cd271706a0bff92b8d25e6725e2c7551b
Opcode Fuzzy Hash: 513affa34ef6fa0cfdd9726aa8b6ba5d063b08ad3f7507a2d1d2c5e26e6a1f1b
Instruction Fuzzy Hash: 18028E70E102098FEBA4DF68D580AADBFB1FB45310F2095AAE405DB395DB32DC85CB91

Function 06B09138 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B091C6
$^q, xrefs: 06B0918B
$^q, xrefs: 06B0917F
$^q, xrefs: 06B091BA

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: e3ead7162b3973d857845208419c76c1a642c8fb1fd7aa4c921fc7a887913403
Instruction ID: bc003735c0f86dfe8824cff13f3502ddd0626458501c9a80fed70578461f48c6
Opcode Fuzzy Hash: e3ead7162b3973d857845208419c76c1a642c8fb1fd7aa4c921fc7a887913403
Instruction Fuzzy Hash: F8916170F0021A9FDB54EB65D9507AEB7F6FBC8204F109569D40DEB389EB70AC428B91

Function 06B0CF28 Relevance: 4.5, Strings: 3, Instructions: 797
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B0D31F
$^q, xrefs: 06B0D327
$^q, xrefs: 06B0D333

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 4014cdd52f8a48fc74084b90870314e61c3023890d5eccaa0e9db6ce9ab22e64
Instruction ID: 50516a71b06a6d43202fca68160552e3e3fa282abc1b4bd07e8251fd03cee946
Opcode Fuzzy Hash: 4014cdd52f8a48fc74084b90870314e61c3023890d5eccaa0e9db6ce9ab22e64
Instruction Fuzzy Hash: 03625330B0021A8FDB55EB69D590A5DBBF2FF84304F109A68D0099F3A9DB71EC46CB90

Function 06B04B50 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06B0525D
XPcq, xrefs: 06B04C7D
\Ocq, xrefs: 06B04D07

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 5c0f42613614408730146e079d0e4ef6a042f8d96de1ffaac1874646da4c3cf9
Instruction ID: f56fc9f6ab8e71a37d4ecb3f14d2f1d7571c4950c653d09d3cc15ac7b9e7393e
Opcode Fuzzy Hash: 5c0f42613614408730146e079d0e4ef6a042f8d96de1ffaac1874646da4c3cf9
Instruction Fuzzy Hash: 2C61AF70E002199FEF559FA8C8547AEBEF6FF88300F208529D506AB395DB758C058B91

Function 06B09127 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B0917F
$^q, xrefs: 06B091BA

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: bbe317f82cb6ae0bfec74b28c584a87ab2b1238b4e344a8ba273b753c2309f51
Instruction ID: 9c9f5233038f371561d69f99075cc373c8a0d5ac84e03c7f19374e66d07db387
Opcode Fuzzy Hash: bbe317f82cb6ae0bfec74b28c584a87ab2b1238b4e344a8ba273b753c2309f51
Instruction Fuzzy Hash: 41517070F002159FEB54EB65D990BAEB7F6EB88600F109569D40DDB3C9EB30AC42CB95

Function 0116EB38 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.2965870415.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1160000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7e20deba295d1ae11a427b962a03c7e1f3914aae82a6e1c023e3bcdbeef955
Instruction ID: f69d8859704e404f861518d03039a8a37ac3aa0b1bb109ce5a7173fae9dcecda
Opcode Fuzzy Hash: 7c7e20deba295d1ae11a427b962a03c7e1f3914aae82a6e1c023e3bcdbeef955
Instruction Fuzzy Hash: DC514472D013589FDB18DF79D8047DEBFF9AF89210F14856AD509A7281DB349841CBE1

Function 0116EC20 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0116EC87

Memory Dump Source

Source File: 0000000D.00000002.2965870415.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1160000_eWJxJJ.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 9388f97f5a14672ce4e59c08de74d0b91b74e3910b5af5e72460e1fc5aedb726
Instruction ID: 5a48be714223b838a014c285bbae60d44683b647f06591658cb2ad910d8cb4ba
Opcode Fuzzy Hash: 9388f97f5a14672ce4e59c08de74d0b91b74e3910b5af5e72460e1fc5aedb726
Instruction Fuzzy Hash: D61120B1C00269DBCB10CF9AC544BDEFBF8AF48320F10812AD818B7240D378A944CFA5

Function 06B04B40 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

XPcq, xrefs: 06B04C7D

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: XPcq
API String ID: 0-714321711
Opcode ID: df4e6a31b1ef43e11747ab05ef89e9b9d10f4800f826d312f3718fdfaae804ba
Instruction ID: 7e5d0703c57100e61e408816e9bc343ff42a03b4b185a8d879d75cc6b4a9147a
Opcode Fuzzy Hash: df4e6a31b1ef43e11747ab05ef89e9b9d10f4800f826d312f3718fdfaae804ba
Instruction Fuzzy Hash: A1418E70E102199FEB599FA8C8547AEBBF2BF88700F20852AE145AB395DB708C05CB51

Function 06B0DA9D Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06B0DBF9

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 15ec7caa0c801cacd85622427aeaf708dd927b0a258edd19e09d0527f4642db6
Instruction ID: 20e11230a596874ad7d299a08572b54556e63d3349f7a780f6eb6255ed46d209
Opcode Fuzzy Hash: 15ec7caa0c801cacd85622427aeaf708dd927b0a258edd19e09d0527f4642db6
Instruction Fuzzy Hash: DC41AF70E0030A9FEB65DFA5C44469EBFB2FF85200F204669E416EB2C4DB75D846CB91

Function 06B021D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06B0230B

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: b6843ccd558a57f99a9683fe5538433b22486cb8e3ec40590106c338d8c9fe68
Instruction ID: 7e8e8bd1c0a150d34b6a29515156626c7a6609d47dd27b9919a2174f2b96cff0
Opcode Fuzzy Hash: b6843ccd558a57f99a9683fe5538433b22486cb8e3ec40590106c338d8c9fe68
Instruction Fuzzy Hash: BD311470F102058FEB699BB4C51866E7FE2EB89200F108578D006DB394DF35DD49C7A1

Function 06B082DE Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B08303

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 34d495f1432f63fa55557afc8f1957e6b510aa757efbd04b5d9b739ba4eaa24a
Instruction ID: a85c7c0cd85164f990c37304173cc183870e56874b2ebcc6f01788a2f0a56b39
Opcode Fuzzy Hash: 34d495f1432f63fa55557afc8f1957e6b510aa757efbd04b5d9b739ba4eaa24a
Instruction Fuzzy Hash: 2EF0A076E14211CFFFB85A42A8506B87FA4E788224B0415E2FD08CB1D5CB31DB00C690

Function 06B0C170 Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1e563e88bebbd35e81ea39421881ae2eca8620cd7cd898083388e447561f64
Instruction ID: 1271cd5b69cb22bc1cc2b9b5ad176617989187c0f3e2d8238d80e91259a9a089
Opcode Fuzzy Hash: 6f1e563e88bebbd35e81ea39421881ae2eca8620cd7cd898083388e447561f64
Instruction Fuzzy Hash: 1132A174F102198FEB54DB68D980AADBFB2FB88314F108665E409D7395DB31EC46CB91

Function 06B061E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d074bd8e3d4ea4d51a9760bfd32cb1578998a3416663f5c17c7e567901822d12
Instruction ID: b13c11c8386baf00bb08578984ee8460884dc40834d86f3cb2aa3ee95936aebb
Opcode Fuzzy Hash: d074bd8e3d4ea4d51a9760bfd32cb1578998a3416663f5c17c7e567901822d12
Instruction Fuzzy Hash: 9D61AFB1F000214FDB549A7EC88466FAED7EFC4610B15447AD80EDB364EE65ED0287C2

Function 06B04280 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb19232b4425b0f96f3e47287d626ca1cdea69568d3e2eee5a0bcb2153a0e4b8
Instruction ID: 8e3b5057422faf8cf4473eacd6533f8f1089cedfbbac81cfe795c3040c6e431b
Opcode Fuzzy Hash: eb19232b4425b0f96f3e47287d626ca1cdea69568d3e2eee5a0bcb2153a0e4b8
Instruction Fuzzy Hash: 51818C70F102099FDF54DBA9D5546AEBBF2EF89304F108568D50ADB394EB31EC428B51

Function 06B045A0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73fd0c7e695253e6378fe4f353d9a16849004deab24b01aaa3b1b3f66281f6b9
Instruction ID: b382659e2a695ef0ded30d71763d94866502c8df1a01b84b8626be0ec18a1e83
Opcode Fuzzy Hash: 73fd0c7e695253e6378fe4f353d9a16849004deab24b01aaa3b1b3f66281f6b9
Instruction Fuzzy Hash: EF917170E102198FDF50DF64C880B9DBBB1FF89304F208695D549EB295DB70AA85CF91

Function 06B045B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 078531e5cbd02a8fcbfaa4b6fd196abef5018da0f4d96b8b844a7696bc627fd1
Instruction ID: 6f7e5efcf24313d71cc06970718a0b242774b964b3d782eff18fe77059e7d366
Opcode Fuzzy Hash: 078531e5cbd02a8fcbfaa4b6fd196abef5018da0f4d96b8b844a7696bc627fd1
Instruction Fuzzy Hash: DA915070E102198FDF64DF68C880B9DBBB1FF89304F208695D549AB295DB70A985CF91

Function 06B0EEF0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd0a6cf507cdd69a717efd4c2ce410f0da2c5d70022aa37e316dd709c381bf8
Instruction ID: 884858de8ceda802a4de743c6076cec5b625c17d20c0323a85db86d545228ad9
Opcode Fuzzy Hash: 1cd0a6cf507cdd69a717efd4c2ce410f0da2c5d70022aa37e316dd709c381bf8
Instruction Fuzzy Hash: 88711C70F002099FDB54DBA9D980AADBFFAFF88304F148569E415EB295DB70E846CB50

Function 06B0EF00 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796fe3c0864ff158cae5c1316452046d3cc958c01d12af139c9add0f113aea79
Instruction ID: 9e2670c4cb2926232324c0cd6aa98854595cc0d032f51f1898016212e8c03eab
Opcode Fuzzy Hash: 796fe3c0864ff158cae5c1316452046d3cc958c01d12af139c9add0f113aea79
Instruction Fuzzy Hash: DB710A70B001099FDB54DBA9D980AAEBBFAFF88304F148569E415EB395DB70E846CB50

Function 06B0FC58 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba950c3557c98caf50428fd5a2e888b2b49bd8b6e19c7dab7116e85d3fe89fa
Instruction ID: 4aa1db25de6cd19f37ace32564e548a2e10f033f726008fbd28c16cc38d0cdad
Opcode Fuzzy Hash: 6ba950c3557c98caf50428fd5a2e888b2b49bd8b6e19c7dab7116e85d3fe89fa
Instruction Fuzzy Hash: EE512271F00109AFEB34AB78E4446BDBFB6FB88301F1089B9E906D7290DB319855CB80

Function 06B0FA0A Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d526d61543540d9e9cfde82a17fc73df3bce5b67f139d58e6ad782bd5c52e83
Instruction ID: fc64cbec4d1fb4d1059e7de5f59dabd3f4f68a73dff56db08fd8a4caf9d66ed1
Opcode Fuzzy Hash: 8d526d61543540d9e9cfde82a17fc73df3bce5b67f139d58e6ad782bd5c52e83
Instruction Fuzzy Hash: 5F51F870B102189FFF74666CD95473F2E9EE789300F20596AE80AD33D9CA69CC564792

Function 06B0FA18 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2cbb066130ceaf1e4564d0208596a5b157ed83cf6afb71c84d3e5536c510c8c
Instruction ID: b42a71d4ff809e471339e6a9434cfe528e788ac03bd2eeb4681668aac761f169
Opcode Fuzzy Hash: f2cbb066130ceaf1e4564d0208596a5b157ed83cf6afb71c84d3e5536c510c8c
Instruction Fuzzy Hash: 17512870B102189FFF74666CD95473F2E9FE789300F20592AE80AD33D9CA69CC464792

Function 06B053F8 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0edd84a7d3eaaf384cadc705152801f45ef43b47a7ac2aab0a730c63fc396f80
Instruction ID: 0cd609b2bb0adb2f8133673f33ada94c9e921502ac85ce1b1b07262fe3b9d278
Opcode Fuzzy Hash: 0edd84a7d3eaaf384cadc705152801f45ef43b47a7ac2aab0a730c63fc396f80
Instruction Fuzzy Hash: 87414FB6E006099FDF70CEA9D980AAFFFB2FB44210F104969D216D7A94D330E9558F91

Function 06B0D950 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33817838dcad538b5b4a3c932f2ad4e1ec2e81049a59c70a0db4a9997fbe38ed
Instruction ID: f3ea6a8d53a9bf3d074634e0a6f328c91d2c25b7ed89e55cf07896e0ea000f3b
Opcode Fuzzy Hash: 33817838dcad538b5b4a3c932f2ad4e1ec2e81049a59c70a0db4a9997fbe38ed
Instruction Fuzzy Hash: 0831C870E1021A8FDF15DFA8C95069EBFB2FF85304F144569D405EB394DB71E8468B50

Function 06B02090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c573df5cf9d1f790bab6a022901bde8892e7abe1aa816094df0246e459fedef
Instruction ID: d75d512176c9d14ca77515862fbfbc16e07cd72f447eba6e2df9bf28a2ac4111
Opcode Fuzzy Hash: 8c573df5cf9d1f790bab6a022901bde8892e7abe1aa816094df0246e459fedef
Instruction Fuzzy Hash: E531CF70E002199FDB59DFA4D85869EBBB2FF89300F108529E906E7384DB71ED46CB50

Function 06B0208F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eda0524312dd2365dfee9556abf9cd55a95f4f4a6ffbf557251d5e283a6da60
Instruction ID: 3204d9714235515b66485c9fc1780573d61d669ab87e16542445251caa266af3
Opcode Fuzzy Hash: 4eda0524312dd2365dfee9556abf9cd55a95f4f4a6ffbf557251d5e283a6da60
Instruction Fuzzy Hash: 0631CF70E102199FDB59DFA4D85869EBBB2FF89300F108529E906E7384DB71AD46CB50

Function 06B03A80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ace70fcd82b9c6204bffc4baab21525baffb498351ce50b7413453706dc0210
Instruction ID: 994080229934e301b21b39d606b0949096d7f3f604311c37f3195912e5a04ae8
Opcode Fuzzy Hash: 9ace70fcd82b9c6204bffc4baab21525baffb498351ce50b7413453706dc0210
Instruction Fuzzy Hash: 17217AB5F102169FEB40DF69EC80AEEBBF5EB48610F108165E909E7281E730D8418B95

Function 06B03A90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f113e7ba19b3f439d83630803df6b62945d6db3691eb648de0cd64092f60dcb
Instruction ID: 0aeb085a9b11f959317cf3d2e2657ddbd2975e6dabb809645cf29336691ce178
Opcode Fuzzy Hash: 5f113e7ba19b3f439d83630803df6b62945d6db3691eb648de0cd64092f60dcb
Instruction Fuzzy Hash: B021B075F002169FEB50DF69D880AAEBBF1EB48710F108165E909E7381E731DC01CB94

Function 0111D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2965356119.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_111d000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 285b71e9c5b918f1115bd7a1fb5f9d01bcbe0d24af3877be1edc59dd10873687
Instruction ID: a68a018b199427d66719e6c8ca6f13d68ee41276579473aba7215e994f02d065
Opcode Fuzzy Hash: 285b71e9c5b918f1115bd7a1fb5f9d01bcbe0d24af3877be1edc59dd10873687
Instruction Fuzzy Hash: 0C212271604200DFCF19DF58E988B2AFBA5EB84314F20C67DD8094B25AC33AD846CA62

Function 06B06D00 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d216246aea00753374cc6c567c1c23404a2b5053b645df6679f7a10e5c439a62
Instruction ID: acf586297770923ea4e6fbbfe2474ded6d52ddf6f11a1466dabb185e55d87b3b
Opcode Fuzzy Hash: d216246aea00753374cc6c567c1c23404a2b5053b645df6679f7a10e5c439a62
Instruction Fuzzy Hash: 4421D570F100199FEF94DB69E85066EBFB6EB84310F248675D405DB380EB31AC518785

Function 06B03BA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 026f99f06b2f4d047467c951d7a0ff7f46536aa44cdfcec825930abceb4fff8c
Instruction ID: 8f3f08661d422965cf8ce3a83a47629ce3296f89e0a798e7692e0f3c12a6029a
Opcode Fuzzy Hash: 026f99f06b2f4d047467c951d7a0ff7f46536aa44cdfcec825930abceb4fff8c
Instruction Fuzzy Hash: 5F11A171F141255FEF549668DC18AAF7BEAEBC8210F01457AD40AE7384EE64DC028BD5

Function 06B041E2 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b501e25cb128f5b4b4648e3154e1444f2c5b28e1163426b3fcb53c09451f11
Instruction ID: 22724e07b0a3f2d2cd6f30d39ebfe088e8bd26193d4695ca60c2ef83a572607a
Opcode Fuzzy Hash: e6b501e25cb128f5b4b4648e3154e1444f2c5b28e1163426b3fcb53c09451f11
Instruction Fuzzy Hash: 8D012471B141105FEBA5A6BDA80031AAFDAEBCA710F1084BAE20ECB395DE55CC434392

Function 06B0A2F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a353a9f0d39779f260342fe421d00a53ecbfb6e5cbc2c29c4c21b8442e6ef5
Instruction ID: 5f033a2439a1f6132105d0836a558620cb54cb796f6f2b87592c286660923e51
Opcode Fuzzy Hash: f4a353a9f0d39779f260342fe421d00a53ecbfb6e5cbc2c29c4c21b8442e6ef5
Instruction Fuzzy Hash: F101B9B0F103101FD7B5967DE56476EBBD5EB4A754F105869E40AC73D5EA11DC0283C1

Function 06B03B8F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1301a3622cd852f4ee06345d6235b8c406d04311a8303fe3cbe49493de0c1aef
Instruction ID: c77e143b68a3b2866ede4afeaae9746b6f7ba94fdc3cfbdf223b98232a83b89c
Opcode Fuzzy Hash: 1301a3622cd852f4ee06345d6235b8c406d04311a8303fe3cbe49493de0c1aef
Instruction Fuzzy Hash: 3601F571F041261BEF9496799C186EB7FEADBC5614F0440BAD80AE7284EF619C4287D2

Function 06B03859 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0708cf88ce34afa350660d9f13df96b1def5842371046c5c817b9658c8ef830f
Instruction ID: 879a72c4edb25d815dc03150b81114d5cdad97f079afd9ba7f0455deab573219
Opcode Fuzzy Hash: 0708cf88ce34afa350660d9f13df96b1def5842371046c5c817b9658c8ef830f
Instruction Fuzzy Hash: A621F2B1D01219EFCB00DF9AD884ACEFFB8FB48320F10816AE518A7240C374A554CFA5

Function 06B0F171 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53d5b3ba53878de0d93464f25f761ef445cc1e0a8f8f0dee2129d58df5bcf92
Instruction ID: 45ced3fcd940a11a95a30d42db7bd03aa363928b49794c2216760497d05f3a3b
Opcode Fuzzy Hash: b53d5b3ba53878de0d93464f25f761ef445cc1e0a8f8f0dee2129d58df5bcf92
Instruction Fuzzy Hash: B101B171B101205BEB759A7DE85473E7BDAEBC9614F244479E90ACB385EA21DC034381

Function 0111D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2965356119.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_111d000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: d501e67a670fed5df8b19e0a9e4e1150fd6df58e6f23b57d88c6f4d20eea1c58
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 0F11D075504280CFDB16CF58D5C4B15FF71FB84314F24C6AAD8494B656C33AD44ACB62

Function 06B03860 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ee0ee272b19d9e7674733b92ffea059a86d4ff9609820b17110c5c829aa94f7
Instruction ID: 27131001efd76fb15b7010eee1d95c455647934efeabd1faf0ec3987442d3ce1
Opcode Fuzzy Hash: 1ee0ee272b19d9e7674733b92ffea059a86d4ff9609820b17110c5c829aa94f7
Instruction Fuzzy Hash: E111C2B1D01259AFCB00DF9AD884ADEFFB4FB48310F10816AE518A7240C374A544CFA5

Function 06B041F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bca3c940d4cfb3218b116da7cf017832c061e0e1829cc824d352b2fd79f73c9
Instruction ID: df021bc7cb381dd13cf3a4aca2d7a9dfa1cd30e43c4ea994b6d4781c21ae0bab
Opcode Fuzzy Hash: 6bca3c940d4cfb3218b116da7cf017832c061e0e1829cc824d352b2fd79f73c9
Instruction Fuzzy Hash: CB01D171B200115FEBA4A6BDE84072BEADAEBC9720F109479E20EC7394DE61DC430395

Function 06B0F180 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b7cab62a4209ef182a47588d21627e6a78edd2fb2c7086d528f905ad9bd849
Instruction ID: 808aa3df40fee3a9f3ac560934e304af95e2318d4d3ae9345bfb9c82564071c8
Opcode Fuzzy Hash: e0b7cab62a4209ef182a47588d21627e6a78edd2fb2c7086d528f905ad9bd849
Instruction Fuzzy Hash: 2701D1B1B100201BEBB4966DE96473F6ADAEBCD610F208439E90AC7384EE21DC030381

Function 06B0A300 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a0c14c6616b57c02fe2f46d2f581d8892ffdce5592adf9cfb4b3bf8f33b4382
Instruction ID: 69774f2605c12cc2828d5ed02a3dda3a73b7ebe992610f154217acecaed2e85e
Opcode Fuzzy Hash: 2a0c14c6616b57c02fe2f46d2f581d8892ffdce5592adf9cfb4b3bf8f33b4382
Instruction Fuzzy Hash: 79016D70B102141BDBB49A6DE564B2EBBD9E78E614F109979E50EC73C5EA21EC028381

Function 06B06461 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840e79fac287cb903ca390d11dd9b539f0e94985ebd9122fe5dc295d316e8d51
Instruction ID: e864a6e452569b2de087254aa7259a86316c479f0a870fc543ba900fd3a956d9
Opcode Fuzzy Hash: 840e79fac287cb903ca390d11dd9b539f0e94985ebd9122fe5dc295d316e8d51
Instruction Fuzzy Hash: 71E092F0E112097BFFA0CE74895579E7FAAEB42214F2049E1D404CB181F632D96182A1

Non-executed Functions

Function 06B07688 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B077C8
$^q, xrefs: 06B07C2E
$^q, xrefs: 06B07C24
$^q, xrefs: 06B07B79
$^q, xrefs: 06B077ED
$^q, xrefs: 06B07C18
$^q, xrefs: 06B077BC
$^q, xrefs: 06B07C3A
$^q, xrefs: 06B07B85
$^q, xrefs: 06B077F9

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: df4551c09d80ead96d8d6bb7de2e3967797fd4d84c6cd1632b508ad4b5fbb121
Instruction ID: 0a8ee6d17407a5dc4ca85867f2f83658df328e89bf8365600a01095f0fd7f58a
Opcode Fuzzy Hash: df4551c09d80ead96d8d6bb7de2e3967797fd4d84c6cd1632b508ad4b5fbb121
Instruction Fuzzy Hash: B9121D70E002198FDB68DF65D954A6DBBB6FF88304F2085A9D409AB394DF31ED85CB81

Function 06B0A920 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B0AA7D
$^q, xrefs: 06B0AA22
$^q, xrefs: 06B0AA16
$^q, xrefs: 06B0AADE
$^q, xrefs: 06B0AAA8
$^q, xrefs: 06B0AA9C
$^q, xrefs: 06B0AAD2
$^q, xrefs: 06B0AA71

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 70e2232bd590862ecf9bc0759724bf46d0a53070de761882a160b0c82e5cb221
Instruction ID: b8e67a46256e3c554912ff4b4709f8349e5be1cfaab3a824bf3769224df5f057
Opcode Fuzzy Hash: 70e2232bd590862ecf9bc0759724bf46d0a53070de761882a160b0c82e5cb221
Instruction Fuzzy Hash: 62917F70E00309DFEB68DF65D954B6E7FB2EF44304F208969E4029B2D6DB759845CB90

Function 06B07088 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B0736A
$^q, xrefs: 06B0759C
$^q, xrefs: 06B073D0
.5vq, xrefs: 06B070E3
$^q, xrefs: 06B07524
$^q, xrefs: 06B07590
$^q, xrefs: 06B073C4

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 31b89238b76d5b7e57efae0334c50096c0d6416f0238ee91c96fb4c555fccd6e
Instruction ID: 2fd0311123911904bd572bb9362a9bd553b330cb87a2117c3047d62a476ec43a
Opcode Fuzzy Hash: 31b89238b76d5b7e57efae0334c50096c0d6416f0238ee91c96fb4c555fccd6e
Instruction Fuzzy Hash: 98F13070E00209CFDB59EB65D554A6EBBB6FF88304F148568D4069B3A9DF71EC86CB80

Function 06B083C0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B0861A
$^q, xrefs: 06B08626
$^q, xrefs: 06B0868B
$^q, xrefs: 06B0867F

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: f4d5b6ba451a59f170047392b24e517dbcde0da0a5a0675ac79da432e1595fdc
Instruction ID: fb5a23b33cdb1767824db38e6ec7e374078f2c519b5917251042434ed3180aab
Opcode Fuzzy Hash: f4d5b6ba451a59f170047392b24e517dbcde0da0a5a0675ac79da432e1595fdc
Instruction Fuzzy Hash: 53B16D70F10209CFEB58DB69D58066EBBB6FF88304F248569D4069B399DB71DD82CB80

Function 06B087D8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B08863
LR^q, xrefs: 06B088CB
LR^q, xrefs: 06B0891A
$^q, xrefs: 06B08857

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: cab47c5e1dd5a872c5b7791e505d0625ed7b9b20ddf7867f0e95e1f27af03377
Instruction ID: a8655f1f3135632510ebb21ad1a08f5d8be8160dc8e3f7d13304d42ba416b0ec
Opcode Fuzzy Hash: cab47c5e1dd5a872c5b7791e505d0625ed7b9b20ddf7867f0e95e1f27af03377
Instruction Fuzzy Hash: F5519270B102058FEB58EB29D540A6ABFE5FB84304F1496A8E4069B3A9DB31ED45CB51

Function 06B0ACA8 Relevance: 5.2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B0AE84
$^q, xrefs: 06B0ADD9
$^q, xrefs: 06B0AE5B
$^q, xrefs: 06B0AE2C

Memory Dump Source

Source File: 0000000D.00000002.2980990767.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6b00000_eWJxJJ.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: db003ea589656c8e748ead363f0337b366f460bfb85ab47b0efd4edfd381297b
Instruction ID: ec2a77cb0ae257315ce6bf43a27b9aa3e4a38c57bea40278d80980676acbc3af
Opcode Fuzzy Hash: db003ea589656c8e748ead363f0337b366f460bfb85ab47b0efd4edfd381297b
Instruction Fuzzy Hash: 4D518570E103059FEF65EB64D9806ADBFB6FB48204F205A69D806DB395DB31DC42CB51

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xJZHVgxQul.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\eWJxJJ.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xJZHVgxQul.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4dzfumwj.pdt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5b5pjbqw.a1l.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_art2xoni.zw5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_heipoja3.qt3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_muwgycz1.ee5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q3zi4onu.qyv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rkkruh2v.cld.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tooqpcsf.3rn.psm1

C:\Users\user\AppData\Local\Temp\tmp6409.tmp

C:\Users\user\AppData\Local\Temp\tmp75DB.tmp

C:\Users\user\AppData\Roaming\eWJxJJ.exe

Windows Analysis Report
xJZHVgxQul.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre