Edit tour

Windows Analysis Report
5hD3Yjf7xD.exe

Overview

General Information

Sample name:	5hD3Yjf7xD.exe renamed because original name is a hash value
Original sample name:	81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe
Analysis ID:	1588669
MD5:	c63d82258f1ff64d0f21b6bc5c2be1e5
SHA1:	1f270b930f58dacf5f18b2658191ca300283ada0
SHA256:	81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b
Tags:	AgentTeslaexeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

5hD3Yjf7xD.exe (PID: 7504 cmdline: "C:\Users\user\Desktop\5hD3Yjf7xD.exe" MD5: C63D82258F1FF64D0F21B6BC5C2BE1E5)

powershell.exe (PID: 7696 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7728 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qIQACwuR.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 8160 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7764 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp7052.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

5hD3Yjf7xD.exe (PID: 7952 cmdline: "C:\Users\user\Desktop\5hD3Yjf7xD.exe" MD5: C63D82258F1FF64D0F21B6BC5C2BE1E5)

qIQACwuR.exe (PID: 8120 cmdline: C:\Users\user\AppData\Roaming\qIQACwuR.exe MD5: C63D82258F1FF64D0F21B6BC5C2BE1E5)

schtasks.exe (PID: 2216 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp8745.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

qIQACwuR.exe (PID: 2168 cmdline: "C:\Users\user\AppData\Roaming\qIQACwuR.exe" MD5: C63D82258F1FF64D0F21B6BC5C2BE1E5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "web@iaa-airferight.com", "Password": "webmaster"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.2591696944.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2591696944.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.2592897583.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.2592897583.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.2592897583.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2591696944.0000000002CC9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 5hD3Yjf7xD.exe PID: 7504	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5hD3Yjf7xD.exe PID: 7504	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 5hD3Yjf7xD.exe PID: 7504	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 5hD3Yjf7xD.exe PID: 7952	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5hD3Yjf7xD.exe PID: 7952	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: qIQACwuR.exe PID: 8120	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: qIQACwuR.exe PID: 2168	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: qIQACwuR.exe PID: 2168	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.5hD3Yjf7xD.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.5hD3Yjf7xD.exe.37a5e38.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.5hD3Yjf7xD.exe.37a5e38.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.5hD3Yjf7xD.exe.37a5e38.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.5hD3Yjf7xD.exe.37e0858.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.5hD3Yjf7xD.exe.37e0858.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.5hD3Yjf7xD.exe.37e0858.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.5hD3Yjf7xD.exe.37e0858.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.5hD3Yjf7xD.exe.37e0858.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.5hD3Yjf7xD.exe.37e0858.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.5hD3Yjf7xD.exe.37e0858.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e00f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e09f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.5hD3Yjf7xD.exe.37a5e38.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.5hD3Yjf7xD.exe.37a5e38.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.5hD3Yjf7xD.exe.37a5e38.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.5hD3Yjf7xD.exe.37a5e38.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa872f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa87a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e00b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa882b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e09d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa88bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e107:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8927:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e179:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8999:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e20f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a2f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\5hD3Yjf7xD.exe", ParentImage: C:\Users\user\Desktop\5hD3Yjf7xD.exe, ParentProcessId: 7504, ParentProcessName: 5hD3Yjf7xD.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe", ProcessId: 7696, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp8745.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp8745.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\qIQACwuR.exe, ParentImage: C:\Users\user\AppData\Roaming\qIQACwuR.exe, ParentProcessId: 8120, ParentProcessName: qIQACwuR.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp8745.tmp", ProcessId: 2216, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DesusertionIp: 46.175.148.58, DesusertionIsIpv6: false, DesusertionPort: 25, EventID: 3, Image: C:\Users\user\Desktop\5hD3Yjf7xD.exe, Initiated: true, ProcessId: 7952, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49752

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp7052.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp7052.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\5hD3Yjf7xD.exe", ParentImage: C:\Users\user\Desktop\5hD3Yjf7xD.exe, ParentProcessId: 7504, ParentProcessName: 5hD3Yjf7xD.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp7052.tmp", ProcessId: 7764, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\5hD3Yjf7xD.exe", ParentImage: C:\Users\user\Desktop\5hD3Yjf7xD.exe, ParentProcessId: 7504, ParentProcessName: 5hD3Yjf7xD.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe", ProcessId: 7696, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp7052.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp7052.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\5hD3Yjf7xD.exe", ParentImage: C:\Users\user\Desktop\5hD3Yjf7xD.exe, ParentProcessId: 7504, ParentProcessName: 5hD3Yjf7xD.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp7052.tmp", ProcessId: 7764, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.5hD3Yjf7xD.exe.37e0858.5.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "web@iaa-airferight.com", "Password": "webmaster"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe

ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: 5hD3Yjf7xD.exe	Virustotal: Detection: 79%			Perma Link
Source: 5hD3Yjf7xD.exe	ReversingLabs: Detection: 83%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 5hD3Yjf7xD.exe

Joe Sandbox ML: detected

Source: 5hD3Yjf7xD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49775 version: TLS 1.2

Source: 5hD3Yjf7xD.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: fjsSj.pdbSHA256 source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr
Source:	Binary string: fjsSj.pdb source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr

Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 4x nop then jmp 0BD80BECh		10_2_0BD80249
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 4x nop then jmp 0BD80BECh		10_2_0BD80406

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37e0858.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37a5e38.3.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View	IP Address: 46.175.148.58 46.175.148.58
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.9:49752 -> 46.175.148.58:25

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.iaa-airferight.com

Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: qIQACwuR.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 5hD3Yjf7xD.exe, 00000009.00000002.2591696944.0000000002CC9000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2592897583.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 5hD3Yjf7xD.exe, 00000000.00000002.1353644765.00000000027A8000.00000004.00000800.00020000.00000000.sdmp, 5hD3Yjf7xD.exe, 00000009.00000002.2591696944.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000A.00000002.1408097571.0000000003148000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2592897583.0000000003069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 5hD3Yjf7xD.exe, 00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2588513639.0000000000436000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: 5hD3Yjf7xD.exe, 00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp, 5hD3Yjf7xD.exe, 00000009.00000002.2591696944.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2588513639.0000000000425000.00000040.00000400.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2592897583.0000000003069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: 5hD3Yjf7xD.exe, 00000009.00000002.2591696944.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2592897583.0000000003069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: 5hD3Yjf7xD.exe, 00000009.00000002.2591696944.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2592897583.0000000003069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49775 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.2.5hD3Yjf7xD.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.5hD3Yjf7xD.exe.37a5e38.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.5hD3Yjf7xD.exe.37e0858.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.5hD3Yjf7xD.exe.37e0858.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.5hD3Yjf7xD.exe.37a5e38.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_00C8D584	0_2_00C8D584
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_04C87578	0_2_04C87578
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_04C801C8	0_2_04C801C8
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_04C801D8	0_2_04C801D8
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_04C87568	0_2_04C87568
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_06CF7EE0	0_2_06CF7EE0
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_06CFD430	0_2_06CFD430
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_06CF7ED9	0_2_06CF7ED9
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_06CFBC98	0_2_06CFBC98
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_06CFCA80	0_2_06CFCA80
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_06CFAA08	0_2_06CFAA08
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_02BEE6A1	9_2_02BEE6A1
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_02BE4A98	9_2_02BE4A98
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_02BEAA1B	9_2_02BEAA1B
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_02BE3E80	9_2_02BE3E80
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_02BE41C8	9_2_02BE41C8
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_067FA034	9_2_067FA034
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_067FB880	9_2_067FB880
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_06805588	9_2_06805588
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_068065E0	9_2_068065E0
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_0680B213	9_2_0680B213
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_06803040	9_2_06803040
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_06807D68	9_2_06807D68
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_06807688	9_2_06807688
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_068002F8	9_2_068002F8
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_0680E388	9_2_0680E388
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_0680003D	9_2_0680003D
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_06805CD3	9_2_06805CD3
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 10_2_012ED584	10_2_012ED584
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 10_2_0735ED6A	10_2_0735ED6A
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 10_2_07377EE0	10_2_07377EE0
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 10_2_0737D430	10_2_0737D430
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 10_2_0737B278	10_2_0737B278
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 10_2_0737AE40	10_2_0737AE40
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 10_2_07377ED9	10_2_07377ED9
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 10_2_0737BC98	10_2_0737BC98
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 10_2_0737AA08	10_2_0737AA08
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 10_2_0737CA80	10_2_0737CA80
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_016BA198	14_2_016BA198
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_016BE6A1	14_2_016BE6A1
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_016BA960	14_2_016BA960
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_016B4A98	14_2_016B4A98
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_016B3E80	14_2_016B3E80
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_016B41C8	14_2_016B41C8
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_06C47688	14_2_06C47688
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_06C465E0	14_2_06C465E0
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_06C45588	14_2_06C45588
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_06C47D68	14_2_06C47D68
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_06C4B20F	14_2_06C4B20F
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_06C42358	14_2_06C42358
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_06C45CE8	14_2_06C45CE8
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_06C4E388	14_2_06C4E388
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_06C40040	14_2_06C40040
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_06C40006	14_2_06C40006

Source: 5hD3Yjf7xD.exe

Static PE information: invalid certificate

Source: 5hD3Yjf7xD.exe, 00000000.00000002.1376631466.0000000008B60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 5hD3Yjf7xD.exe
Source: 5hD3Yjf7xD.exe, 00000000.00000002.1353644765.00000000027BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs 5hD3Yjf7xD.exe
Source: 5hD3Yjf7xD.exe, 00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs 5hD3Yjf7xD.exe
Source: 5hD3Yjf7xD.exe, 00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 5hD3Yjf7xD.exe
Source: 5hD3Yjf7xD.exe, 00000000.00000002.1376525398.00000000078D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs 5hD3Yjf7xD.exe
Source: 5hD3Yjf7xD.exe, 00000000.00000002.1352201832.00000000009BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 5hD3Yjf7xD.exe
Source: 5hD3Yjf7xD.exe, 00000000.00000002.1353644765.00000000027A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs 5hD3Yjf7xD.exe
Source: 5hD3Yjf7xD.exe, 00000000.00000000.1324979851.00000000003D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameChromeSetup.exe< vs 5hD3Yjf7xD.exe
Source: 5hD3Yjf7xD.exe, 00000000.00000002.1352201832.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerSQ vs 5hD3Yjf7xD.exe
Source: 5hD3Yjf7xD.exe, 00000000.00000002.1352201832.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowe: vs 5hD3Yjf7xD.exe
Source: 5hD3Yjf7xD.exe, 00000009.00000002.2589041143.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 5hD3Yjf7xD.exe
Source: 5hD3Yjf7xD.exe	Binary or memory string: OriginalFilenameChromeSetup.exe< vs 5hD3Yjf7xD.exe

Source: 5hD3Yjf7xD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 9.2.5hD3Yjf7xD.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.5hD3Yjf7xD.exe.37a5e38.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.5hD3Yjf7xD.exe.37e0858.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.5hD3Yjf7xD.exe.37e0858.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.5hD3Yjf7xD.exe.37a5e38.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 5hD3Yjf7xD.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: qIQACwuR.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@2/2

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe

File created: C:\Users\user\AppData\Roaming\qIQACwuR.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7796:120:WilError_03

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe

File created: C:\Users\user\AppData\Local\Temp\tmp7052.tmp

Jump to behavior

Source: 5hD3Yjf7xD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5hD3Yjf7xD.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5hD3Yjf7xD.exe	Virustotal: Detection: 79%
Source: 5hD3Yjf7xD.exe	ReversingLabs: Detection: 83%

Source: 5hD3Yjf7xD.exe	String found in binary or memory: appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={7845CB06-2203-CC75-ADD7-5EC2F08BF338}&lang=en&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&brand=RXQR&installdataindex=empty
Source: 5hD3Yjf7xD.exe	String found in binary or memory: appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={7845CB06-2203-CC75-ADD7-5EC2F08BF338}&lang=en&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&brand=RXQR&installdataindex=empty0

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe

File read: C:\Users\user\Desktop\5hD3Yjf7xD.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\5hD3Yjf7xD.exe "C:\Users\user\Desktop\5hD3Yjf7xD.exe"
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qIQACwuR.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp7052.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Users\user\Desktop\5hD3Yjf7xD.exe "C:\Users\user\Desktop\5hD3Yjf7xD.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\qIQACwuR.exe C:\Users\user\AppData\Roaming\qIQACwuR.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp8745.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process created: C:\Users\user\AppData\Roaming\qIQACwuR.exe "C:\Users\user\AppData\Roaming\qIQACwuR.exe"
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe"	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qIQACwuR.exe"	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp7052.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Users\user\Desktop\5hD3Yjf7xD.exe "C:\Users\user\Desktop\5hD3Yjf7xD.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp8745.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process created: C:\Users\user\AppData\Roaming\qIQACwuR.exe "C:\Users\user\AppData\Roaming\qIQACwuR.exe"	Jump to behavior

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Section loaded: wintypes.dll

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 5hD3Yjf7xD.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 5hD3Yjf7xD.exe

Static file information: File size 1111088 > 1048576

Source: 5hD3Yjf7xD.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 5hD3Yjf7xD.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: fjsSj.pdbSHA256 source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr
Source:	Binary string: fjsSj.pdb source: 5hD3Yjf7xD.exe, qIQACwuR.exe.0.dr

Source: 5hD3Yjf7xD.exe

Static PE information: 0x8E8E03F4 [Sun Oct 15 09:16:36 2045 UTC]

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_00C8F2A8 push ebx; retn 0004h	0_2_00C8F2C2
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_00C8F340 push edi; retn 0004h	0_2_00C8F34A
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_00C8F330 push esi; retn 0004h	0_2_00C8F33A
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_06CF200F push ds; iretd	0_2_06CF2016
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_06CF2000 push ds; iretd	0_2_06CF2006
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_06CF202B push ds; iretd	0_2_06CF202E
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 0_2_06CF6F93 push 6DF206CFh; iretd	0_2_06CF6FA2
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_02BE0C6D push edi; retf	9_2_02BE0C7A
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_067F3A40 push FC068EDAh; retf	9_2_067F3A4D
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Code function: 9_2_0680FFBF push es; ret	9_2_0680FFC0
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_016B0C6D push edi; retf	14_2_016B0C7A
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Code function: 14_2_06C4FFBF push es; ret	14_2_06C4FFC0

Source: 5hD3Yjf7xD.exe	Static PE information: section name: .text entropy: 7.201620048730543
Source: qIQACwuR.exe.0.dr	Static PE information: section name: .text entropy: 7.201620048730543

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe

File created: C:\Users\user\AppData\Roaming\qIQACwuR.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp7052.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: 5hD3Yjf7xD.exe PID: 7504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qIQACwuR.exe PID: 8120, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Memory allocated: C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Memory allocated: 2760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Memory allocated: 2650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Memory allocated: 8CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Memory allocated: 9CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Memory allocated: 9F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Memory allocated: AF00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Memory allocated: 2A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Memory allocated: 2C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Memory allocated: 4C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Memory allocated: 12E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Memory allocated: 3100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Memory allocated: 14F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Memory allocated: 9160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Memory allocated: A160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Memory allocated: A360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Memory allocated: B360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Memory allocated: 12C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Memory allocated: 3060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Memory allocated: 1600000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe

Code function: 10_2_0735BD19 sldt word ptr [eax]

10_2_0735BD19

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6599	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 462	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6537	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Window / User API: threadDelayed 5688	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Window / User API: threadDelayed 4153	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Window / User API: threadDelayed 8062
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Window / User API: threadDelayed 1802

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 7524	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep count: 6599 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8040	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep count: 462 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7972	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8060	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8016	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8140	Thread sleep count: 5688 > 30	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -99828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -99714s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -99609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8140	Thread sleep count: 4153 > 30	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -99500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -99372s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -99263s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -99134s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -99031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -98922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -98688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -98467s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -98354s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -98073s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -97766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -97656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -97540s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -97422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -97313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -97188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -97063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -96938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -96828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -96719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -96594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -96480s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -96372s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -96266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -96156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -96046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -95937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -95828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -95716s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -95589s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -95482s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -95312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -95203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -95092s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -94984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -94875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -94766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -94656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -94547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -94438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -94328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -94219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe TID: 8116	Thread sleep time: -94094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 7244	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep count: 32 > 30
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -29514790517935264s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 6260	Thread sleep count: 8062 > 30
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -99781s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 6260	Thread sleep count: 1802 > 30
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -99671s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -99562s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -99452s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -99343s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -99234s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -99124s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -99015s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -98904s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -98796s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -98687s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -98578s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -98468s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -98359s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -98249s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -98140s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -98031s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -97919s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -97812s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -97703s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -97593s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -97484s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -97374s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -97265s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -97156s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -97046s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -96937s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -96828s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -96718s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -96609s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -96500s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -96390s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -96281s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -96171s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -96062s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -95953s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -95843s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -95734s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -95617s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -95515s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -95405s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -95296s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -95187s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -95078s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -94968s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -94855s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -94750s >= -30000s
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe TID: 1968	Thread sleep time: -94640s >= -30000s

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 99828	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 99714	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 99609	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 99500	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 99372	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 99263	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 99134	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 99031	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 98922	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 98467	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 98354	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 98073	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 97766	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 97656	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 97540	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 97422	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 97313	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 97188	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 97063	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 96938	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 96828	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 96719	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 96594	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 96480	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 96372	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 96266	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 96156	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 96046	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 95937	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 95828	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 95716	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 95589	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 95482	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 95312	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 95203	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 95092	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 94984	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 94875	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 94766	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 94656	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 94547	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 94438	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 94328	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 94219	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Thread delayed: delay time: 94094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 99781
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 99671
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 99562
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 99452
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 99343
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 99234
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 99124
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 99015
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 98904
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 98796
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 98687
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 98578
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 98468
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 98359
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 98249
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 98140
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 98031
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 97919
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 97812
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 97703
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 97593
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 97484
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 97374
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 97265
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 97156
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 97046
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 96937
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 96828
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 96718
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 96609
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 96500
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 96390
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 96281
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 96171
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 96062
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 95953
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 95843
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 95734
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 95617
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 95515
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 95405
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 95296
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 95187
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 95078
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 94968
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 94855
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 94750
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Thread delayed: delay time: 94640

Source: qIQACwuR.exe, 0000000A.00000002.1405052597.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: od_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 5hD3Yjf7xD.exe, 00000009.00000002.2589996019.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2591112770.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe"
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qIQACwuR.exe"
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe"	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qIQACwuR.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Memory written: C:\Users\user\Desktop\5hD3Yjf7xD.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Memory written: C:\Users\user\AppData\Roaming\qIQACwuR.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe"	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qIQACwuR.exe"	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp7052.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Process created: C:\Users\user\Desktop\5hD3Yjf7xD.exe "C:\Users\user\Desktop\5hD3Yjf7xD.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp8745.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Process created: C:\Users\user\AppData\Roaming\qIQACwuR.exe "C:\Users\user\AppData\Roaming\qIQACwuR.exe"	Jump to behavior

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Users\user\Desktop\5hD3Yjf7xD.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Users\user\Desktop\5hD3Yjf7xD.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Queries volume information: C:\Users\user\AppData\Roaming\qIQACwuR.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Queries volume information: C:\Users\user\AppData\Roaming\qIQACwuR.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37a5e38.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37e0858.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37e0858.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37a5e38.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2591696944.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2592897583.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2592897583.00000000030DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2591696944.0000000002CC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5hD3Yjf7xD.exe PID: 7504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5hD3Yjf7xD.exe PID: 7952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qIQACwuR.exe PID: 2168, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\5hD3Yjf7xD.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\qIQACwuR.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37a5e38.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37e0858.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37e0858.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37a5e38.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2591696944.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2592897583.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5hD3Yjf7xD.exe PID: 7504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5hD3Yjf7xD.exe PID: 7952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qIQACwuR.exe PID: 2168, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37a5e38.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37e0858.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37e0858.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5hD3Yjf7xD.exe.37a5e38.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2591696944.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2592897583.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2592897583.00000000030DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2591696944.0000000002CC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5hD3Yjf7xD.exe PID: 7504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5hD3Yjf7xD.exe PID: 7952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qIQACwuR.exe PID: 2168, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	111 Process Injection	3 Obfuscated Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5hD3Yjf7xD.exe	79%	Virustotal		Browse
5hD3Yjf7xD.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
5hD3Yjf7xD.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\qIQACwuR.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\qIQACwuR.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook

Name	IP	Active	Malicious	Reputation
mail.iaa-airferight.com	46.175.148.58	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
api.ipify.org	172.67.74.152	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.ipify.org	5hD3Yjf7xD.exe, 00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp, 5hD3Yjf7xD.exe, 00000009.00000002.2591696944.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2588513639.0000000000425000.00000040.00000400.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2592897583.0000000003069000.00000004.00000800.00020000.00000000.sdmp	false	high
https://account.dyn.com/	5hD3Yjf7xD.exe, 00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2588513639.0000000000436000.00000040.00000400.00020000.00000000.sdmp	false	high
https://api.ipify.org/t	5hD3Yjf7xD.exe, 00000009.00000002.2591696944.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2592897583.0000000003069000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	5hD3Yjf7xD.exe, 00000000.00000002.1353644765.00000000027A8000.00000004.00000800.00020000.00000000.sdmp, 5hD3Yjf7xD.exe, 00000009.00000002.2591696944.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000A.00000002.1408097571.0000000003148000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2592897583.0000000003069000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mail.iaa-airferight.com	5hD3Yjf7xD.exe, 00000009.00000002.2591696944.0000000002CC9000.00000004.00000800.00020000.00000000.sdmp, qIQACwuR.exe, 0000000E.00000002.2592897583.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	false
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588669
Start date and time:	2025-01-11 03:55:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5hD3Yjf7xD.exe renamed because original name is a hash value
Original Sample Name:	81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 173 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 184.28.90.27, 20.12.23.50
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:56:23	Task Scheduler	Run new task: qIQACwuR path: C:\Users\user\AppData\Roaming\qIQACwuR.exe
21:56:19	API Interceptor	175x Sleep call for process: 5hD3Yjf7xD.exe modified
21:56:21	API Interceptor	42x Sleep call for process: powershell.exe modified
21:56:25	API Interceptor	188x Sleep call for process: qIQACwuR.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.175.148.58	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse
	kzy8qg5lbR.exe	Get hash	malicious	AgentTesla	Browse
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	kzy8qg5lbR.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
s-part-0017.t-0009.t-msedge.net	02Eh1ah35H.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	AJ5zYYsisA.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	suBpo1g13Q.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	4N4nldx1wW.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	5by4QM3v89.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	uEuTtkxAqq.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	rwlPT9YJt0.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
api.ipify.org	ukBQ4ch2nE.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	ru52XOQ1p7.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	s2Jg1MAahY.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Y8Q1voljvb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	IUqsn1SBGy.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DpTbBYeE7J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLAGIDKOM-NETUA	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	kzy8qg5lbR.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
CLOUDFLARENETUS	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	https://freesourcecodes70738.emlnk.com/lt.php?x=3DZy~GDLVnab5KCs-Nu4WOae1qEoiN9xvxk1XaPMVXahD5B9-Uy.xuW-242imNX	Get hash	malicious	Unknown	Browse	104.17.205.31
	https://youtube.com0x360x380x370x340x370x340x370x300x370x330x330x610x320x660x320x660x360x310x360x640x360x360x370x320x320x650x370x320x370x350x320x660x370x320x360x620x320x650x370x300x360x380x370x300x330x660x360x390x360x340x330x640x330x320x330x300x330x300x320x360x370x330x360x390x370x340x360x350x350x660x360x390x360x340x330x640x370x330x330x310x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x320x360x310x360x650x360x650x360x350x370x320x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x330x360x630x360x390x360x330x360x620x320x360x360x350x370x360x360x350x360x650x370x340x330x330x330x640x330x310x320x620x320x350x330x320x340x360x320x620x320x350x330x350x340x320x330x320x330x350x330x300x320x350x330x350x340x340x320x620x320x350x330x350x340x320x360x390x360x650x360x340x360x350x370x380x350x660x360x320x350x660x360x330x320x350x330x350x340x340x320x620x320x350x340x340x330x300x320x350x330x390x330x330x320x350x340x340x330x300x320x350x340x320x340x320x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x300x320x350x340x320x330x320x320x350x340x340x330x300x320x350x340x320x340x340x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x310x320x350x330x380x340x360x320x620x320x350x340x340x330x310x320x350x330x380x330x310x320x350x340x340x330x310x320x350x330x380x330x320x320x350x340x340x330x340x370x380x360x340x390x320x390x330x370x320x330x300x390x340x370x330x340x300x330x340x2d0x380x380x340x330x340x370x330x340x300x340x390x300x350x370x330x370x340x330x300x340x300x330x340x380x320x2d0x340x300x390x340x380x2d0x320x2d0x340x380x380x320x2d0x330x320x380x380x340x370x370x320x390x390x320x380x380x380x340x370x340x370x320x390x300x340x390x340x370x320x340x300x380x320x340x370x340x370x320x620x320x640x320x620x320x350x340x340x330x300x320x350x330x390x330x340x320x350x340x340x330x300x320x350x340x320x330x350x320x350x340x340x330x300x320x350x340x320x340x330x320x350x340x340x330x300x320x350x340x320x330x380x320x350x340x340x330x300x320x350x340x320x340x310x320x350x340x340x330	Get hash	malicious	Unknown	Browse	172.64.41.3
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	AJ5zYYsisA.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	1SxKeB4u0c.exe	Get hash	malicious	FormBook	Browse	104.21.95.160
	SpCuEoekPa.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	AJ5zYYsisA.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	suBpo1g13Q.exe	Get hash	malicious	FormBook	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	AJ5zYYsisA.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	AJ5zYYsisA.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.74.152
	KtPCqWWnqM.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	YDg44STseR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	KtPCqWWnqM.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	ZoRLXzC5qF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\5hD3Yjf7xD.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qIQACwuR.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\qIQACwuR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379071839957789
Encrypted:	false
SSDEEP:	48:bWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugeC/ZPUyus:bLHxvIIwLgZ2KRHWLOug8s
MD5:	4135B00B11C8089FA64CF40DE44EDC1C
SHA1:	3490E9A1BCB4FDEC9332379CD669FB69BB74A601
SHA-256:	A5E4501942BD47C58D7C3934AB6443BC684A3AD54A5709CB62EC2B45504BDC63
SHA-512:	DCB00F8E5764F5710DEEEAC6A810585B07570ECB2753FE83E8604E422FCC7C6B26C52518F385A3483480BCD93B1DC8016C103AC82E7AB823C6C49AB23D079871
Malicious:	false
Preview:	@...e.................................&..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0a0fckuw.g3y.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0whdddrv.k3o.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cbyszcau.c0o.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ex32iry2.v12.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5vlzoyx.0tl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u2aqxl0m.zkt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xv0cq5dy.nt2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zo0gk4tj.tcw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp7052.tmp

Download File

Process:	C:\Users\user\Desktop\5hD3Yjf7xD.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	5.087655075329882
Encrypted:	false
SSDEEP:	48:cge2oHr8YrFdOFzOzN33ODOiDdKrsuTewGv:HeLwYrFdOFzOz6dKrsuqT
MD5:	E2A51E3B59F487185BE9ADFE09C1A5C5
SHA1:	A60D3FF3B031C2B6DC08573F405EEC9538014400
SHA-256:	A705FBBEEC3475E61C29B567A9FBA68053BF096588F1BA92FE840609848ADED0
SHA-512:	4F436860B9AB84B16BF7D19E7B623A51BC6D8622465315B20D5E5CD7F626C805CEB2BE0D7EED0A875BE58EFC11CEF9AFE723EFB9CE3B7498384B09E3D3EB44AD
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Local\Temp\tmp8745.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\qIQACwuR.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	5.087655075329882
Encrypted:	false
SSDEEP:	48:cge2oHr8YrFdOFzOzN33ODOiDdKrsuTewGv:HeLwYrFdOFzOz6dKrsuqT
MD5:	E2A51E3B59F487185BE9ADFE09C1A5C5
SHA1:	A60D3FF3B031C2B6DC08573F405EEC9538014400
SHA-256:	A705FBBEEC3475E61C29B567A9FBA68053BF096588F1BA92FE840609848ADED0
SHA-512:	4F436860B9AB84B16BF7D19E7B623A51BC6D8622465315B20D5E5CD7F626C805CEB2BE0D7EED0A875BE58EFC11CEF9AFE723EFB9CE3B7498384B09E3D3EB44AD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Roaming\qIQACwuR.exe

Download File

Process:	C:\Users\user\Desktop\5hD3Yjf7xD.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1111088
Entropy (8bit):	7.080929619354295
Encrypted:	false
SSDEEP:	12288:9pZsSjq5o5LUdMyQHuvKp35UZ27TfqSPwYbQsrEOW0tF:9zsQM/vKIE7TCSj8Cr5F
MD5:	C63D82258F1FF64D0F21B6BC5C2BE1E5
SHA1:	1F270B930F58DACF5F18B2658191CA300283ADA0
SHA-256:	81313224EE12F9A06F36E6F47F95F01B1BC30E94BF9C576F3C476B3633A0302B
SHA-512:	DF1C4A894FDB4497AA62B9C0B06CA6ABD5C60C701C56A0E5CF36530BA5D746A9A9A757A1A9DA2767A91E846D7BDF4A17DB7B157F65333FD2DE960AAE7C722509
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................................@.................................h...O.... ..................0L..........`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................H........x..l.......7....~..Ht...........................................0.............o.....8.....o....t.......u.........,@..t......o....r...po....-..o....r...po....+......,....o.......+&.u...........,...t........o....(........o....:t......u........,...o......*...................0...........#........}.....#........}.....#........}.....#.....L.@}......}......}.....s....}.....s....}.....sG...}.....sM...}......}......}.....(.......(.......{....(.......{!...(.......{....(.......

C:\Users\user\AppData\Roaming\qIQACwuR.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\5hD3Yjf7xD.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.080929619354295
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5hD3Yjf7xD.exe
File size:	1'111'088 bytes
MD5:	c63d82258f1ff64d0f21b6bc5c2be1e5
SHA1:	1f270b930f58dacf5f18b2658191ca300283ada0
SHA256:	81313224ee12f9a06f36e6f47f95f01b1bc30e94bf9c576f3c476b3633a0302b
SHA512:	df1c4a894fdb4497aa62b9c0b06ca6abd5c60c701c56a0e5cf36530ba5d746a9a9a757a1a9da2767a91e846d7bdf4a17db7b157f65333fd2de960aae7c722509
SSDEEP:	12288:9pZsSjq5o5LUdMyQHuvKp35UZ27TfqSPwYbQsrEOW0tF:9zsQM/vKIE7TCSj8Cr5F
TLSH:	1035942F287D1137E575C37F86D7A8A7A0B44C5E3084B86446E65B7C827E9123C8F62E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................................@................................

File Icon


Icon Hash:	2946e68e96b3ca4d

Static PE Info

General

Entrypoint:	0x4e0bba
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x8E8E03F4 [Sun Oct 15 09:16:36 2045 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	02/07/2021 01:00:00 11/07/2024 00:59:59
Subject Chain	CN=Google LLC, O=Google LLC, L=Mountain View, S=California, C=US
Version:	3
Thumbprint MD5:	DC429A22AA63D23DB8E84F53D05D1D48
Thumbprint SHA-1:	2673EA6CC23BEFFDA49AC715B121544098A1284C
Thumbprint SHA-256:	7D3D117664F121E592EF897973EF9C159150E3D736326E9CD2755F71E0FEBC0C
Serial:	0E4418E2DEDE36DD2974C3443AFB5CE5

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe0b68	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe2000	0x2b79a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x10a800	0x4c30
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xdf260	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xdebc0	0xdec00	8636caf4041ac26f84b09c5dd2732fdc	False	0.7520802644500562	data	7.201620048730543	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe2000	0x2b79a	0x2b800	4573d0114b4b418e76ada64508df8bc0	False	0.20976450251436782	data	5.124995116922287	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10e000	0xc	0x200	19c92e260def07186bb4202005378bad	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xe22b0	0x3751	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9929383518113127
RT_ICON	0xe5a04	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.0891251626641429
RT_ICON	0xf622c	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.13335610678999368
RT_ICON	0xff6d4	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.16816081330868762
RT_ICON	0x104b5c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.15594000944733113
RT_ICON	0x108d84	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.23392116182572614
RT_ICON	0x10b32c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.274624765478424
RT_ICON	0x10c3d4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.41885245901639345
RT_ICON	0x10cd5c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5
RT_GROUP_ICON	0x10d1c4	0x84	data	0.7045454545454546
RT_VERSION	0x10d248	0x368	data	0.40940366972477066
RT_MANIFEST	0x10d5b0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:56:22.535558939 CET	49741	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:22.535590887 CET	443	49741	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:22.535762072 CET	49741	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:22.542766094 CET	49741	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:22.542776108 CET	443	49741	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:23.033978939 CET	443	49741	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:23.034523964 CET	49741	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:23.037302017 CET	49741	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:23.037308931 CET	443	49741	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:23.037600994 CET	443	49741	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:23.133363008 CET	49741	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:23.179331064 CET	443	49741	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:23.248158932 CET	443	49741	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:23.248331070 CET	443	49741	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:23.248405933 CET	49741	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:23.262785912 CET	49741	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:24.487871885 CET	49752	25	192.168.2.9	46.175.148.58
Jan 11, 2025 03:56:25.531657934 CET	49752	25	192.168.2.9	46.175.148.58
Jan 11, 2025 03:56:27.449692965 CET	49775	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:27.449743032 CET	443	49775	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:27.449817896 CET	49775	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:27.453176022 CET	49775	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:27.453193903 CET	443	49775	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:27.547163963 CET	49752	25	192.168.2.9	46.175.148.58
Jan 11, 2025 03:56:27.909106016 CET	443	49775	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:27.909163952 CET	49775	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:27.911849976 CET	49775	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:27.911860943 CET	443	49775	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:27.912071943 CET	443	49775	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:28.048281908 CET	49775	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:28.099173069 CET	49775	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:28.139338017 CET	443	49775	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:28.213536978 CET	443	49775	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:28.213606119 CET	443	49775	172.67.74.152	192.168.2.9
Jan 11, 2025 03:56:28.213661909 CET	49775	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:28.216499090 CET	49775	443	192.168.2.9	172.67.74.152
Jan 11, 2025 03:56:29.366506100 CET	49786	25	192.168.2.9	46.175.148.58
Jan 11, 2025 03:56:30.531550884 CET	49786	25	192.168.2.9	46.175.148.58
Jan 11, 2025 03:56:31.562844038 CET	49752	25	192.168.2.9	46.175.148.58
Jan 11, 2025 03:56:32.531567097 CET	49786	25	192.168.2.9	46.175.148.58
Jan 11, 2025 03:56:36.531579971 CET	49786	25	192.168.2.9	46.175.148.58
Jan 11, 2025 03:56:39.578449965 CET	49752	25	192.168.2.9	46.175.148.58
Jan 11, 2025 03:56:44.547274113 CET	49786	25	192.168.2.9	46.175.148.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:56:22.488641977 CET	52094	53	192.168.2.9	1.1.1.1
Jan 11, 2025 03:56:22.495667934 CET	53	52094	1.1.1.1	192.168.2.9
Jan 11, 2025 03:56:24.465615034 CET	60956	53	192.168.2.9	1.1.1.1
Jan 11, 2025 03:56:24.478210926 CET	53	60956	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:56:22.488641977 CET	192.168.2.9	1.1.1.1	0xddd4	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:56:24.465615034 CET	192.168.2.9	1.1.1.1	0xc996	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:56:16.692831993 CET	1.1.1.1	192.168.2.9	0x959d	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:56:16.692831993 CET	1.1.1.1	192.168.2.9	0x959d	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:56:22.495667934 CET	1.1.1.1	192.168.2.9	0xddd4	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:56:22.495667934 CET	1.1.1.1	192.168.2.9	0xddd4	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:56:22.495667934 CET	1.1.1.1	192.168.2.9	0xddd4	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:56:24.478210926 CET	1.1.1.1	192.168.2.9	0xc996	No error (0)	mail.iaa-airferight.com		46.175.148.58	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49741	172.67.74.152	443	7952	C:\Users\user\Desktop\5hD3Yjf7xD.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 02:56:23 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-11 02:56:23 UTC	425	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 02:56:23 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 9001a220eff743af-EWR server-timing: cfL4;desc="?proto=TCP&rtt=5189&min_rtt=1675&rtt_var=2882&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1743283&cwnd=230&unsent_bytes=0&cid=2aedb0e25848fe5c&ts=218&x=0"
2025-01-11 02:56:23 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49775	172.67.74.152	443	2168	C:\Users\user\AppData\Roaming\qIQACwuR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 02:56:28 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-11 02:56:28 UTC	424	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 02:56:28 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 9001a23fed6c43a1-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1690&min_rtt=1676&rtt_var=639&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1742243&cwnd=233&unsent_bytes=0&cid=fa3db049575bb729&ts=309&x=0"
2025-01-11 02:56:28 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	21:56:18
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\5hD3Yjf7xD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5hD3Yjf7xD.exe"
Imagebase:	0x2f0000
File size:	1'111'088 bytes
MD5 hash:	C63D82258F1FF64D0F21B6BC5C2BE1E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1356446762.0000000003769000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:56:19
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\5hD3Yjf7xD.exe"
Imagebase:	0x920000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:56:20
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:56:20
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qIQACwuR.exe"
Imagebase:	0x920000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:56:20
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:56:20
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp7052.tmp"
Imagebase:	0x8b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:56:20
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:56:21
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\5hD3Yjf7xD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5hD3Yjf7xD.exe"
Imagebase:	0x850000
File size:	1'111'088 bytes
MD5 hash:	C63D82258F1FF64D0F21B6BC5C2BE1E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2591696944.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2591696944.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2591696944.0000000002CC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:56:23
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\qIQACwuR.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\qIQACwuR.exe
Imagebase:	0xb70000
File size:	1'111'088 bytes
MD5 hash:	C63D82258F1FF64D0F21B6BC5C2BE1E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:56:24
Start date:	10/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff72d8c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	21:56:26
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qIQACwuR" /XML "C:\Users\user\AppData\Local\Temp\tmp8745.tmp"
Imagebase:	0x8b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:56:26
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:56:26
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\qIQACwuR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\qIQACwuR.exe"
Imagebase:	0xb50000
File size:	1'111'088 bytes
MD5 hash:	C63D82258F1FF64D0F21B6BC5C2BE1E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2592897583.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2592897583.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2592897583.00000000030DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	55
Total number of Limit Nodes:	2

Executed Functions

Function 04C87578 Relevance: 3.4, Strings: 1, Instructions: 2103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$%q, xrefs: 04C875CD

Memory Dump Source

Source File: 00000000.00000002.1362779530.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c80000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID: $%q
API String ID: 0-3689577991
Opcode ID: eb64f6d7ad5a9dd0e768162511fe64058e1a3dfed69ccc00469a2849de030a68
Instruction ID: a9d571a524c2aaba382836d5f9ee2b8a793d2ee3a125123b58fdda7abf44413d
Opcode Fuzzy Hash: eb64f6d7ad5a9dd0e768162511fe64058e1a3dfed69ccc00469a2849de030a68
Instruction Fuzzy Hash: 7C33E734A11218CFDB25EF64C894EA9B7B6FF89304F5141E9E409AB361DB71AE85CF40

Function 04C87568 Relevance: 3.3, Strings: 1, Instructions: 2082
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$%q, xrefs: 04C875CD

Memory Dump Source

Source File: 00000000.00000002.1362779530.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c80000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID: $%q
API String ID: 0-3689577991
Opcode ID: b8bc3accd6090efa5effb24ae84bd49f6c2421504e86adfed0213c3012c6a1bc
Instruction ID: 0e8cb440576cddc7f0ca67c4216b82412a49f7f29d5555cf605d043e70d216c1
Opcode Fuzzy Hash: b8bc3accd6090efa5effb24ae84bd49f6c2421504e86adfed0213c3012c6a1bc
Instruction Fuzzy Hash: 1133E734A11218CFDB25EF64C894AE9B7B6FF8A304F5141E9E4096B361DB71AE85CF40

Function 06CF7ED9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de9e583eab32bc98efd2b6cc600ba46c26c539395296ffa72567a94b08fb52c6
Instruction ID: 2762c859e823572f7c3de6cd42df128108be3918ec24ed5955c1177115f4480e
Opcode Fuzzy Hash: de9e583eab32bc98efd2b6cc600ba46c26c539395296ffa72567a94b08fb52c6
Instruction Fuzzy Hash: EB21F3B1D116188BEB58CFABC8447DEFAF7AF89300F14C06AD508A62A4DB740945CFA0

Function 06CF7EE0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac01de02bd431cf304fecb37fb91babc661c76dee87997ec8acad297db47da0a
Instruction ID: 3a7ba00ce6fb7a17b2645df81a0ebebd14cd23549876e90755da91bc9081dd71
Opcode Fuzzy Hash: ac01de02bd431cf304fecb37fb91babc661c76dee87997ec8acad297db47da0a
Instruction Fuzzy Hash: 1A21C3B1D156188BEB58CFABC8447DEFAF7AFC9310F14C06AD509A6264DB7409458FA0

Function 06CFDFA4 Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06CFE1E6

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9dd364674c2f4674301021b9228e0db435136f059fc545450aaf0d3947bf5deb
Instruction ID: ae41c4a248e1ae5f15bf8c6a3e71082c8ba95b14f9b819f0170017ddd4747021
Opcode Fuzzy Hash: 9dd364674c2f4674301021b9228e0db435136f059fc545450aaf0d3947bf5deb
Instruction Fuzzy Hash: DAA1AD70D10259DFEBA0CFA9CC40BDDBBB2BF48300F048569E904A7290DB759A85CF91

Function 06CFDFB0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06CFE1E6

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0167920d3b6680029e7ea2b287ccf35abbcaeac7c5d349bee8fdfbc74b1aa4ef
Instruction ID: cea8e81a8f4734998220ae271c3ca2b7557e13d4bc7afacca4eeb01cdf1f998f
Opcode Fuzzy Hash: 0167920d3b6680029e7ea2b287ccf35abbcaeac7c5d349bee8fdfbc74b1aa4ef
Instruction Fuzzy Hash: BE918D70D102599FEBA0CFA9CC417DDBBB2BF48310F048569E908A7290DB759A85CF91

Function 00C8449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C859C9

Memory Dump Source

Source File: 00000000.00000002.1352987444.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_5hD3Yjf7xD.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 11084ad2646f6b3c96ff5aa562879c3b839fb7f625f9dd216a14ec5462b18f9f
Instruction ID: de216b55572efc15dde6b91fb64bb5994e546dabc80f58278e12f111fb51345b
Opcode Fuzzy Hash: 11084ad2646f6b3c96ff5aa562879c3b839fb7f625f9dd216a14ec5462b18f9f
Instruction Fuzzy Hash: D541B2B0D04719CBDB24DFA9C884BDEBBB5BF48704F20816AD418AB251DBB56946CF50

Function 00C8590C Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C859C9

Memory Dump Source

Source File: 00000000.00000002.1352987444.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_5hD3Yjf7xD.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a9661df78db2a1922c781ea665c5b3f2fa66cd240b54d1e187b99d01d1b5aa61
Instruction ID: 4f883ba443904d73c1d9b29bcca6edc41a5ada3face7e919eac763e72eaca2e2
Opcode Fuzzy Hash: a9661df78db2a1922c781ea665c5b3f2fa66cd240b54d1e187b99d01d1b5aa61
Instruction Fuzzy Hash: 5E41C2B1D00719CBEB24DFA9C8847DDBBF2BF48704F20816AD418AB251DBB56986CF50

Function 04C841E0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04C842A1

Memory Dump Source

Source File: 00000000.00000002.1362779530.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c80000_5hD3Yjf7xD.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 1beaf9b1aac188e16717a1805767d45ae558c7338c5b5001e8e223dc6c990a64
Instruction ID: e953e2245e09a2341115483e9d3fa1928b721aadf84aee9196262cc9fde88c51
Opcode Fuzzy Hash: 1beaf9b1aac188e16717a1805767d45ae558c7338c5b5001e8e223dc6c990a64
Instruction Fuzzy Hash: A7413AB8904305DFDB14DF89C448BAABBF6FB88314F25C459D518AB321D374A841CFA4

Function 06CD5D50 Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 06CD5DEF

Memory Dump Source

Source File: 00000000.00000002.1367387951.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd0000_5hD3Yjf7xD.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: aa807db35dbfe07a60e64a1683f298dd4b5cc4dddeeed7a927eabbb4dfc58f1e
Instruction ID: ca4c5477c238285e02cbf4eb0add6cd204c512cd716465de99bdaa4eadc52b53
Opcode Fuzzy Hash: aa807db35dbfe07a60e64a1683f298dd4b5cc4dddeeed7a927eabbb4dfc58f1e
Instruction Fuzzy Hash: 173102B5D003499FCB10CF9AD884AEEBBF4EB48320F54842EE919A7210D774A944CFA1

Function 06CFD920 Relevance: 1.6, APIs: 1, Instructions: 75
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06CFD9B8

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e75f8d797c2ac1286640dcee6d00dd70e7703f81b3b097f58d91f5a5ae13b058
Instruction ID: cf2e36d14e0edce5cf7a7d027033bf21066648b5bb6beb783c98c4d65bd6a0f3
Opcode Fuzzy Hash: e75f8d797c2ac1286640dcee6d00dd70e7703f81b3b097f58d91f5a5ae13b058
Instruction Fuzzy Hash: F7216BB19003099FDF40CFA9C841BDEBBF5FF48310F108429E959A7240DB74AA54CBA1

Function 06CD5D58 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 06CD5DEF

Memory Dump Source

Source File: 00000000.00000002.1367387951.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd0000_5hD3Yjf7xD.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: dd1370578aeac750d74e4d52515d2eb9e17ba235a9b987b29f5160b9060e41f3
Instruction ID: c170b9697bffc05972ff7313806d59d94dd6dd66a8558c1140f0fe1d09a62a63
Opcode Fuzzy Hash: dd1370578aeac750d74e4d52515d2eb9e17ba235a9b987b29f5160b9060e41f3
Instruction Fuzzy Hash: 3021C0B5D003499FDB10CF9AD884A9EFBF5FB58310F54842AE919A7210D775A944CFA0

Function 06CFD928 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06CFD9B8

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5557d196398db19012141d905ebe1315433953a66f353d656bb5a2333969dc9c
Instruction ID: 07cb8e8486faef7c65615b44fa143d1bee336acfb92bcd6fd2798c0f4d137a1b
Opcode Fuzzy Hash: 5557d196398db19012141d905ebe1315433953a66f353d656bb5a2333969dc9c
Instruction Fuzzy Hash: DE215AB19003499FDF40CFA9C8417DEBBF5FF48310F108429E959A7240CB749A40CBA0

Function 06CFD351 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06CFD3D6

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 552e8b67d833c3fcd68c530fe599b93d8123984a4c63d9cecf1378619d15456b
Instruction ID: c515d9a627c139705b4746ef8aff28f388de214ddf7739009e29aa32ccd0569c
Opcode Fuzzy Hash: 552e8b67d833c3fcd68c530fe599b93d8123984a4c63d9cecf1378619d15456b
Instruction Fuzzy Hash: 242125B19003099FDB50DFAAC4857EEBBF4AF48210F548429D559A7241C778A944CFA4

Function 06CFDA10 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06CFDA98

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 5e08c8b6f74668e755c7e7306f2cd41bde5d8369a3c1e9b44e6b21ad746d081d
Instruction ID: 3abf595ae8baa7bc736ceb79e90b252aaa7251232009b83c66a7c55540afea4a
Opcode Fuzzy Hash: 5e08c8b6f74668e755c7e7306f2cd41bde5d8369a3c1e9b44e6b21ad746d081d
Instruction Fuzzy Hash: E42136B1D003499FDB10DFAAC841BEEBBF5FF48310F50842AE919A7240DB75A941CBA5

Function 00C8BCA0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C8D7D6,?,?,?,?,?), ref: 00C8D897

Memory Dump Source

Source File: 00000000.00000002.1352987444.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_5hD3Yjf7xD.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 043f5c8059d38c0942df78166a2c3b90593e5153bdd6d223b818dff0fcdd10f4
Instruction ID: 5b5844e510acf54ed351f253937dd62b64ab4558110c3cb1529a0895c4d4d9c2
Opcode Fuzzy Hash: 043f5c8059d38c0942df78166a2c3b90593e5153bdd6d223b818dff0fcdd10f4
Instruction Fuzzy Hash: 382103B5D00248AFDB10DF9AD884BEEBBF4EB48310F14842AE958A7351D374A954CFA5

Function 00C8D808 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C8D7D6,?,?,?,?,?), ref: 00C8D897

Memory Dump Source

Source File: 00000000.00000002.1352987444.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_5hD3Yjf7xD.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 246b3dceb0b581ea5d24e86239a3e4b7c04aca4a7dd63ff416ab826b4438ba4b
Instruction ID: c751cdf88608126773847ea859cebe7279ccf664fe165a16c483c90eb766e45c
Opcode Fuzzy Hash: 246b3dceb0b581ea5d24e86239a3e4b7c04aca4a7dd63ff416ab826b4438ba4b
Instruction Fuzzy Hash: 5621E2B5D00248AFDB10CFAAD484BDEBBF4EB48320F14842AE958A7350D374A955CFA5

Function 06CFD358 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06CFD3D6

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 886d0e0bbadaf9f373344544406034719a0f4da80c10e6850698db72fdb34b91
Instruction ID: 07455aefce5db1af6f5e0481aebcfb0fd23af745595ac5a7fce1e93c1769235c
Opcode Fuzzy Hash: 886d0e0bbadaf9f373344544406034719a0f4da80c10e6850698db72fdb34b91
Instruction Fuzzy Hash: AD2135B1D003098FDB50DFAAC4857EEBBF4EF48310F54842AD559A7241CBB8A944CFA4

Function 06CFDA18 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06CFDA98

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1598f9b4267304bcd75ed5397f9df0c67e84ad192886ba4e68c113c78b0bfd6f
Instruction ID: 4bd14573acbe833ac5411b5a1e240552da973a7f984ff8538cad62efb0ff56ea
Opcode Fuzzy Hash: 1598f9b4267304bcd75ed5397f9df0c67e84ad192886ba4e68c113c78b0bfd6f
Instruction Fuzzy Hash: 122116B19003499FDB10DFAAC841BEEBBF5FF48310F50842AE959A7240D7759940CBA5

Function 06CFD860 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06CFD8D6

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8617d3fef48f02367c2a2a1f5ff7bf2a26a348de1bf42bd73d978bb5e59ad2ba
Instruction ID: 7aac5bcf897b95766843cf59e6908647d15073fbbc0e17c0ed105f2e99c3f64b
Opcode Fuzzy Hash: 8617d3fef48f02367c2a2a1f5ff7bf2a26a348de1bf42bd73d978bb5e59ad2ba
Instruction Fuzzy Hash: 331144B18003499FDB10DFAAC845BEEBBF5EF48310F14842AE959A7250C775A950CFA0

Function 06CFD2A0 Relevance: 1.6, APIs: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06CFD30A

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2238223429cc72505a8bee64bd51e710c5732f545e41028931de31813db5bf5d
Instruction ID: a38762a5fa2dbee22968b95db7dcdacd2e5e6c71f8afe69ce0fdf488da11a9f4
Opcode Fuzzy Hash: 2238223429cc72505a8bee64bd51e710c5732f545e41028931de31813db5bf5d
Instruction Fuzzy Hash: 821146B1C003488FDB10DFAAC8457EFBBF4EF88324F248429D519A7240CB79A944CBA4

Function 06CFD868 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06CFD8D6

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2c340387beefe32a01fe47e07480ebae32a65456af4142b2dcad805fb7c3b0cc
Instruction ID: dddd641b517d0c38290344156b78c839db8042282f55e241fc78b57197cf9f90
Opcode Fuzzy Hash: 2c340387beefe32a01fe47e07480ebae32a65456af4142b2dcad805fb7c3b0cc
Instruction Fuzzy Hash: C41126718003499FDF10DFAAC845BEEBBF5EF48310F14842AE555A7250C775A950CFA0

Function 06CFD2A8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06CFD30A

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f2d7f7efe163bc9a8945d0a17730e990b0d1f826f721b9b514e4b224e3480339
Instruction ID: f396728452fdb67172d0cd875adc150d5f4274801623710b4f952f2418384a8f
Opcode Fuzzy Hash: f2d7f7efe163bc9a8945d0a17730e990b0d1f826f721b9b514e4b224e3480339
Instruction Fuzzy Hash: 9F1125B1D003488FDB10DFAAC4457AEFBF4EF88324F248429D559A7240CB75A944CBA4

Function 00C8B118 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C8B17E

Memory Dump Source

Source File: 00000000.00000002.1352987444.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_5hD3Yjf7xD.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1d92ad26ec51c1794ac5589692157720c04dae8640e42db04d04bdb67cbabd13
Instruction ID: 22a05252e6601409720b79c1257f977d899ed4213aa701568c4ae26755450d92
Opcode Fuzzy Hash: 1d92ad26ec51c1794ac5589692157720c04dae8640e42db04d04bdb67cbabd13
Instruction Fuzzy Hash: BD11E3B5C007498FDB10DF9AC448BDEFBF4EB48714F10842AD469A7210D375A945CFA5

Function 00BBD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352628403.0000000000BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bbd000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f74d428182a1d9df87b474529e1f3de82745f2a30a2a50eea0cf59cc5f9b7fe
Instruction ID: c0a469072733986538cdc673068beccd5a1c702ed51c5fe95d47f5e309d11778
Opcode Fuzzy Hash: 9f74d428182a1d9df87b474529e1f3de82745f2a30a2a50eea0cf59cc5f9b7fe
Instruction Fuzzy Hash: 9F21F871504204DFDB05DF10D9C0B66BBA5FB98314F24C5A9D9090B356D3BAE856CBA2

Function 00BCD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352701275.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0fbf290b90410b86f2d49f168b3419bad25071520975475fdc020a20ef2387
Instruction ID: 716271222369da2a635521b055ed7fe5fd44b026db293f3420fdda1cdb405fa0
Opcode Fuzzy Hash: 8c0fbf290b90410b86f2d49f168b3419bad25071520975475fdc020a20ef2387
Instruction Fuzzy Hash: 1921D079604200DFDB14DF18D9D4F26BBA5EB88314F20C5BDD84A4B296C336D857CA62

Function 00BCD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352701275.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67cd174d2968657c0cee7bd4c6cf606d201d58da7d25461e25a1a8f24df3a1ff
Instruction ID: 749c69ff4c407fe9597267ce1d881196e815263b3990dee157c0251e8f59151f
Opcode Fuzzy Hash: 67cd174d2968657c0cee7bd4c6cf606d201d58da7d25461e25a1a8f24df3a1ff
Instruction Fuzzy Hash: B621FFB9604200EFDB05DF50D9C0F26BBA5FB88314F24C6BDE8494F292C336D856CA62

Function 00BCD006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352701275.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a51a03373238d44513673225a44ed9b0913de34314da0e45797fae6883765ad
Instruction ID: 76be472ee11eb08ff47e680b3cfb57b1010b9b33343a3c51d5f3e770b28d6dcd
Opcode Fuzzy Hash: 2a51a03373238d44513673225a44ed9b0913de34314da0e45797fae6883765ad
Instruction Fuzzy Hash: DF21A4795093808FCB12CF24D594B15BFB1EB45314F28C5EED8498B697C33AD80ACB62

Function 00BBD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352628403.0000000000BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bbd000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9223d17f0c59b9928f2445ae754a3689dedab5288f4c6dbc5edc2f4224d076
Instruction ID: 621dcdd8019afed2d6be7d488c0183e310273702c9966280ce068a3ac6070074
Opcode Fuzzy Hash: 8a9223d17f0c59b9928f2445ae754a3689dedab5288f4c6dbc5edc2f4224d076
Instruction Fuzzy Hash: 3311D376504240DFCB15CF10D5C4B66BFB1FB94324F24C6A9D8490B756C37AE85ACBA2

Function 00BCD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352701275.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b342587f02f4df216fd9fa4589941a60fabf0b5787ec5e4e812599987ae7f8
Instruction ID: 64659b2cb015f9815e510b3a4fd40e04c21c55c236135c19a00e9f7cdc37c3a8
Opcode Fuzzy Hash: 04b342587f02f4df216fd9fa4589941a60fabf0b5787ec5e4e812599987ae7f8
Instruction Fuzzy Hash: EE118B7A604280DFCB15CF10D9C4B15BBA1FB84314F24C6AED8494F696C33AD84ACB61

Function 00BBD731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352628403.0000000000BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bbd000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef2e95870b0c44ccc3d0b0ccd077e0bcfe75ec435476ac8b4c0a49b45a09232
Instruction ID: c80b620aa5b2c4e1c112161a1537d350d76f962c60e554175257b784356da34b
Opcode Fuzzy Hash: 8ef2e95870b0c44ccc3d0b0ccd077e0bcfe75ec435476ac8b4c0a49b45a09232
Instruction Fuzzy Hash: 9E01A7315083449BE7148A67CDC47F6FBD8DF51325F14C4A9ED494A182EABD9C44CBB2

Function 00BBD730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352628403.0000000000BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bbd000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df53165c29947f590c53e97eb99c40dc647f33f4cc32b40475cd63d7e3506f04
Instruction ID: 5ef8d3a8121fa8736b5e22ffc80f4d515698881163115abbd74d04216dcf7fb8
Opcode Fuzzy Hash: df53165c29947f590c53e97eb99c40dc647f33f4cc32b40475cd63d7e3506f04
Instruction Fuzzy Hash: AFF0CD32408344AFE7108A16C884BB2FFD8EB90734F18C49AED480E282D6B99C44CBB1

Non-executed Functions

Function 06CFBC98 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65bc7536b5c62ae7a9133e45bf91f401056d1a44632c469a6e9e195d8c770af
Instruction ID: 3dc40b5088bc3c97d786f3af2002c244d12451c707513215ea0d3eaa58c02725
Opcode Fuzzy Hash: c65bc7536b5c62ae7a9133e45bf91f401056d1a44632c469a6e9e195d8c770af
Instruction Fuzzy Hash: EDF18034A04308EFDB46DBB5D850BAE7BB2EF89310F1080A9E445A7395CB359E55CF91

Function 04C801D8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362779530.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c80000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c767fe096f37035c27af18ca770831df8d84dae194cf4b42b9446349edc3d7
Instruction ID: d789fe7d52de8e51f3d485d4ed8a248c18d0a251caa3b34ee61f77b7a20354c8
Opcode Fuzzy Hash: b9c767fe096f37035c27af18ca770831df8d84dae194cf4b42b9446349edc3d7
Instruction Fuzzy Hash: 6E1277B8C827468BE710CF66E98C1893BF1BB65718FD0CA1AD2611F2E1D7B4156ACF44

Function 06CFD430 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4946abc198992d6e4b31185b4ab1b625e4fe3a018f8e99ba2abe62a4d0d782f
Instruction ID: 2747addbce69daa379e17878f28c0c5efc8242dc90454705fa65d85e80dd418e
Opcode Fuzzy Hash: f4946abc198992d6e4b31185b4ab1b625e4fe3a018f8e99ba2abe62a4d0d782f
Instruction Fuzzy Hash: 6EE148B4E102598FDB54DFA8C580AAEFBB2FF89305F248169D515AB315C730AD41CFA0

Function 06CFCA80 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94739cbe937bebde4ef4e7ce7a58d0c770d8ddb5c5a56b56b142d328b728cfb
Instruction ID: 9366f53be3ee56b98646d38d17fd8fab851240dee958d47cd080f8ef93db01be
Opcode Fuzzy Hash: f94739cbe937bebde4ef4e7ce7a58d0c770d8ddb5c5a56b56b142d328b728cfb
Instruction Fuzzy Hash: 74E12674E102598FDB58DFA9C580AAEFBB2FF88305F248169D514AB356C730AD41CFA0

Function 06CFAA08 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367616585.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf0000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a689c657cc938a0deab7d3008a24cc0e2bb5ec2cc61c17e0960aad40bed7552d
Instruction ID: c217b17fc764fbf2409b621f51a44642af296c3259bcddf6d6ecb951e66784a4
Opcode Fuzzy Hash: a689c657cc938a0deab7d3008a24cc0e2bb5ec2cc61c17e0960aad40bed7552d
Instruction Fuzzy Hash: 62E11574E102598FDB54DFA9C580AAEFBF2BF88305F248169D918AB355C731AD41CFA0

Function 00C8D584 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1352987444.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904f0a0bc63c58c1433e8f6cc572eb7a27c8360c64c0959ad229b7069cb7dced
Instruction ID: 50f03c6f1f4e53c090cf33fa294eee736efb4fd001f1e71ec446da885b6c55b6
Opcode Fuzzy Hash: 904f0a0bc63c58c1433e8f6cc572eb7a27c8360c64c0959ad229b7069cb7dced
Instruction Fuzzy Hash: EBA14936E002098FCF05EFA4C84459EB7B2FF85308B25857EE815AB265DB71EA56CB40

Function 04C801C8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362779530.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c80000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c255006e40a22dc7045491a66d6d6c66c993e82ea52e59c8d0bb669d28ba599
Instruction ID: 9955f0f0ceb75c513ff3e8c7c6a9ed409668711899917fb9268c8d97155bd951
Opcode Fuzzy Hash: 5c255006e40a22dc7045491a66d6d6c66c993e82ea52e59c8d0bb669d28ba599
Instruction Fuzzy Hash: EFC1FAB8C817468BD714CF66E8882897BF1BFA5314F91CB1AD1612F2D0DBB415AACF44

Analysis Process: 5hD3Yjf7xD.exePID: 7952, Parent PID: 7504COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	97
Total number of Limit Nodes:	12

Executed Functions

Function 068065E0 Relevance: .8, Instructions: 816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca04a46defbd74e34ea32977f8c336172ab10c0aa6e826c72fbb34732c24f23
Instruction ID: d53a52cb59aa4fc16977dcb9bffee8808211ee524e568ba86fa3f700b0f93db8
Opcode Fuzzy Hash: 5ca04a46defbd74e34ea32977f8c336172ab10c0aa6e826c72fbb34732c24f23
Instruction Fuzzy Hash: ED629F34B002048FEB94DB68D954BADB7B2FF84310F148969E516EB394EB35ED91CB90

Function 06805588 Relevance: .6, Instructions: 609COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d30d75200e26b424fbf1f71c192d58ce2957ac7cb5a25e899e4a5e4f15c4a4
Instruction ID: e12e745d9c64cacb2e7cef029686245d7e683ad23fef7b958fdbdef09ab6275b
Opcode Fuzzy Hash: 05d30d75200e26b424fbf1f71c192d58ce2957ac7cb5a25e899e4a5e4f15c4a4
Instruction Fuzzy Hash: FF22B635E102148FEFA4DBA4C9806AEBBB2EF85310F148869D515EB395DB31DD41CFA2

Function 0680B213 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e378c257edb890d545ed9944c9817abf4bfb23ab62d6799e5568d95fdefc93
Instruction ID: 4742ac4a5f41fd269bdb962816b8e1f8092fca5ab42e0a6679b71408b2830613
Opcode Fuzzy Hash: b1e378c257edb890d545ed9944c9817abf4bfb23ab62d6799e5568d95fdefc93
Instruction Fuzzy Hash: 0E227134E102099FFFA4CB99D890BAEB7B1EB49310F248926E505DB3D1DB36DC818B51

Function 06803040 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60f25163cbb732e8c166fc355052bbd2b8464ae42e39c8b7304cc6c26ff4fdb
Instruction ID: 0be712ba17c6889e07cbb002eafbeab7380c75c707a04f4f429f415df94675db
Opcode Fuzzy Hash: b60f25163cbb732e8c166fc355052bbd2b8464ae42e39c8b7304cc6c26ff4fdb
Instruction Fuzzy Hash: C9322130E10619CFDB55EB79C8906ADB7B6BFC9300F50CAA9D446A7254EF30AD85CB90

Function 06807D68 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc68d5e6f5d1ac0edbd969b52cc4a9291b3150eba1a9ef4096994aaf9c67f32
Instruction ID: e1d5b02242d5971386e22b7735fcfc26bce7dcc989bfe624f0509de0d64bfc7a
Opcode Fuzzy Hash: bcc68d5e6f5d1ac0edbd969b52cc4a9291b3150eba1a9ef4096994aaf9c67f32
Instruction Fuzzy Hash: 2A027C70B006158FEF94EBA8D8507AEB7A2FF88710F148929D505DB395DB71EC86CB90

Function 067F2C82 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 067F2D06
GetCurrentThread.KERNEL32 ref: 067F2D43
GetCurrentProcess.KERNEL32 ref: 067F2D80
GetCurrentThreadId.KERNEL32 ref: 067F2DD9

Memory Dump Source

Source File: 00000009.00000002.2603111976.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_67f0000_5hD3Yjf7xD.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6019c9fd375f37fe448d4a0a75a0c4e4a97197bcb24decf972ab3ee170b9c668
Instruction ID: 922cdd23abc32302cdc8f069483084df846db9f08b29160287aa8ff363edbae4
Opcode Fuzzy Hash: 6019c9fd375f37fe448d4a0a75a0c4e4a97197bcb24decf972ab3ee170b9c668
Instruction Fuzzy Hash: 485169B0900609CFDB54CFA9D948BEEBBF1FF48314F208029E159A7361D7745948CB66

Function 067F2C88 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 067F2D06
GetCurrentThread.KERNEL32 ref: 067F2D43
GetCurrentProcess.KERNEL32 ref: 067F2D80
GetCurrentThreadId.KERNEL32 ref: 067F2DD9

Memory Dump Source

Source File: 00000009.00000002.2603111976.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_67f0000_5hD3Yjf7xD.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: fccab4bb306338bb52bcb5264f86f08c86ce50efeb50a6517a4ad7ed97f858c3
Instruction ID: 42a00a68719296dd176ddfefc0c330a16cf45a451161a80fb5221fa3adcacd5e
Opcode Fuzzy Hash: fccab4bb306338bb52bcb5264f86f08c86ce50efeb50a6517a4ad7ed97f858c3
Instruction Fuzzy Hash: 055158B0900609CFDB54DFAAD948BEEBBF1BF48314F208029D159A7361D7745948CB65

Function 067FB198 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 067FB3FE

Memory Dump Source

Source File: 00000009.00000002.2603111976.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_67f0000_5hD3Yjf7xD.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 723c7f37db2c58ef82095d7386cbc8ef1f3d6418be7394bfbb8f9a57c39f2470
Instruction ID: 62ac6912e2f587a1f6e7c047917f58c7d2445d9c1a9555cb7320b3bc589f82da
Opcode Fuzzy Hash: 723c7f37db2c58ef82095d7386cbc8ef1f3d6418be7394bfbb8f9a57c39f2470
Instruction Fuzzy Hash: AA815370A10B058FD7A4CF6AD445B6ABBF1FF88600F008A29D59AD7B40DB75E849CB91

Function 02BEEB38 Relevance: 1.7, APIs: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2591272586.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2be0000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b208e04094e5f850d98f281ca42692e321d39c230cc589f890f990c9dbcad2
Instruction ID: df8664d75eee3a4c0a7d4dac2906b9992f2fb0c1514ae3b5151866866f598708
Opcode Fuzzy Hash: 01b208e04094e5f850d98f281ca42692e321d39c230cc589f890f990c9dbcad2
Instruction Fuzzy Hash: 85516671E043899FDF15CF79D8443AEBBF5EF8A220F0485AAD446E7241DB74A841C7A1

Function 067FD384 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 067FD4A2

Memory Dump Source

Source File: 00000009.00000002.2603111976.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_67f0000_5hD3Yjf7xD.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 466199785fea566815458e1a59727cbd7dc4c1c5cbfd84279815ade040fdde23
Instruction ID: 2a75e63c99f48d605c12f22a4ea843ea4884a87578b012f28487e4dcb77b153f
Opcode Fuzzy Hash: 466199785fea566815458e1a59727cbd7dc4c1c5cbfd84279815ade040fdde23
Instruction Fuzzy Hash: 9951C1B1D103489FDB24CF9AC984ADEBBB5BF48310F24812AE918AB210D775A845CF90

Function 067FD390 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 067FD4A2

Memory Dump Source

Source File: 00000009.00000002.2603111976.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_67f0000_5hD3Yjf7xD.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 674195b89d377bb7aa0acdd26eee75c919acae9f71b774508da4ffa614c8a89f
Instruction ID: 0b7b209394264b57579aae583e4d1081652a27ab0b995ad90c6388296c533ca9
Opcode Fuzzy Hash: 674195b89d377bb7aa0acdd26eee75c919acae9f71b774508da4ffa614c8a89f
Instruction Fuzzy Hash: BA41B0B1D103099FDB14CF9AC984AEEBBB5FF48314F24812AE918AB250D775A845CF90

Function 067FFAFE Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 067FFB91

Memory Dump Source

Source File: 00000009.00000002.2603111976.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_67f0000_5hD3Yjf7xD.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: da68f1adc90cd719958ffd90c54456bce71242a6670608de5472e825f46db791
Instruction ID: f710cee8d35923a64d0aba87ce6510762c927221707f8edff4fe94f774eb7fdc
Opcode Fuzzy Hash: da68f1adc90cd719958ffd90c54456bce71242a6670608de5472e825f46db791
Instruction Fuzzy Hash: 7D3115B5A10205CFDB54CF55C888FAABBF5FF88314F24C899D6599B321D778A841CBA0

Function 067F2EC8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 067F2F57

Memory Dump Source

Source File: 00000009.00000002.2603111976.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_67f0000_5hD3Yjf7xD.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ed0256c6db6d798c05273720caa1bba584b80321907f76d6627c9de06be7a6b2
Instruction ID: d6da18faa4b7a45fe8d1b813cdb1116f25c3b544fe158a4b8b62525c6ec5a281
Opcode Fuzzy Hash: ed0256c6db6d798c05273720caa1bba584b80321907f76d6627c9de06be7a6b2
Instruction Fuzzy Hash: 932105B5D10208DFDB50CFAAD584AEEBBF4FB48310F14802AE958A7311D374A954CFA1

Function 067F2ED0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 067F2F57

Memory Dump Source

Source File: 00000009.00000002.2603111976.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_67f0000_5hD3Yjf7xD.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fcbabc1b1e29e34621a3051f0b6e0aee2cf903f16563a321a26bf75af5286b66
Instruction ID: 4335eea9eebed1fd02f9606455b313e50715deafcf9ee679e2fab166a5c28515
Opcode Fuzzy Hash: fcbabc1b1e29e34621a3051f0b6e0aee2cf903f16563a321a26bf75af5286b66
Instruction Fuzzy Hash: 7F21E4B5D10208DFDB10CF9AD984ADEBBF4FB48310F14802AE958A3351D374A954CFA5

Function 02BEEC20 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02BEEC87

Memory Dump Source

Source File: 00000009.00000002.2591272586.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2be0000_5hD3Yjf7xD.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 716c7b3e6b23b4dd8a8062100a61031dbc837281dc4398ad1ce5f5fdda544f29
Instruction ID: 36b11cea066e71619c5e3ee8feb87b1a032ce2333b7a3df609f98a86e31a0f38
Opcode Fuzzy Hash: 716c7b3e6b23b4dd8a8062100a61031dbc837281dc4398ad1ce5f5fdda544f29
Instruction Fuzzy Hash: 16111FB1C006599BCB10CF9AC544BDEFBF4EF48224F15816AD818A7240D378A944CFA5

Function 067FB398 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 067FB3FE

Memory Dump Source

Source File: 00000009.00000002.2603111976.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_67f0000_5hD3Yjf7xD.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e2d57641199f99967f6c414db8c2e34efc265e8bb37338e58c9db4be7e5791ef
Instruction ID: ef95a715b971d978514086bc8b8120e63e48b718b1aa423b670bd1d4d1733113
Opcode Fuzzy Hash: e2d57641199f99967f6c414db8c2e34efc265e8bb37338e58c9db4be7e5791ef
Instruction Fuzzy Hash: F711DFB5C006498FDB10CF9AC544BEEFBF4AF88624F10842AD959A7310D375A545CFA1

Function 0680CF28 Relevance: .8, Instructions: 803
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c982d7563942dd32ce387d547625cb78643720593f37a2c65492c0c2a3bcbd
Instruction ID: bca140c44c061562ba2991a95f3b854e64d401f169b4e447396901a8f97b602d
Opcode Fuzzy Hash: 80c982d7563942dd32ce387d547625cb78643720593f37a2c65492c0c2a3bcbd
Instruction Fuzzy Hash: D1622D30A00705CFEB55EFA8D990A5EB7A2FF84304B60CA68D005EF255DB71ED96CB91

Function 0680C170 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d205ae8047209d1a9c346e6c361621692ef95e4a07304a00a0e11ecb032ed9
Instruction ID: 1c7220bfc5a9004a278b788efc2447a24a994d1fbfb7bdc1768c2dfc784f36d1
Opcode Fuzzy Hash: c4d205ae8047209d1a9c346e6c361621692ef95e4a07304a00a0e11ecb032ed9
Instruction Fuzzy Hash: B9325274B102059FEB94DFA8D890BAEB7B6FB89310F108A29D505E7395DB31DC41CB91

Function 0680B630 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26496a53f0157853a82c0221948e03867e9bf2a6266627b067ed9d5f92e470b
Instruction ID: 0ea9b5d53c2b1db34e9b910d92a359b9577f7089c692f72c5af6d48d5dbef366
Opcode Fuzzy Hash: b26496a53f0157853a82c0221948e03867e9bf2a6266627b067ed9d5f92e470b
Instruction Fuzzy Hash: 8E026F30E10209CFEBA4DBA8D8947ADB7B1FF45314F20896AD515EB295DB32DC41CB91

Function 06802ABF Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb74359d7429fef8f27a99d6be9724bcd3c058245aa9666d4f047e8b586b85dd
Instruction ID: df926bf76985f50cc18cfad150900b2d63f09843806371bf21cfdbd9a18b5dd1
Opcode Fuzzy Hash: cb74359d7429fef8f27a99d6be9724bcd3c058245aa9666d4f047e8b586b85dd
Instruction Fuzzy Hash: C3024830A00204CFEBA4DB64C968A6DB7E2FF45354F54C8A9D51AEB291DBB1ED41CB90

Function 0680ACB8 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ad0eb163fb374bfbc1958b32be2c3ca0cccbac768f6c9ac50054bee20c36a2
Instruction ID: ca034f95f604ce00c51c8c951a79a74a5d3318c85ce6b8d98af89b28aa93215a
Opcode Fuzzy Hash: b3ad0eb163fb374bfbc1958b32be2c3ca0cccbac768f6c9ac50054bee20c36a2
Instruction Fuzzy Hash: 18E16130E103058FEBA9DBA8D8906AEB7B6FF85310F108929D506EB395DB71DC41CB91

Function 06809138 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74dab889c474cbf26cb1be3d2864e4eb9fbcc4f3a54c4473f63c45d465cdc3e
Instruction ID: cd98c86fb9940f8d9acd9487f4fffc409de9adb3e5c13d693d7669e6ecf45d1e
Opcode Fuzzy Hash: a74dab889c474cbf26cb1be3d2864e4eb9fbcc4f3a54c4473f63c45d465cdc3e
Instruction Fuzzy Hash: 8F915270B006198FDF94EB69D8607AE7BB6BFC8700F508569C509EB385EF309D459BA0

Function 068061E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc7f6b02b875e001c2c0457d7de3a918a64080683dc5b02e5fda48107e23a7c
Instruction ID: b603e7a42a56e4fc8307ff9972ec2631878c1e9816f20621abb0ed0da9c0c238
Opcode Fuzzy Hash: afc7f6b02b875e001c2c0457d7de3a918a64080683dc5b02e5fda48107e23a7c
Instruction Fuzzy Hash: 4861B371F001114FEF649B6ECC4066EBAE7AFC4610B554439D90ADB3A0EE76ED4287D1

Function 06804280 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f813f92a9bb74633a99de7c65188775141a0aeba8e18d84c8a7bfda6e1809547
Instruction ID: 7ad90c05f199241fecda2f29f467a9d9be7f56fb7227e6086c2b471969293b1e
Opcode Fuzzy Hash: f813f92a9bb74633a99de7c65188775141a0aeba8e18d84c8a7bfda6e1809547
Instruction Fuzzy Hash: D0816234B102048FDB94DFB9D8547AEBBF2AF89300F108528D50AEB395EB75DC429B91

Function 068045A0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b8e80fc6830ab346afd2e622206b37b863e24e0c6e1e1b4a609bd91e523d11
Instruction ID: ba5e0d2d302487d265df46bc19ae1a8ba162d642be62dde07e9d646d84a40ddd
Opcode Fuzzy Hash: 89b8e80fc6830ab346afd2e622206b37b863e24e0c6e1e1b4a609bd91e523d11
Instruction Fuzzy Hash: 38912E30E102598BEF60DF68C850B9DB7B1FF89310F208A99D549EB291DB71A985CF91

Function 068045B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc33f43ce2451c015d94dd28c2e2784f9bcf9404ab91586094b55571ee48b13f
Instruction ID: 4a50361ce2a274f962b78547933bdb675ae70e09876c5f3406e139b33b10f51f
Opcode Fuzzy Hash: cc33f43ce2451c015d94dd28c2e2784f9bcf9404ab91586094b55571ee48b13f
Instruction Fuzzy Hash: D4911F30E10619CBEF64DF68C850B9DB7B1FF89310F208A99D549BB294DB71A985CF90

Function 0680EEF0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75df64f6e6ae26b0a85b1e0510fff8bfe718d1d4b49e6a0591d299206b5c5812
Instruction ID: 025137caa433998724bf6e732cc1c6dcf653ada63b56a16e289706a4e8cfb537
Opcode Fuzzy Hash: 75df64f6e6ae26b0a85b1e0510fff8bfe718d1d4b49e6a0591d299206b5c5812
Instruction Fuzzy Hash: A3814170A002488FEB95DBA8D884AAEB7F6BF84300F14C969D505EB395DB70EC46CB51

Function 0680EF00 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d773c74178b79b85a7381acc2e32c05adce820eb5c5a4de8158bbb81fed5af4
Instruction ID: e39577ad4d1c91e78bb8bf002c323972d684fb37013659fce3ae171cf535e5b9
Opcode Fuzzy Hash: 3d773c74178b79b85a7381acc2e32c05adce820eb5c5a4de8158bbb81fed5af4
Instruction Fuzzy Hash: 1D714D70A002088FEB95DBA8D990AAEB7F6FF88300F14C969D515EB355DB70EC46CB51

Function 06804B50 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8dd56c55b2ac3ebd7c9571e032dd2d0ad8d9b9efe6ec06f94f9791f3630d55
Instruction ID: 06445958c610137574b7e8b8aff1b1604b5966ff4105f50fe3190366250e33d0
Opcode Fuzzy Hash: 0f8dd56c55b2ac3ebd7c9571e032dd2d0ad8d9b9efe6ec06f94f9791f3630d55
Instruction Fuzzy Hash: C5615E30F002189FEB549BA9C8147AEBAF6FF88710F208529D606EB394DF758C459B91

Function 0680FC58 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84665aa67f97ea989e470a03aa105818b48d1b3afdc67003e36f95258ff4822f
Instruction ID: 6695b243946ca9fac35b360c46124f483991ff3eb627c74535443761a8a34c8c
Opcode Fuzzy Hash: 84665aa67f97ea989e470a03aa105818b48d1b3afdc67003e36f95258ff4822f
Instruction Fuzzy Hash: 0251D531E00219DFEBA4EB78E8446ADB7B2FB85311F108C79DA06D7290DF359955C790

Function 0680FA0B Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d0d0867c080c9f39d7eafd29a8b0577a7a5527128d2133502c2bd78afa723d
Instruction ID: 6a2ec63538f392334e4c101c12b2d81c722fb786c7b3f18957cf9ef4446af5bb
Opcode Fuzzy Hash: d2d0d0867c080c9f39d7eafd29a8b0577a7a5527128d2133502c2bd78afa723d
Instruction Fuzzy Hash: C351A430B10214DBFFB496A9EC6477E275AD789310F208836EA0AD73D4CE69CC5587A1

Function 0680FA18 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc49d26acdc65137e7687f4e025b8e35ee61a6b7a14f2e6d224bae72859400b3
Instruction ID: c04f2fce7f257e1a27710b0a6f7cb0562323499041832e98c571b166742e80cc
Opcode Fuzzy Hash: dc49d26acdc65137e7687f4e025b8e35ee61a6b7a14f2e6d224bae72859400b3
Instruction Fuzzy Hash: A1517330B10214DBFFB4A6A9DC64B3E275AD789750F20883AEA0AD73D4CE79CC5547A1

Function 06809127 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cee5acd1878f89d887db4f817275bf261d80b2bd0d25cb0c45db75c34600d46
Instruction ID: 657d5511268f23b80fb18d173fe3d37c80ba50118f01c5f231c7fdc527aa800f
Opcode Fuzzy Hash: 9cee5acd1878f89d887db4f817275bf261d80b2bd0d25cb0c45db75c34600d46
Instruction Fuzzy Hash: 27514470B005158FDB95EB79D860BAE7BF6ABC8750F508469C50AE7385EF30AC41DBA0

Function 068053F8 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a90e19edf4c80154523f11dd9b059d42b93832654624661ba14795dadb4cc8b
Instruction ID: ebd2e0ff0413cee93a63f7c6b2159120a10aabb0a2bc6ce80f3fab24cce9a5cd
Opcode Fuzzy Hash: 4a90e19edf4c80154523f11dd9b059d42b93832654624661ba14795dadb4cc8b
Instruction Fuzzy Hash: 44416171E006099FEFB0CE99CD80AAEF7B2FB45310F108926D215D7690D230E9558FA2

Function 06804B40 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3de6d825b0ebcf8cd21dc5c6322d955f5a752735da42f57dce73748476937234
Instruction ID: 1aceb78742ba73f40509ea9932e7689292921e3489632c7df1c417cdd4bf7691
Opcode Fuzzy Hash: 3de6d825b0ebcf8cd21dc5c6322d955f5a752735da42f57dce73748476937234
Instruction Fuzzy Hash: 2F515D30A002189FEB55DFE9C814BAEBBF6BF88700F208529D605EB395DB759C05DB90

Function 0680DA9D Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b1bded856f1bc9b60fae8a484cc99abaa91e80929237e7c8b3e4b73cbd3134
Instruction ID: e0f45770aed92cdd0872122c5510c60570b40abe328d97b5dd147e975e408dcd
Opcode Fuzzy Hash: 37b1bded856f1bc9b60fae8a484cc99abaa91e80929237e7c8b3e4b73cbd3134
Instruction Fuzzy Hash: 71416030E04209DFEBA5DFA5C85069EBBB2BF85300F248929D906EB280DF75D942CB51

Function 068021D0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5612e02008af3b127dd7fe6482107d9468c07e24aa3061faf453982c3929c972
Instruction ID: 48c4f08bb133fdade72b4b4d92c18bd2363181df11bca6d29e7bcd3f3d21bc07
Opcode Fuzzy Hash: 5612e02008af3b127dd7fe6482107d9468c07e24aa3061faf453982c3929c972
Instruction Fuzzy Hash: C931D230B102058FEB99ABB8D86876E7BA3AF89710F10496CC402DB394DF75CD42C7A1

Function 068021CB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a70174b213a68fd5711486cbab5afbf70a885da64a76b5e5881dfb4187cc11
Instruction ID: b152960809ce59cacfec1da3ab41b2c0968716099634f7ae0bce5e07dca0050a
Opcode Fuzzy Hash: 14a70174b213a68fd5711486cbab5afbf70a885da64a76b5e5881dfb4187cc11
Instruction Fuzzy Hash: 2131E230B102058FEB99ABB4D86876E7BA3AF89750F10496CC402DB385DF75DD42C7A1

Function 0680D950 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7148b23f2e1fe7b612500a8d39d0bc4786db86d5e59edaae9a672b3cee8775
Instruction ID: 0844a9c67d893fd1e69b79d190c14e89c70d988b19c0cc50ccde6f5f471bc998
Opcode Fuzzy Hash: ae7148b23f2e1fe7b612500a8d39d0bc4786db86d5e59edaae9a672b3cee8775
Instruction Fuzzy Hash: 53319430A1430ACBEB65DFA4D85069EB7F2FF85300F108929D405EB644EB71E9468B51

Function 0680208B Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff24a61edac5c713d712605f3dedb5b70afd76126e99186cd10ed75109c4412
Instruction ID: b06322cd2db026aab5167aafb34814a98ef27e565a85cf70d0c399cca4e2a561
Opcode Fuzzy Hash: 6ff24a61edac5c713d712605f3dedb5b70afd76126e99186cd10ed75109c4412
Instruction Fuzzy Hash: 2C318330E002059BDB59DF64D8A46AEB7B2FF89300F10C929E916E7384DBB1AD42CB50

Function 06802090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bf2cade2291836a3d869f573fceaf9abf09ac13a94b6046db099427ce0d7a3
Instruction ID: 068d57ede9fbf7327c9b5ba4bdfe755f83a9cec1c495cb8866c5297029b60df9
Opcode Fuzzy Hash: 38bf2cade2291836a3d869f573fceaf9abf09ac13a94b6046db099427ce0d7a3
Instruction Fuzzy Hash: 29317030E102099BDB59DF64D86869EB7F2FF89300F10C929E926E7384DBB1AD41CB50

Function 06803A80 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9285e597a494c1f8383d5b85c44028337691664d759ccccc687cbe871419311
Instruction ID: 27270211fc1e39ce02f3387ce1e1b385f2d551ce532ad676b91f4fdae3722497
Opcode Fuzzy Hash: e9285e597a494c1f8383d5b85c44028337691664d759ccccc687cbe871419311
Instruction Fuzzy Hash: 14217A35E006159FEB40DFA9DC81AAEBBF9AB49B10F108566E905E7384E730DD418FA4

Function 06803A90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66bd57dc121f9d0d095de7c39a0c5f04b53614cbcc46a5d8a8e397e0453512f
Instruction ID: 75792835d4cec27fb3186ca039d6d13c2bca6fe6874760e8e29fa9f9ebbc5278
Opcode Fuzzy Hash: e66bd57dc121f9d0d095de7c39a0c5f04b53614cbcc46a5d8a8e397e0453512f
Instruction Fuzzy Hash: A5217C75E006159FEB90DFA9D880BAEBBF5AB48B10F108465EA05E7384E730DD408BA4

Function 0125D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2590661013.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_125d000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e7722e4b5631f366501a4f7e5aaa0ac1b14df3fe8cdc4070f70920c45874cc
Instruction ID: 2ef35bac1640511a97edcc8ba887d1ab9af1d55da1684fb13794eae883123a95
Opcode Fuzzy Hash: 71e7722e4b5631f366501a4f7e5aaa0ac1b14df3fe8cdc4070f70920c45874cc
Instruction Fuzzy Hash: C12122B1528208DFDB55DF94D9C0B26BBA1EB84314F20C56DDD0A4B252C37AD847CA62

Function 0125D006 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2590661013.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_125d000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7ad8e766c3cf01048d851d32a693459d0a94181fd059f2bf5d81534c036229
Instruction ID: 43b17a54a28cbe0a44ac0e593247a20d695fc599f74712fe810e77eda01a71b7
Opcode Fuzzy Hash: 9e7ad8e766c3cf01048d851d32a693459d0a94181fd059f2bf5d81534c036229
Instruction Fuzzy Hash: C0217A7550D3C48FDB03CB64C990715BF71AB46214F28C5EBD9898B2A3C33A984ACB62

Function 06803BA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95911d462bcbadb7be8a98494bf3efa1290a74b9a9648495712a0b7f27d2203
Instruction ID: 348fc648cd9155dfcb70934a3e310122038c29bc0aebcfd8fc928df4226f139f
Opcode Fuzzy Hash: e95911d462bcbadb7be8a98494bf3efa1290a74b9a9648495712a0b7f27d2203
Instruction Fuzzy Hash: 9311A531B005294FDB959678CC206BE77AAABC9710F00893AD506E7384EF65DC125BE4

Function 068041E3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e19b7d9c12daa3868b07df95a6ef52e3f366d7215bc06015618c535ccea99d
Instruction ID: f30a6f64d72688fd484a7b276bd39e9f13364832b65d4b7f67b4d64396999185
Opcode Fuzzy Hash: f9e19b7d9c12daa3868b07df95a6ef52e3f366d7215bc06015618c535ccea99d
Instruction Fuzzy Hash: 2101D431B042109FEBA596BC985172FA7DADBCE710F10887AE34AC7391DD65DC4243A6

Function 06803B8F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7114e301e012a5d11830a59236aba2b065844e9ea312028772598bc49eeb959a
Instruction ID: 12f55e48b238e8015077a54b1fa0889df3f9f588dc9a545364bc326a7b199411
Opcode Fuzzy Hash: 7114e301e012a5d11830a59236aba2b065844e9ea312028772598bc49eeb959a
Instruction Fuzzy Hash: E101D631B048150FFBD5957D9C246FE7FAA8BC9710F04493AD546D32C0EF619C129BA5

Function 06803859 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ca98b4367946a9f5cd4472a281cde76a89f309a32b1d14ef89fa69526d9e44
Instruction ID: 975a1cc75e62227794d7b9fce3396cd3a5a6ff7515c3fb8c41e210f17bc1de12
Opcode Fuzzy Hash: b4ca98b4367946a9f5cd4472a281cde76a89f309a32b1d14ef89fa69526d9e44
Instruction Fuzzy Hash: 6521F2B1D00259AFDB40CF9AD884ADEFBB8FB49310F10856AE918B7250D374A954CFA4

Function 0680A2F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 821516196339e89df6b1a692938b11eeafc62a75f866295903746a9377321181
Instruction ID: 90795f0581ce6e9c3f814701f84257944a8cc43c595796d2fd9f6493cde84b8d
Opcode Fuzzy Hash: 821516196339e89df6b1a692938b11eeafc62a75f866295903746a9377321181
Instruction Fuzzy Hash: 8301B570B143104FE7A99A7CDC60B6EB7E5EB8E700F108D29E14BCB392EA21DC118381

Function 0680F171 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b8b1b082dc5853f2b93f150eab2bfa61a3e7286a8ea4ff7ccc626177fba7587
Instruction ID: 23e7d99c0e11daa26f7acb9a06aa248ccc39d0885a5e853cdcf8a75afe721c7f
Opcode Fuzzy Hash: 5b8b1b082dc5853f2b93f150eab2bfa61a3e7286a8ea4ff7ccc626177fba7587
Instruction Fuzzy Hash: CC01B171B042104BEBA6D66CD85072EB7E6EBCA710F148869EA4ACB381DA25EC074395

Function 06803860 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c042e0dfad64a8a90881f4b977f1d8ebcaca353a0fcbf65c29acdc8a9674f1c1
Instruction ID: 7b0791bee255ff6ad049fdbd731db603b3874ab00f3473260a35460990c4561b
Opcode Fuzzy Hash: c042e0dfad64a8a90881f4b977f1d8ebcaca353a0fcbf65c29acdc8a9674f1c1
Instruction Fuzzy Hash: 5311DDB1D01219AFDB00CF9AD884BDEFBB8FB49310F10812AE918A7240D374A954CFA5

Function 068041F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df881f1ad2d0fc03e80d3a51887204c22b70cfd9a02f2e3a274ec35ea390f2ca
Instruction ID: 179a98c1c0c25b6f9b365617dc2eda1b4c0502056289351235c32d7d6f4c8ea7
Opcode Fuzzy Hash: df881f1ad2d0fc03e80d3a51887204c22b70cfd9a02f2e3a274ec35ea390f2ca
Instruction Fuzzy Hash: 44018C31B001109BEBA4D5ADE85072FA3DBEBCD720F208839E30AC7395EE65EC424395

Function 0680F180 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f3dd26c0beea8ec34008557d963d8dc30455f5aebbe67b596e66e605ddb823
Instruction ID: 887ec39bde662f560df9668be78580ad6b92d0d87d3a14aa2955440f1ba4d58b
Opcode Fuzzy Hash: f1f3dd26c0beea8ec34008557d963d8dc30455f5aebbe67b596e66e605ddb823
Instruction Fuzzy Hash: A9013C75B106105BEBB6D66CDC6172F63DAEBCA710F20C829EA4BC7381DE25EC124395

Function 0680A300 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8074f47c345da266cba63914cf535993b160fbd14b8b266c12dc485476b59e91
Instruction ID: a171bc2701823cf362f4b6db890f3eb2f2cdca42b91b5ef902c162c54d1a4d78
Opcode Fuzzy Hash: 8074f47c345da266cba63914cf535993b160fbd14b8b266c12dc485476b59e91
Instruction Fuzzy Hash: 7E014970B106104BE7A8D67CD851B1F73D5EBCE710F108939E54BC7385EA21DC118795

Function 068082DE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051f08f532ee4358811fa85a6161684b57998809a59e406f35cdba09da401d8e
Instruction ID: d2b6b267402b79af3fe9d893d475d921391e583149852cbcffdd6c624fc3f004
Opcode Fuzzy Hash: 051f08f532ee4358811fa85a6161684b57998809a59e406f35cdba09da401d8e
Instruction Fuzzy Hash: C0F0A076A04204CFFFE49985AD912AC77A4ABC8624F064862CE00D31C0D730D985C6A0

Function 06806461 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2603288624.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6800000_5hD3Yjf7xD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d88d0ceb65fc579ba02dca6e27724b12b674d6ed97b9be5dea680e710152385
Instruction ID: d4f3a44265bf2697fcf9654231510a42de6e311d07b6f76f55e7778cdd171a9e
Opcode Fuzzy Hash: 1d88d0ceb65fc579ba02dca6e27724b12b674d6ed97b9be5dea680e710152385
Instruction Fuzzy Hash: 20E02270E01908BFFBF0CE748D2826E776ADB42214F208CA1C108DB2C1F132DDB18260

Analysis Process: qIQACwuR.exePID: 8120, Parent PID: 1124COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	211
Total number of Limit Nodes:	10

Executed Functions

Function 0737DFA4 Relevance: 1.8, APIs: 1, Instructions: 251
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0737E1E6

Memory Dump Source

Source File: 0000000A.00000002.1412430716.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7370000_qIQACwuR.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d7bf5345a6871ca33799edf7a67fc477e84d9bc5a05e092f1720260ca57fe2f3
Instruction ID: b989405d8e8f69ed17ae1efc66fcb7991d0daed232d3df83cdf7f4c655ed12fb
Opcode Fuzzy Hash: d7bf5345a6871ca33799edf7a67fc477e84d9bc5a05e092f1720260ca57fe2f3
Instruction Fuzzy Hash: 1CA16EB1D00219CFEF24DFA9C8417EDBBB1BF48310F1481A9D859A7250DB799985CF92

Function 0737DFB0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0737E1E6

Memory Dump Source

Source File: 0000000A.00000002.1412430716.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7370000_qIQACwuR.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 47de684be4b6bde620711aa9050853b75926fd0e55184aa48fafb7d1774529b0
Instruction ID: 9b5f25764d977ba824e8c1d555bdf941de212811beca39fc930f4846f4cb59f1
Opcode Fuzzy Hash: 47de684be4b6bde620711aa9050853b75926fd0e55184aa48fafb7d1774529b0
Instruction Fuzzy Hash: BF916EB1D00219CFEF24DFA9C8417EDBBB2BF48310F0481A9D818A7250DB799985CF92

Function 012EAF19 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 012EB17E

Memory Dump Source

Source File: 0000000A.00000002.1404999313.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12e0000_qIQACwuR.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2c5d76a89545460871616d4e587def4f4dec54aa85a05347d14baef07c78dcdc
Instruction ID: 36ff9b611c8dde91a68193d2cf28a49d1bd2fff201ac5146acc6a5b1eccc19a7
Opcode Fuzzy Hash: 2c5d76a89545460871616d4e587def4f4dec54aa85a05347d14baef07c78dcdc
Instruction Fuzzy Hash: 09817B70A10B468FE725CF29D05876ABBF1FF48300F00892ED59ADBA50D775E845CB91

Function 012E590C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012E59C9

Memory Dump Source

Source File: 0000000A.00000002.1404999313.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12e0000_qIQACwuR.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0d120726b84d82927c348b7a230c41aad1f2fd9bc0d488491e8e89688c5a2401
Instruction ID: 1df7e9d2c9ac1882de20855c0fb967f2f2a51dc1cf7e9d515605092201260a17
Opcode Fuzzy Hash: 0d120726b84d82927c348b7a230c41aad1f2fd9bc0d488491e8e89688c5a2401
Instruction Fuzzy Hash: DF41D2B5C10719CBDB24DFA9C884BDDBBF1BF49304F60846AD408AB251DB756986CF50

Function 012E449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012E59C9

Memory Dump Source

Source File: 0000000A.00000002.1404999313.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12e0000_qIQACwuR.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6bd70225a040678364a5dc913e4e8ed14daf5da62a3f9be405be08b8da2364a0
Instruction ID: 3299cb80c24fa113b8c4ad8344aa41608c28a249207024591e602bec4f1e5ba9
Opcode Fuzzy Hash: 6bd70225a040678364a5dc913e4e8ed14daf5da62a3f9be405be08b8da2364a0
Instruction Fuzzy Hash: 0041D274C10719CBDB24DFA9C888BDEBBF5BF49304F60806AD508AB251DBB56946CF90

Function 0737D920 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0737D9B8

Memory Dump Source

Source File: 0000000A.00000002.1412430716.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7370000_qIQACwuR.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 665fefb0b045a0006386e2d4b9cbaf6386c1eb3cb9c272f2131db399aa350692
Instruction ID: db6d44e11404d5149aacfd015d5d307e785f7cf11b12ae7a5edb8c1de521d15a
Opcode Fuzzy Hash: 665fefb0b045a0006386e2d4b9cbaf6386c1eb3cb9c272f2131db399aa350692
Instruction Fuzzy Hash: 9F2177B59003099FDF10CFAAC881BEEBBF5FF48310F10842AE958A7241C7789951DBA0

Function 07355D50 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 07355DEF

Memory Dump Source

Source File: 0000000A.00000002.1412299811.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7350000_qIQACwuR.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 27cc158b1402679fcf25b8aaf4b84692c44ede8790dbded2bb657c283e870737
Instruction ID: 6465d9b2d871b9a73f56f828062ef6a33823dbaf17ebacdc11d802710d66b19f
Opcode Fuzzy Hash: 27cc158b1402679fcf25b8aaf4b84692c44ede8790dbded2bb657c283e870737
Instruction Fuzzy Hash: EA31E4B6D002099FDB10CF9AD884ADEFBF5FF48310F14842AE819A7210D774A955CFA1

Function 0737D928 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0737D9B8

Memory Dump Source

Source File: 0000000A.00000002.1412430716.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7370000_qIQACwuR.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3fa41a1c32e4b87d8534f220a6b0a79ce0e3d7df846163d1d2c80b7e32d88885
Instruction ID: 45d33b985b4b7a6bb30422bcf1fb04fd4e055811119cf60ddffa3d608ee8de8f
Opcode Fuzzy Hash: 3fa41a1c32e4b87d8534f220a6b0a79ce0e3d7df846163d1d2c80b7e32d88885
Instruction Fuzzy Hash: AE2125B59003099FDF10CFAAC885BEEBBF5FF48310F10842AE959A7241C7789955CBA4

Function 07355D58 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 07355DEF

Memory Dump Source

Source File: 0000000A.00000002.1412299811.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7350000_qIQACwuR.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 44624b3393749b1bf763395b2dd65b8aed229b4e120f573c0325266050a215cd
Instruction ID: 89f7fdd062b45ddaf44e528e6bac9dc210ee8c4af123a9b467e4d8c438c09290
Opcode Fuzzy Hash: 44624b3393749b1bf763395b2dd65b8aed229b4e120f573c0325266050a215cd
Instruction Fuzzy Hash: E121C0B6D003499FDB10CF9AD884ADEFBF5FB48310F14842AE819A7210D774A955CFA0

Function 0737D351 Relevance: 1.6, APIs: 1, Instructions: 68
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0737D3D6

Memory Dump Source

Source File: 0000000A.00000002.1412430716.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7370000_qIQACwuR.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0279fbb3d77fd27471ba0be3c6235bc22f469a4920564b270aeb6c84521a76c8
Instruction ID: 6aba447d7883af76882e2aaa0b6a9a53eefc526288c304ed45b4b73909d5b1aa
Opcode Fuzzy Hash: 0279fbb3d77fd27471ba0be3c6235bc22f469a4920564b270aeb6c84521a76c8
Instruction Fuzzy Hash: A42148B19003099FEB10CFAAC4857EEBBF4EF48314F14842AD459A7241C7799985CFA5

Function 012ED808 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,012ED7D6,?,?,?,?,?), ref: 012ED897

Memory Dump Source

Source File: 0000000A.00000002.1404999313.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12e0000_qIQACwuR.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5f4c61059826f43d11193340ada8216d7648bdc5524d2e46a43239da0c090acb
Instruction ID: 91e3bdad8404dd9f8f482fa8b519b6d789f8b462b4b8157ca1043bd4ede8f877
Opcode Fuzzy Hash: 5f4c61059826f43d11193340ada8216d7648bdc5524d2e46a43239da0c090acb
Instruction Fuzzy Hash: F32116B5C00208DFDB10DF99D585ADEBBF4FB48310F14842AE958A3350D3789955CF61

Function 012EBCA0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,012ED7D6,?,?,?,?,?), ref: 012ED897

Memory Dump Source

Source File: 0000000A.00000002.1404999313.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12e0000_qIQACwuR.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 249caa26b9b3d94fbd37912c6232826e3c88c896851366942f65b6624337f107
Instruction ID: 50655714f526391fe6afc1b771397c9cdfee3d5226af7a35e255e3a4b1943dc3
Opcode Fuzzy Hash: 249caa26b9b3d94fbd37912c6232826e3c88c896851366942f65b6624337f107
Instruction Fuzzy Hash: D221D4B59002489FDB10CF9AD884AEEBBF4EB48310F14842AE958A7351D374A955CFA5

Function 0737DA10 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0737DA98

Memory Dump Source

Source File: 0000000A.00000002.1412430716.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7370000_qIQACwuR.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 960a5c15a007d2d6f8e45d8e85f773ffd8fe8f3052196bb67f5a8d74ea8a21ad
Instruction ID: 6a7bc11341b5b1631949f07b3fecfa89381641b50e4817d31393c84d98f5c92b
Opcode Fuzzy Hash: 960a5c15a007d2d6f8e45d8e85f773ffd8fe8f3052196bb67f5a8d74ea8a21ad
Instruction Fuzzy Hash: 582148B59003499FDB10DFAAC884BEEFBF5FF48310F50882AE959A7240C7799551CBA4

Function 0737D358 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0737D3D6

Memory Dump Source

Source File: 0000000A.00000002.1412430716.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7370000_qIQACwuR.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 26243aa37b9a971b552dba0dfd1b2c9f1ee05eef4e32549c00f7f1b93646d32e
Instruction ID: 3bb4c459afd8359bec771de9df994499f1a566d60f432533ce1f74cc4c78a1d8
Opcode Fuzzy Hash: 26243aa37b9a971b552dba0dfd1b2c9f1ee05eef4e32549c00f7f1b93646d32e
Instruction Fuzzy Hash: C52149B1D003099FEB10DFAAC4857EEBBF4EF48314F54842AD459A7241C7789945CFA5

Function 0737DA18 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0737DA98

Memory Dump Source

Source File: 0000000A.00000002.1412430716.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7370000_qIQACwuR.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4962220dcd57ed02b309ede35864e628e5db27503315396e9f535a5ad95acd1e
Instruction ID: 04785c3f2cb8b7714a9010fa21b0f60c5d3d8323ab29e3eed851605ce04008df
Opcode Fuzzy Hash: 4962220dcd57ed02b309ede35864e628e5db27503315396e9f535a5ad95acd1e
Instruction Fuzzy Hash: C32145B19003499FDB10CFAAC880BEEFBF5FF48310F50842AE958A7240C7789941CBA0

Function 0737D860 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0737D8D6

Memory Dump Source

Source File: 0000000A.00000002.1412430716.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7370000_qIQACwuR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a8b345e93844c788835b6e95f9cbd67c04ce130eabf727123f4870da1756060b
Instruction ID: 17b2dfe406caaab64790ed84f2f7afbc41a7de9cd84153b4199ce5884d578c6c
Opcode Fuzzy Hash: a8b345e93844c788835b6e95f9cbd67c04ce130eabf727123f4870da1756060b
Instruction Fuzzy Hash: 37118CB6800308AFDB10DFAAD4057DEBBF5EF48310F108429D555A7250C7759951CFA1

Function 0737D2A0 Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0737D30A

Memory Dump Source

Source File: 0000000A.00000002.1412430716.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7370000_qIQACwuR.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8def7dd19fdf7fa7cbe329c490f73e3e2c8920b421ee322eae713ec9af5eb50d
Instruction ID: fd089a372c6847744e3d4fbb302a801a308599def8211dd8963aafe149cc9e31
Opcode Fuzzy Hash: 8def7dd19fdf7fa7cbe329c490f73e3e2c8920b421ee322eae713ec9af5eb50d
Instruction Fuzzy Hash: 3E118BB1D003488FEB10DFAAD4447DEFBF4EF88324F14842AC459A7240C779A945CB94

Function 0737D868 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0737D8D6

Memory Dump Source

Source File: 0000000A.00000002.1412430716.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7370000_qIQACwuR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 97318be637dc01fce5dc239d6fc16cdbc746efbd7331a45dfaac0a09355da144
Instruction ID: 0459ae8e0ccdadd391c4e32334bb15d031b77e8d0291862cf15a8fbfc64080c5
Opcode Fuzzy Hash: 97318be637dc01fce5dc239d6fc16cdbc746efbd7331a45dfaac0a09355da144
Instruction Fuzzy Hash: 8F1167B69003089FDF10DFAAC844BEEBBF5EF48310F148429E519A7250C7799550CFA1

Function 0BD811B8 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0BD8121D

Memory Dump Source

Source File: 0000000A.00000002.1416287591.000000000BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bd80000_qIQACwuR.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e17eb93c93b76ac06aa96184161ab4ba79fd0d5ee88f2c1caa0e43a0f3ac9312
Instruction ID: ee3c1ff3394e3e40df2a0f2b89aa16e299673d11eeec1e6e17921052617995e4
Opcode Fuzzy Hash: e17eb93c93b76ac06aa96184161ab4ba79fd0d5ee88f2c1caa0e43a0f3ac9312
Instruction Fuzzy Hash: F11122B58003089FDB10DF9AD846BDEFBF8FB48320F20841AE958A7210D375A585CFA1

Function 0737D2A8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0737D30A

Memory Dump Source

Source File: 0000000A.00000002.1412430716.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7370000_qIQACwuR.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7a167bcaefa8a8a4a0fa08dbcea0b085578583cfb32d480fb3e39dcd78ffa865
Instruction ID: 53be6ba60c4e2c22ad4d86e3df53a836f5c5bd7299d6f220d00db71240a06e32
Opcode Fuzzy Hash: 7a167bcaefa8a8a4a0fa08dbcea0b085578583cfb32d480fb3e39dcd78ffa865
Instruction Fuzzy Hash: CD116AB1D003088FEB20DFAAC4457DEFBF4EF88314F148429C459A7240C779A544CBA4

Function 012EB118 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 012EB17E

Memory Dump Source

Source File: 0000000A.00000002.1404999313.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12e0000_qIQACwuR.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 512e8dd6769cd4521cb1a4e6dc4b31450187665e1dd17b687f6f191d84e3af12
Instruction ID: 7f0558bc70f1e40cbed966ebf8b7e3d6437a9cafa7a16b03842bcbaf668a0453
Opcode Fuzzy Hash: 512e8dd6769cd4521cb1a4e6dc4b31450187665e1dd17b687f6f191d84e3af12
Instruction Fuzzy Hash: 4411DFB6C006498FDB10CF9AD848BDEFBF4AB88224F10842AD959A7250C379A545CFA1

Function 0BD811C0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0BD8121D

Memory Dump Source

Source File: 0000000A.00000002.1416287591.000000000BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bd80000_qIQACwuR.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a12bbf55b0ee8b4902107e059962d07562e1f2db448d7bd50952a580f6793f49
Instruction ID: 0160f813fcda7d29b7df13e74e4ceaf1bed255fcf886142ae43c8938498ce860
Opcode Fuzzy Hash: a12bbf55b0ee8b4902107e059962d07562e1f2db448d7bd50952a580f6793f49
Instruction Fuzzy Hash: D211D3B5800349DFDB10DF9AD445BDEFBF8EB48320F10841AD558A7250C375A554CFA1

Function 0124D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1404684272.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_124d000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b74da685b9bc5c99b3fbdb71d1fa012065bb4fd6bb039e3ef2f1fd4dd477e79a
Instruction ID: abef321ec4600464e2c603f164876055003f2ae121d54a4dea34093e8b864aee
Opcode Fuzzy Hash: b74da685b9bc5c99b3fbdb71d1fa012065bb4fd6bb039e3ef2f1fd4dd477e79a
Instruction Fuzzy Hash: A8212871514308DFDB09DF94D8C4B2ABB65FB98320F20C569ED090B247C376D416CBA1

Function 0125D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1404755890.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_125d000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6964572dd4c1f38506d93dd7ce7a25c2e823859225946395ddb9c3683c8067ed
Instruction ID: 482b0de5f173daa038c806f0dbc98b80cabb3f4668d842d4c18e064daecee760
Opcode Fuzzy Hash: 6964572dd4c1f38506d93dd7ce7a25c2e823859225946395ddb9c3683c8067ed
Instruction Fuzzy Hash: F5213471524308EFDB45DF94D9C0B26BBA1FB88324F20C56DED098B253C376D846CA62

Function 0125D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1404755890.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_125d000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb8ea2aaf95850d97020657548a4ab2c72690f0044c7949574d5ef9662e83d9f
Instruction ID: a96c332a606d4dbafe3b55c21c1603cb08469f903f619ca2818b3c4587112ed0
Opcode Fuzzy Hash: eb8ea2aaf95850d97020657548a4ab2c72690f0044c7949574d5ef9662e83d9f
Instruction Fuzzy Hash: 5D212271624308DFDB55DFA4D8C0B26BB61EB88314F20C56DDD0A4B252C37AD447CA62

Function 0125D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1404755890.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_125d000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d2eb3be168dc9f91009d393612cf16de3716908a0e35b6b742b4200eaa59834
Instruction ID: 84f34e69c0c32fe4fe223a637a432f464776409bd93ec65a1385a740bde3d227
Opcode Fuzzy Hash: 5d2eb3be168dc9f91009d393612cf16de3716908a0e35b6b742b4200eaa59834
Instruction Fuzzy Hash: 0121CA755083848FCB02CF24C9D0B15BF71EB46314F28C5EAD9498B2A3C33AD80ACB62

Function 0124D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1404684272.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_124d000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91bdf0bd23193508057cb366e2903bad23f0689d54242342d8c5009dfe04fd1
Instruction ID: e0877abddea10ed26f9ef139f1c77e17415a442cbd58203f250f0c97fbb1e087
Opcode Fuzzy Hash: e91bdf0bd23193508057cb366e2903bad23f0689d54242342d8c5009dfe04fd1
Instruction Fuzzy Hash: B721CD76404244CFDB06CF54D9C4B16BF62FB84324F24C1AADD080A657C33AD42ACBA1

Function 0125D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1404755890.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_125d000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b342587f02f4df216fd9fa4589941a60fabf0b5787ec5e4e812599987ae7f8
Instruction ID: e1dd39030255047b7fc664524afe8de73de4f885028052a3ebcbfb66176795fe
Opcode Fuzzy Hash: 04b342587f02f4df216fd9fa4589941a60fabf0b5787ec5e4e812599987ae7f8
Instruction Fuzzy Hash: 3C11EB75504284CFDB02CF54C5C0B15BBA1FB84324F24C6ADDD498B293C33AD44ACB61

Non-executed Functions

Function 0735BD19 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1412299811.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7350000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a99ebb60aa328fe8d881ddf503c204ceec642358704b987ce3929c80ddc0a417
Instruction ID: 3deac0b8e9bcd0745aba5c98a98e404a7635d9b09b56ad2f94f7d89b20077761
Opcode Fuzzy Hash: a99ebb60aa328fe8d881ddf503c204ceec642358704b987ce3929c80ddc0a417
Instruction Fuzzy Hash: 2E2127F3509751DFEB0A9F68E8118E8FBF1EF822207058197D8089B662DB30D849C7C2

Function 0BD80249 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1416287591.000000000BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bd80000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234edfa43a7f209c51b11dc4f43957acfcec22599ff4eb795b4440a465982adc
Instruction ID: ece409944039cc00ea0233e7b8c49a6912a9393494e9b12c507ce661f60a63c8
Opcode Fuzzy Hash: 234edfa43a7f209c51b11dc4f43957acfcec22599ff4eb795b4440a465982adc
Instruction Fuzzy Hash: 81F03079949104CFC714AF94E4485F8F7BCFB4A327F0060A2945E97222CB30A949CF50

Function 0BD80406 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1416287591.000000000BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bd80000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa2bfbc8f9c0d1090fb1b6bc19ddc6241da76aa9c2b062e1565160b79b5b260
Instruction ID: 67941e37ecea1aea10070e16676be07d2655acc8bafb6b2ec7777cd999299813
Opcode Fuzzy Hash: baa2bfbc8f9c0d1090fb1b6bc19ddc6241da76aa9c2b062e1565160b79b5b260
Instruction Fuzzy Hash: 53E04FB9D4E104CFC701AFA4A5442F8F7BCE74B72BF0420A2919E97622D630A9088B25

Analysis Process: qIQACwuR.exePID: 2168, Parent PID: 8120COMMON

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06C42358 Relevance: 1.5, Instructions: 1482COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb39e32ad5fd96a374668a4bbd7ecf94a1db898dea8b47b52ca04934354c5e1
Instruction ID: acf31e7cf7f595753d6f39ea3f9dd7ae3c75d68f3f38322b55cd1611359dced8
Opcode Fuzzy Hash: ccb39e32ad5fd96a374668a4bbd7ecf94a1db898dea8b47b52ca04934354c5e1
Instruction Fuzzy Hash: 02D23C34E10205CFDB64EF68C584A9DB7B2FF85310F5485A9E44AAB351EB34EE85CB90

Function 06C465E0 Relevance: .8, Instructions: 805COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f739b8c57260e8ad7fbe389a6115591d1e6f2c478731692a4694761168b7cb58
Instruction ID: ed5b98aca9e485f01d65e8f8cc63e1a9e2494123f3d2f8b58a341fe4a3dc9839
Opcode Fuzzy Hash: f739b8c57260e8ad7fbe389a6115591d1e6f2c478731692a4694761168b7cb58
Instruction Fuzzy Hash: 2D626934B00204CFDB54EBA9D594BADBBF2EF89314F148469E806AB394DB75ED41CB90

Function 06C45588 Relevance: .6, Instructions: 594
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84194a00a9e4294fe6ac63be23bc72adfc663f5167be7114973f18b029b99996
Instruction ID: f79951070109abca1bd93bb07b79c04b8d6385ca23c1540c5d42e8bd2548a48a
Opcode Fuzzy Hash: 84194a00a9e4294fe6ac63be23bc72adfc663f5167be7114973f18b029b99996
Instruction Fuzzy Hash: 5622A175E102148FDF64EBA8C4807AEBBB2EF89320F64846AD415EB344DB35DD46CB91

Function 06C4B20F Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ec3365f38bdc3af079cb32cb01e429f246794351af05e1312040287adbae16
Instruction ID: 330e911b4f71e68a6c71de24920d836ff6df3bbb1233c20d8fc8a6786628c6a0
Opcode Fuzzy Hash: e2ec3365f38bdc3af079cb32cb01e429f246794351af05e1312040287adbae16
Instruction Fuzzy Hash: 04225070E101098FEF64EBA9D4947AEB7F6FB45310F24852AE405EB391CA39DD81CB91

Function 06C47D68 Relevance: .5, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad982b599399f4c1b6938689598354d815520c45aeaa2f119d2f7c078fba1624
Instruction ID: e735951d4e48ee8323db01222d9e10f9560292fd2c96b05b937f92596f8ca039
Opcode Fuzzy Hash: ad982b599399f4c1b6938689598354d815520c45aeaa2f119d2f7c078fba1624
Instruction Fuzzy Hash: 72029C30B11205CFDB54EFA9D4946AEBBE2FF84710F148568D806AB395DB35ED42CB90

Function 06C47688 Relevance: .5, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bcb7d0ed2cafdfa294c2304091e62f27cdf5de787d54ff713e481d72e3d4a3e
Instruction ID: 6d12316b28c8bfc582bb2bb0c4a048c1fee7c534b5e97865d46045c2cbf17f7e
Opcode Fuzzy Hash: 4bcb7d0ed2cafdfa294c2304091e62f27cdf5de787d54ff713e481d72e3d4a3e
Instruction Fuzzy Hash: 14120034E00219CFDB64EFA9D9946AEB7B2FF84314F208569D406AB354DB349D85CFA0

Function 016BEB38 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 016BEB9B

Memory Dump Source

Source File: 0000000E.00000002.2591334342.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_16b0000_qIQACwuR.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 0ca5676180d72651b1c9f76c6b8487745faf72ccb8a2e1e67233ddb55ceb02c7
Instruction ID: dab4dd51d135edeb625f1d801b9a62a7358b5bdee27d01e21ae5e07aac30dd3b
Opcode Fuzzy Hash: 0ca5676180d72651b1c9f76c6b8487745faf72ccb8a2e1e67233ddb55ceb02c7
Instruction Fuzzy Hash: 4A515772E043898FDB14DFA9D8443EDBBB1AF89220F05856AD518E7381E7349885CBE1

Function 016BEC20 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 016BEC87

Memory Dump Source

Source File: 0000000E.00000002.2591334342.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_16b0000_qIQACwuR.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 3c4478e622f2ee9680a97f4facdc4539d36d8a2596165a298fefbf514ad7223b
Instruction ID: b0b66965af69553df7f0c8a85f0b2f499b67e55fa2c7fe52b3f31abe0381811a
Opcode Fuzzy Hash: 3c4478e622f2ee9680a97f4facdc4539d36d8a2596165a298fefbf514ad7223b
Instruction Fuzzy Hash: 8B1112B1C006599BDB10CF9AC444BEEFBF4AF48220F15812AD818A7241D378A944CFA1

Function 06C4CF28 Relevance: .8, Instructions: 797
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6136529447d667b8bd7ba95db4b22b8bcf9d9a0bf8a00172996d23029e13b80
Instruction ID: d9c45ce9f5896386fa6fd51c0ff9b74c17e99cc88bb96339eed3a97de8b740c6
Opcode Fuzzy Hash: a6136529447d667b8bd7ba95db4b22b8bcf9d9a0bf8a00172996d23029e13b80
Instruction Fuzzy Hash: 98625B70A00209CFDB55EFA8D590A5EBBF2FF84310B208A68D006AF755DB75ED46CB91

Function 06C4C170 Relevance: .6, Instructions: 637
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973a91c05ad1dc642fb89161fc0dedf2fde4531e2179ffb8857606ea1a9033c9
Instruction ID: 82b2d42f5bd613eac665556d53676f1bd6bc2a2c0e185ff60881c340c5b409f6
Opcode Fuzzy Hash: 973a91c05ad1dc642fb89161fc0dedf2fde4531e2179ffb8857606ea1a9033c9
Instruction Fuzzy Hash: 80324F74B11205DFDB54EFA8D990BAEBBB2EB88310F108529D406E7361DB39ED41CB91

Function 06C4B630 Relevance: .5, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d975ba1d66db98bd2b0481f7dfbc177a70fcdae64408b221adafb8981320763
Instruction ID: bebfb083a0a705ef98067009c83577cf7e8e74df2c60bf4d67a4a6c472bacf6a
Opcode Fuzzy Hash: 1d975ba1d66db98bd2b0481f7dfbc177a70fcdae64408b221adafb8981320763
Instruction Fuzzy Hash: FA025930E14209CFDB64EFA9D4806AEB7F2FB85310F20856AD405EB255DB35EE45CB91

Function 06C4ACB8 Relevance: .4, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e549d677affa94755d296bca80d5fa3e290c9b159e8bf7ff0ce6168cd36b45d3
Instruction ID: 167cb3c11b1f9ac94d947ad95631a118673f5c43e50b7609ed1b4e1a2a375c96
Opcode Fuzzy Hash: e549d677affa94755d296bca80d5fa3e290c9b159e8bf7ff0ce6168cd36b45d3
Instruction Fuzzy Hash: F6E15C30E10209CFDB65EFA9D8906AEB7B2FF85310F20852DD416AB254DB35ED46CB91

Function 06C49138 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f65b6b7271dde6f6446e7f3a7a5ce1ccb31870d4b1174dddb05e85dd150d0b59
Instruction ID: 5964660af5fda5cced08dc42e6363f58d908a7c55e56231bf60f76805175bf9a
Opcode Fuzzy Hash: f65b6b7271dde6f6446e7f3a7a5ce1ccb31870d4b1174dddb05e85dd150d0b59
Instruction Fuzzy Hash: 2C914B70B002199FDB54DF69D9607AFBBF2FB88710F108569C80AAB345EF349D419BA0

Function 06C461E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94d15de2ecc61164381081f7ffe6480485d3f2eff39adb6e15c3308411d1031
Instruction ID: 8e44bd143e6988233bb6cbd68a7689266bada67208a78abead782cd3202812cb
Opcode Fuzzy Hash: e94d15de2ecc61164381081f7ffe6480485d3f2eff39adb6e15c3308411d1031
Instruction Fuzzy Hash: 3561C171F001104BDF64AA7ECC8466EBAE7AFC5620B554439D80ADB364DE76ED0287D1

Function 06C445A0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c626c14d4dc6d5e9762561814da8737f086f0ee88d6dc114156c511b12e1c4
Instruction ID: 50e0f91a81dc2107e34c9a401a3e0d88b1490ed8952b0979d46aa6dbc2f40b99
Opcode Fuzzy Hash: 43c626c14d4dc6d5e9762561814da8737f086f0ee88d6dc114156c511b12e1c4
Instruction Fuzzy Hash: BD913E30E102598FDF64DF68C890B9DB7B1FF89310F20C699D549BB295DB70AA85CB90

Function 06C44280 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeae5d5b40430fd0b2d8fe851c7cf554f922c94ac84a68cb9dc30c07b90d847f
Instruction ID: a50066a75c2c856c59ab842a3b694bb7f00f1b102a950d610a6afa3ac2006618
Opcode Fuzzy Hash: aeae5d5b40430fd0b2d8fe851c7cf554f922c94ac84a68cb9dc30c07b90d847f
Instruction Fuzzy Hash: 5C815E70B102058BDB58DFA9D4547AEBBF2EB88700F208568D40AEB355EF35DD428B91

Function 06C44290 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75f4ff4d21adca2d40885517648b430435a3f01a3d24f57ce91b931b64d27fd
Instruction ID: dd22a2924138f479f8ff92f76ce30bcb05e4b305471512c6f015613947994bc8
Opcode Fuzzy Hash: e75f4ff4d21adca2d40885517648b430435a3f01a3d24f57ce91b931b64d27fd
Instruction Fuzzy Hash: 17814E70B102098BDF58DFA9D4547AEBBF2EB89700F208568D40AEB354EF35DD428791

Function 06C445B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9a20f86f36e4415fe2bd24ab6d60133aa38c32a7b8bede0752687add8c0f63
Instruction ID: 366e1cb736cbe26728060eae705fc22fef7f0431d0f5e3587e2cacdad5f0c147
Opcode Fuzzy Hash: 3c9a20f86f36e4415fe2bd24ab6d60133aa38c32a7b8bede0752687add8c0f63
Instruction Fuzzy Hash: 1B912F30E106198BDF64DF68C890B9DB7B1FF89310F20C699D549BB284DB71AA85CF90

Function 06C4EEF0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f20b3b07e7d79571e65e6c2f6f7b7c92921fea0bac378d228ddefa5c62d29de
Instruction ID: f643f40c74a14760a3d41159ca058b3f401cca232d5993655b2ab270b3f4bc50
Opcode Fuzzy Hash: 5f20b3b07e7d79571e65e6c2f6f7b7c92921fea0bac378d228ddefa5c62d29de
Instruction Fuzzy Hash: C9714A70E002498FDB54EFA8D980AAEBBF6FF88310F248529D415AB355DB30ED46CB40

Function 06C4EF00 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa977f4692acc63a0a3a079b230a86ceb9855187a7536920afa67eb3d3ebae73
Instruction ID: b162f5ed875c9948ff2df0f825aff454aa76535c787805b652de069dc8cb2a63
Opcode Fuzzy Hash: fa977f4692acc63a0a3a079b230a86ceb9855187a7536920afa67eb3d3ebae73
Instruction Fuzzy Hash: 3C714C70A002499FDB54EFA8D980AAEBBF6FF88310F248429D415EB355DB34ED46CB50

Function 06C44B50 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c569a0df2ad70ecd0669a1cda844ad8d226c9754c271a08b22b1297ac11e22
Instruction ID: 21144b5b28fd0a290d2a2265a81a89f839e20fae1853bbb3201d328530245f9b
Opcode Fuzzy Hash: 31c569a0df2ad70ecd0669a1cda844ad8d226c9754c271a08b22b1297ac11e22
Instruction Fuzzy Hash: 0A616F70E002099FEB54EFA9C8547AEBAF6FB88710F20852AD106AB394DF755D45CB90

Function 06C4FC58 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9afd43b8d2e9e0c990df2f914d21442aeaeb3989882c2ca3a18cb46f44339c96
Instruction ID: e898e9d2329d387c42888ce0abbebaa4224a82df19d30c045dc1ceb2ada0920f
Opcode Fuzzy Hash: 9afd43b8d2e9e0c990df2f914d21442aeaeb3989882c2ca3a18cb46f44339c96
Instruction Fuzzy Hash: 8751C031E00109DFDB24FFB8E5946AEBBB2EB88311F10887DE116D7250DB359A55CB90

Function 06C4FA09 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27925e229240ec9c393cf707f2a7464f22cb1edd79b7b62c93985d977b79784
Instruction ID: 65fbd7088aaec79cce8e4d78e578f14a10b5bb1ce0c96ba689c1f5b08b68c86f
Opcode Fuzzy Hash: f27925e229240ec9c393cf707f2a7464f22cb1edd79b7b62c93985d977b79784
Instruction Fuzzy Hash: 15516170B20204DBEF64EAA9E854B7E275AD789750F20843EE40BD7790C97DCD5193A2

Function 06C4FA18 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec24d0cf9fd9f8430e881d808e6a58808088820ec9385a18de36cea1ee3c968c
Instruction ID: c76c82f50fedc089fe00f1ee20f355eacf3fa5f0d046b5f8fd369c39dcdba4fe
Opcode Fuzzy Hash: ec24d0cf9fd9f8430e881d808e6a58808088820ec9385a18de36cea1ee3c968c
Instruction Fuzzy Hash: 96517F70B202049BEF64EAA9E894B7E275AD7C9710F20843EE40BD7790CD6DCD5153A2

Function 06C49127 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 670b3f0ea2b98503a63b588b13f25186c0adec43900423b98efee5a1a17d36ec
Instruction ID: 09b854aa18a8cff6bbef0b3d497cde642eab2e3f3503efc5e2dfdb5edca4c1a5
Opcode Fuzzy Hash: 670b3f0ea2b98503a63b588b13f25186c0adec43900423b98efee5a1a17d36ec
Instruction Fuzzy Hash: 8F512E70B001149FDB54DF69D9A0BAFBBF6EB88710F508469C80AAB355DF34AD41DBA0

Function 06C44B40 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d8c718c85b68d3ebab5a095fe713b208333f62e89f8c4c85b60746c86108ff
Instruction ID: ee0bf7805d1c7919a70a2c2a80b5fad34f6906fe22a086c416fa26c7779f8735
Opcode Fuzzy Hash: 28d8c718c85b68d3ebab5a095fe713b208333f62e89f8c4c85b60746c86108ff
Instruction Fuzzy Hash: EF417F70B102089FEB54DFA9C854BAEBBF6FF88710F20852AD105AB394DB759C05CB90

Function 06C45408 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5720089aadf12f5ed1e477ee4ea68322b430bb553be5ad30d8f939c0c38b3aae
Instruction ID: 7a5ce9f69b9ddb60d7991fe1922e9e33ee63c641cc6e7920182a83a02e5a8621
Opcode Fuzzy Hash: 5720089aadf12f5ed1e477ee4ea68322b430bb553be5ad30d8f939c0c38b3aae
Instruction Fuzzy Hash: 94413A71E0060A8BDF70DEA9D880ABFF7F2FB84310F50892AE11AD7654D631E955CB91

Function 06C4DAB0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e2f3eab13f1b15ffa696a313e457942648bf9d2719854427c0686cee7d624e
Instruction ID: 0ea430b82f65828716b4b6e329b125228b8b70f6660ba52da504c65c0f2bddd7
Opcode Fuzzy Hash: c7e2f3eab13f1b15ffa696a313e457942648bf9d2719854427c0686cee7d624e
Instruction Fuzzy Hash: D6415E70E10309DBDB64FFA5D49469EBBB2BF85700F20852DD806EB240EB70E946CB91

Function 06C4DA9D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16bfcd5c184915dc83d4fd81c2a9254ec0917659ee2d20ba35f7ed19e765f0f7
Instruction ID: 71e63d6b8a7514352a7b1610d0b572ff7da65e37c4b5ad0b05c0d2d2e184d8e6
Opcode Fuzzy Hash: 16bfcd5c184915dc83d4fd81c2a9254ec0917659ee2d20ba35f7ed19e765f0f7
Instruction Fuzzy Hash: FB417C70E00309DBDB65EFA9D49469EBBB2BF85200F10452EE802EB240EB70E942CB51

Function 06C421BD Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2551af6684e9971dbba98bd3820a9457cf5c00a77cb0bf3ac44d8e19c0645e06
Instruction ID: 7fc8d1504481847dd3a8e36d7c3b37cc9320fa926bb0ba0464a1febc7ae8db20
Opcode Fuzzy Hash: 2551af6684e9971dbba98bd3820a9457cf5c00a77cb0bf3ac44d8e19c0645e06
Instruction Fuzzy Hash: 0E31CE30B142058FDB65EB78D55866E7BA2AB89210F14446CE402EB395EF38CE05C7A1

Function 06C421D0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5915c24c53e30c72afcf39b279eda63b42d2d3e9603fbe3379581af35c8fcbd6
Instruction ID: 29e527fbc3f8ee69c43565ccf535e8e467f8fcb3a01283652f148ea2ff51193c
Opcode Fuzzy Hash: 5915c24c53e30c72afcf39b279eda63b42d2d3e9603fbe3379581af35c8fcbd6
Instruction Fuzzy Hash: BE319E30B102059BDB69EB79D55866E7BA3AB89610F10446CE402DB355DF39CE01C7A5

Function 06C4D950 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808e4eff7c910e5805a7dffa2bd4796ca39039e784b4cb8d21f7be72033f194b
Instruction ID: de88cdb6c447fe5ac6b4c50743553159c8924fc971ddeeb410e763c3ccbfc3cb
Opcode Fuzzy Hash: 808e4eff7c910e5805a7dffa2bd4796ca39039e784b4cb8d21f7be72033f194b
Instruction Fuzzy Hash: CC317470E1430ADBDB25EFA5D89069EBBB2FF85200F108569D406EB640EB71F946CB51

Function 06C4208B Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcdad6ce4f9ef1c614361e156e167602b2e49cf416cc0c9f6a20c9272a912427
Instruction ID: 83fc53898eb496acc041b871eff5a7b78be838e7159245dfc7ac119b51dd7920
Opcode Fuzzy Hash: bcdad6ce4f9ef1c614361e156e167602b2e49cf416cc0c9f6a20c9272a912427
Instruction Fuzzy Hash: 5D318934E106059BCB18DF68D895AAEBBF2FF88300F108529E806E7340DB75EE42CB50

Function 06C42090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd25996636303e0f62292ac2ae0f5b61239d553260c80b3e4de3f7f566cb979
Instruction ID: c2259fe35fdd89ea70e63294843e00af66da45551af52c772755381c3e3e8b95
Opcode Fuzzy Hash: acd25996636303e0f62292ac2ae0f5b61239d553260c80b3e4de3f7f566cb979
Instruction Fuzzy Hash: 3C316E35E106099BCB19DF68D895AAEBBF2FF89300F108529E906E7350DB75EE41CB50

Function 06C43A80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6904610982e9b0c276b46c695c4e4260aaaaa3d3f9bd7ed175d7c288b4b2e58b
Instruction ID: a98a2d6464c87f27fba81db2354d2b5ac21d4b9f3104a5462e2e071b9a01d7ee
Opcode Fuzzy Hash: 6904610982e9b0c276b46c695c4e4260aaaaa3d3f9bd7ed175d7c288b4b2e58b
Instruction Fuzzy Hash: 07212C75F012159FDB50DFA9D880AEEBBF5EB88710F10806AE905E7381E734DD419BA4

Function 06C43A90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ac48943a78b347431caa17e277624d3225678dbb56d9aeea138e41683b6420
Instruction ID: 4a80fd109078668e71e809452477a3314e8c8f7808a95a18d26a01d775d8f5b8
Opcode Fuzzy Hash: 79ac48943a78b347431caa17e277624d3225678dbb56d9aeea138e41683b6420
Instruction Fuzzy Hash: E9213B75E016159FDB50DFAED880AAEBBF1EB88710F108069E909E7380E734DD408BA4

Function 0122D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2589689674.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_122d000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 545e498d1bcccfbcbe7bcdff336f13969f62f6fc9eb0e0dc1b53b1c38798c0b0
Instruction ID: f7a7b91b4652e81e16cbf7c840329de55338019ec4f58195d769c32d4bd1fb9a
Opcode Fuzzy Hash: 545e498d1bcccfbcbe7bcdff336f13969f62f6fc9eb0e0dc1b53b1c38798c0b0
Instruction Fuzzy Hash: DD216771518308EFDB10DF94D8C0B2ABB61FB84314F20C56DE9090B262C37BD447CA62

Function 06C453F8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f687eaf5a99e9d83a071865180129b445b175f316b6ad58e704a00db7c80b87a
Instruction ID: 1e7cebf04ef22973ee621a0ec1b7416d04c1dfd3ff070dc59f9a139d5c1ad2bd
Opcode Fuzzy Hash: f687eaf5a99e9d83a071865180129b445b175f316b6ad58e704a00db7c80b87a
Instruction Fuzzy Hash: CF216F32A007059BCB20DFA5CCC1AAFFBF6FB84710F548929E15697654D730B955CB90

Function 06C46D00 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0d21e32452a1b1854b262d2919d3bce075dd62acb3550dd5eadd29df7e4da3
Instruction ID: 5489dad635e95fa72dcd4067c7d9c5e0cf9a4b7a687ca7adcea553b21cb617cc
Opcode Fuzzy Hash: ec0d21e32452a1b1854b262d2919d3bce075dd62acb3550dd5eadd29df7e4da3
Instruction Fuzzy Hash: 9021AF30B101089BDF94EBAAE8506AEBBF6EB85310F248429E405EB344DB35ED418B94

Function 06C43BA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c1b769b1f31276edc674dd1ce1a6c2c8f801ccb2b86d3aec85ee72c0fbf7f6
Instruction ID: 6d3b0b3263c132feb5e66d8dd4d08bc3025c19f055aaf4aaba41bdaf93b53815
Opcode Fuzzy Hash: 73c1b769b1f31276edc674dd1ce1a6c2c8f801ccb2b86d3aec85ee72c0fbf7f6
Instruction Fuzzy Hash: 7D11A531B005284BDB54EA6AC8546AE7BAAEBC8750F004539D40AE7340DF25DD029BE0

Function 06C441E2 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8febd3c59d3a38aa02cdce5105462786c34b5a03cbbaf1f72f08e38d8e782555
Instruction ID: 4dcd22efaee288a5db9cc5448ff70b0059d8cf790744f8e4a58bf553aabefd8d
Opcode Fuzzy Hash: 8febd3c59d3a38aa02cdce5105462786c34b5a03cbbaf1f72f08e38d8e782555
Instruction Fuzzy Hash: 4E01D431B101104BDB74E9ACE858B2BB7CBDBC9760F20843DE54AC7355ED55ED428395

Function 06C4F171 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1d6925dde4bb6820630b65c43cc22f78b289cf956a83c139181eef0e95a650
Instruction ID: abc3cd32fa7efbc651f4c43fedb760048a6cc194134dbe042b92208828fb57a0
Opcode Fuzzy Hash: bc1d6925dde4bb6820630b65c43cc22f78b289cf956a83c139181eef0e95a650
Instruction Fuzzy Hash: BE018F71B000155BDB65EA6CD8A0B6FB7DAEBC9720F20842DE64BC7341DA25DD1243A5

Function 0122D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2589689674.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_122d000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b342587f02f4df216fd9fa4589941a60fabf0b5787ec5e4e812599987ae7f8
Instruction ID: 5034d3101b71a8d3e0bf29f218bfde26407c6532a2c8424b9a397c38138d183b
Opcode Fuzzy Hash: 04b342587f02f4df216fd9fa4589941a60fabf0b5787ec5e4e812599987ae7f8
Instruction Fuzzy Hash: 0A11BB75504284DFCB12CF54D5C4B19BBA1FB84314F28C6AAD9494B667C33AD44ACB62

Function 06C47678 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43edb1efc0d13116afe12d9b45afda928988ae3797371aa99f800a3bb54d7224
Instruction ID: 684d66d8c2c494b31ea257d394f65da994d0a3d756d6f5f0f7d6b22f52f77f42
Opcode Fuzzy Hash: 43edb1efc0d13116afe12d9b45afda928988ae3797371aa99f800a3bb54d7224
Instruction Fuzzy Hash: 9C110871E11124CBDB24EF28DC407AAB376EB81350F0044BDD80AE7380D7349E468BD1

Function 06C43040 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14571b429c9be2080b0736c500360609899c4184e9acde4f3d0f62de91f9a8f4
Instruction ID: 967d10c27ff6757e4e22a7b922089900baf19a4bb98d53e041226c976eef8dc5
Opcode Fuzzy Hash: 14571b429c9be2080b0736c500360609899c4184e9acde4f3d0f62de91f9a8f4
Instruction Fuzzy Hash: 77018471E002589BDB54EBBAD8405DEFBF5EFC9710F10856AD509E7300EA319A40CBA0

Function 06C43859 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8902bb4ddcd393a2244b78ff13ad428dd50090bf5dad3bc8a875c677bcef9fe
Instruction ID: 0da5fd81a58a74214cd9ebe144d23187ec960a6e36c4bf74c2ed34a8cc290199
Opcode Fuzzy Hash: c8902bb4ddcd393a2244b78ff13ad428dd50090bf5dad3bc8a875c677bcef9fe
Instruction Fuzzy Hash: B321FCB1D00659AFCB00DF9AD884ADEFBF8FB49310F10812AE918A7240C374A944CFA5

Function 06C43860 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6b5e9a82e097bdc7d4c77d0a0a0f7fd82db7aedd50a10efde77b298aa76c34
Instruction ID: d49bb22ab7591eda7dedc8b0bc65c14126ebb06124c06e73ac7c050768e5a1ca
Opcode Fuzzy Hash: da6b5e9a82e097bdc7d4c77d0a0a0f7fd82db7aedd50a10efde77b298aa76c34
Instruction Fuzzy Hash: 8A11BFB5D01659AFCB00DF9AD884BDEFBB8FB49310F50812AE918B7240C375A954CFA5

Function 06C4A2F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00596e503cab1f65f81ec77bd1d5403e14725205c81cad56897de4910cd4bd79
Instruction ID: ad6fdac2b54dc99eed04dba948412d2c50f2a8d68dc454fe36cdc1033807c4e4
Opcode Fuzzy Hash: 00596e503cab1f65f81ec77bd1d5403e14725205c81cad56897de4910cd4bd79
Instruction Fuzzy Hash: FA01BCB1B104005BDBA0DABCE86076EB7D6EB89310F10843DEA4BC7384EA25DD128381

Function 06C441F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd983aa22ca331158c0b1673ab4376c0e75642cecf02f6cf290e7c2947469aa3
Instruction ID: 6dd6af8db451565bad69d98999d156807381d48d0afcd3d76a4fb263a78eaec6
Opcode Fuzzy Hash: dd983aa22ca331158c0b1673ab4376c0e75642cecf02f6cf290e7c2947469aa3
Instruction Fuzzy Hash: 1601AD30B100110BDBB8E9ADE458B2BA7CAEBC9760F20C43DE10AC7351DE65ED424395

Function 06C43B8F Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d80ebc4aa358d0e69bb4bcfa4d7eae36b20f60d0209e82ab20bfbff3d197790
Instruction ID: 68fb2b03d332997f9857cc9d44f4e2a0a06234324ee24174ebb0d6f0f42ad78e
Opcode Fuzzy Hash: 0d80ebc4aa358d0e69bb4bcfa4d7eae36b20f60d0209e82ab20bfbff3d197790
Instruction Fuzzy Hash: 5401F772B005244BDB55EA6ECC246EF7BAADBC8710F04413ED81AE7380EF248D1257E1

Function 06C4F180 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60240c68f99108949f203abe0e8ca366dc3b81ebf46691ee6d50bdba55073833
Instruction ID: 4882cc7be7d61eec064a00262de575edb16dedb48983840a453ffa5798f7f0dc
Opcode Fuzzy Hash: 60240c68f99108949f203abe0e8ca366dc3b81ebf46691ee6d50bdba55073833
Instruction Fuzzy Hash: 8401AF71B100155BDBA5E66CD8A0B2FB7DAEBC9720F20883DE60BC7380DE25DD1243A5

Function 06C4A300 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cf38bf3ee8b84e2ec8814ce0d2099fe020c48879fa142fcf0f9952af4c695af
Instruction ID: 511a0f70cc8be23fb69f907b72165e90a45b112003a462cd1f59de77b85553fa
Opcode Fuzzy Hash: 3cf38bf3ee8b84e2ec8814ce0d2099fe020c48879fa142fcf0f9952af4c695af
Instruction Fuzzy Hash: C601A470B100145BDBA0EAACE46072FB3DAEBC9760F10883DE60FC7384EA25ED118394

Function 06C4C7C0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7ae3a70fc4d728948db0f154fbe1e4358dd000ea9ccbca3d1865787283af00
Instruction ID: 621b6d2cf33f273e8305aa5e43693c31fd1a4e3160b54ae57a526697bebf3d9b
Opcode Fuzzy Hash: ad7ae3a70fc4d728948db0f154fbe1e4358dd000ea9ccbca3d1865787283af00
Instruction Fuzzy Hash: 0001F471F21228ABDB64EAA9E840A9E7776FB85310F00403EE901EB340DA36AD048780

Function 06C482DE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e143a7edab2c1bb9b967d70c8ec3d205d519855ef007ac4c1034cdfdcdd2e6
Instruction ID: 1b70582ed6fcb45b8fe32016d7049d29dc0fa2b6a7641da8eb87e85017154582
Opcode Fuzzy Hash: f3e143a7edab2c1bb9b967d70c8ec3d205d519855ef007ac4c1034cdfdcdd2e6
Instruction Fuzzy Hash: EDF06535F06210CFDF64FE4AE9803B873A5E740654F1841BADD01D7144D739DB11C6A1

Function 06C46461 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eca0db0140451d5e488f2189e28f683f13b746b99a3192924f0d23ee653ff9a
Instruction ID: 1067f884593dbbe1c20247dff9a958b3544d9fe9e11f2ccfe57611552628aec8
Opcode Fuzzy Hash: 3eca0db0140451d5e488f2189e28f683f13b746b99a3192924f0d23ee653ff9a
Instruction Fuzzy Hash: C2E086F2E151049BDFA0EE71CAA535A7766EB42354F204DA9C809CB345E237DF158781

Function 06C46470 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2604406352.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c40000_qIQACwuR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction ID: 2939923727b0973e5ad017c816b2c5e4b8251572a1938df5e54e781f7be187c3
Opcode Fuzzy Hash: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction Fuzzy Hash: 50E0C2B0E10108ABDF50EEB2C94575AB7ADD702244F2088A8D409CB201E132DF014780

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5hD3Yjf7xD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5hD3Yjf7xD.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qIQACwuR.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0a0fckuw.g3y.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0whdddrv.k3o.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cbyszcau.c0o.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ex32iry2.v12.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5vlzoyx.0tl.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u2aqxl0m.zkt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xv0cq5dy.nt2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zo0gk4tj.tcw.psm1

C:\Users\user\AppData\Local\Temp\tmp7052.tmp

C:\Users\user\AppData\Local\Temp\tmp8745.tmp

Windows Analysis Report
5hD3Yjf7xD.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre