Edit tour

Windows Analysis Report
jKqPSehspS.exe

Overview

General Information

Sample name:	jKqPSehspS.exe renamed because original name is a hash value
Original sample name:	23a0eed35d69811a38633d41868a1fd6a20faf3912bde628eb556124fd6e5447.exe
Analysis ID:	1588702
MD5:	3b1b99f3617bbe21d2bd1601e6ce73ee
SHA1:	0ba6e0fe3c8f5a0511694421d841c377c1a4dae5
SHA256:	23a0eed35d69811a38633d41868a1fd6a20faf3912bde628eb556124fd6e5447
Tags:	AgentTeslaexeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

jKqPSehspS.exe (PID: 1308 cmdline: "C:\Users\user\Desktop\jKqPSehspS.exe" MD5: 3B1B99F3617BBE21D2BD1601E6CE73EE)

powershell.exe (PID: 6352 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3484 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BLpvFR.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 6860 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 3956 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp89B.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

jKqPSehspS.exe (PID: 6784 cmdline: "C:\Users\user\Desktop\jKqPSehspS.exe" MD5: 3B1B99F3617BBE21D2BD1601E6CE73EE)

BLpvFR.exe (PID: 2660 cmdline: C:\Users\user\AppData\Roaming\BLpvFR.exe MD5: 3B1B99F3617BBE21D2BD1601E6CE73EE)

schtasks.exe (PID: 7344 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp1EF1.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BLpvFR.exe (PID: 7408 cmdline: "C:\Users\user\AppData\Roaming\BLpvFR.exe" MD5: 3B1B99F3617BBE21D2BD1601E6CE73EE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "mail@iaa-airferight.com", "Password": "Asaprocky11"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.3946194292.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.3942304427.000000000042E000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.3942304427.000000000042E000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.3946068127.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.3946068127.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.3946068127.0000000002F4C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3946194292.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.3946194292.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: jKqPSehspS.exe PID: 1308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jKqPSehspS.exe PID: 1308	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: jKqPSehspS.exe PID: 1308	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: jKqPSehspS.exe PID: 6784	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jKqPSehspS.exe PID: 6784	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BLpvFR.exe PID: 2660	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BLpvFR.exe PID: 7408	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BLpvFR.exe PID: 7408	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.jKqPSehspS.exe.4259970.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.jKqPSehspS.exe.4259970.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jKqPSehspS.exe.4259970.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31769:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31885:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31961:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a87:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.jKqPSehspS.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.jKqPSehspS.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.jKqPSehspS.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.jKqPSehspS.exe.4294390.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.jKqPSehspS.exe.4294390.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jKqPSehspS.exe.4294390.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31769:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31885:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31961:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a87:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.jKqPSehspS.exe.4294390.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.jKqPSehspS.exe.4294390.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.jKqPSehspS.exe.4294390.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jKqPSehspS.exe.4294390.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd17:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd89:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de13:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dea5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df0f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df81:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e017:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e0a7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.jKqPSehspS.exe.4259970.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.jKqPSehspS.exe.4259970.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.jKqPSehspS.exe.4259970.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jKqPSehspS.exe.4259970.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df17:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa8737:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df89:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa87a9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e013:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8833:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e0a5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa88c5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e10f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa892f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e181:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa89a1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e217:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a37:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\jKqPSehspS.exe", ParentImage: C:\Users\user\Desktop\jKqPSehspS.exe, ParentProcessId: 1308, ParentProcessName: jKqPSehspS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe", ProcessId: 6352, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp1EF1.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp1EF1.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\BLpvFR.exe, ParentImage: C:\Users\user\AppData\Roaming\BLpvFR.exe, ParentProcessId: 2660, ParentProcessName: BLpvFR.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp1EF1.tmp", ProcessId: 7344, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Users\user\Desktop\jKqPSehspS.exe, Initiated: true, ProcessId: 6784, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp89B.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp89B.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\jKqPSehspS.exe", ParentImage: C:\Users\user\Desktop\jKqPSehspS.exe, ParentProcessId: 1308, ParentProcessName: jKqPSehspS.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp89B.tmp", ProcessId: 3956, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\jKqPSehspS.exe", ParentImage: C:\Users\user\Desktop\jKqPSehspS.exe, ParentProcessId: 1308, ParentProcessName: jKqPSehspS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe", ProcessId: 6352, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp89B.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp89B.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\jKqPSehspS.exe", ParentImage: C:\Users\user\Desktop\jKqPSehspS.exe, ParentProcessId: 1308, ParentProcessName: jKqPSehspS.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp89B.tmp", ProcessId: 3956, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.jKqPSehspS.exe.4294390.0.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "mail@iaa-airferight.com", "Password": "Asaprocky11"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\BLpvFR.exe

ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: jKqPSehspS.exe	Virustotal: Detection: 79%			Perma Link
Source: jKqPSehspS.exe	ReversingLabs: Detection: 91%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\BLpvFR.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: jKqPSehspS.exe

Joe Sandbox ML: detected

Source: jKqPSehspS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.8:49711 version: TLS 1.2

Source: jKqPSehspS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.jKqPSehspS.exe.4294390.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jKqPSehspS.exe.4259970.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.8:59576 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 46.175.148.58 46.175.148.58

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.8:49708 -> 46.175.148.58:25

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.iaa-airferight.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: jKqPSehspS.exe, BLpvFR.exe.0.dr	String found in binary or memory: http://localhost/arkanoid_server/requests.php
Source: jKqPSehspS.exe, 00000009.00000002.3946068127.0000000002F4C000.00000004.00000800.00020000.00000000.sdmp, BLpvFR.exe, 0000000E.00000002.3946194292.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: jKqPSehspS.exe, 00000000.00000002.1534303990.0000000003286000.00000004.00000800.00020000.00000000.sdmp, jKqPSehspS.exe, 00000009.00000002.3946068127.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, BLpvFR.exe, 0000000A.00000002.1573785874.0000000002756000.00000004.00000800.00020000.00000000.sdmp, BLpvFR.exe, 0000000E.00000002.3946194292.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: jKqPSehspS.exe, 00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp, jKqPSehspS.exe, 00000009.00000002.3942304427.000000000042E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: jKqPSehspS.exe, 00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp, jKqPSehspS.exe, 00000009.00000002.3946068127.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, jKqPSehspS.exe, 00000009.00000002.3942304427.000000000042E000.00000040.00000400.00020000.00000000.sdmp, BLpvFR.exe, 0000000E.00000002.3946194292.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: jKqPSehspS.exe, 00000009.00000002.3946068127.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, BLpvFR.exe, 0000000E.00000002.3946194292.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: jKqPSehspS.exe, 00000009.00000002.3946068127.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, BLpvFR.exe, 0000000E.00000002.3946194292.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.8:49711 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\jKqPSehspS.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\BLpvFR.exe

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.jKqPSehspS.exe.4259970.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.jKqPSehspS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.jKqPSehspS.exe.4294390.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.jKqPSehspS.exe.4294390.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.jKqPSehspS.exe.4259970.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\jKqPSehspS.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 0_2_0150DF14	0_2_0150DF14
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 0_2_07944730	0_2_07944730
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 0_2_079442F8	0_2_079442F8
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 0_2_07945F70	0_2_07945F70
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 0_2_07943EC0	0_2_07943EC0
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 0_2_0794BD08	0_2_0794BD08
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 0_2_07945B38	0_2_07945B38
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_0126A968	9_2_0126A968
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_01264A98	9_2_01264A98
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_01263E80	9_2_01263E80
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_012641C8	9_2_012641C8
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_0126F8A5	9_2_0126F8A5
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_06AE45A0	9_2_06AE45A0
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_06AE5D30	9_2_06AE5D30
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_06AE3578	9_2_06AE3578
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_06AE0338	9_2_06AE0338
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_06AEE0B9	9_2_06AEE0B9
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_06AE91F0	9_2_06AE91F0
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_06AEA140	9_2_06AEA140
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_06AE5650	9_2_06AE5650
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_06AE3CA0	9_2_06AE3CA0
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_06AEC358	9_2_06AEC358
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_00D0DF14	10_2_00D0DF14
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_05951140	10_2_05951140
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_05951130	10_2_05951130
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_06FF3EC0	10_2_06FF3EC0
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_06FF5F70	10_2_06FF5F70
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_06FF4730	10_2_06FF4730
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_06FF42F8	10_2_06FF42F8
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_06FFABA8	10_2_06FFABA8
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_06FF5B38	10_2_06FF5B38
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_0128A182	14_2_0128A182
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_0128A968	14_2_0128A968
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_0128DBE0	14_2_0128DBE0
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_01284A98	14_2_01284A98
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_01283E80	14_2_01283E80
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_012841C8	14_2_012841C8
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_0128E4D0	14_2_0128E4D0
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_068945A0	14_2_068945A0
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_06895D30	14_2_06895D30
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_06893578	14_2_06893578
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_0689E0B9	14_2_0689E0B9
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_06891030	14_2_06891030
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_068991E0	14_2_068991E0
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_0689A140	14_2_0689A140
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_06895650	14_2_06895650
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_06893C8F	14_2_06893C8F
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_06890328	14_2_06890328
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_0689C358	14_2_0689C358

Source: jKqPSehspS.exe, 00000000.00000002.1520573879.000000000134E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs jKqPSehspS.exe
Source: jKqPSehspS.exe, 00000000.00000002.1534303990.000000000329C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs jKqPSehspS.exe
Source: jKqPSehspS.exe, 00000000.00000002.1520573879.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShe vs jKqPSehspS.exe
Source: jKqPSehspS.exe, 00000000.00000002.1534303990.0000000003286000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8854fa4e-ee03-4899-b0c3-2df80b3f7614.exe4 vs jKqPSehspS.exe
Source: jKqPSehspS.exe, 00000000.00000000.1475642417.0000000000CE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamejNDn.exe0 vs jKqPSehspS.exe
Source: jKqPSehspS.exe, 00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8854fa4e-ee03-4899-b0c3-2df80b3f7614.exe4 vs jKqPSehspS.exe
Source: jKqPSehspS.exe, 00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs jKqPSehspS.exe
Source: jKqPSehspS.exe, 00000000.00000002.1538657428.0000000005A60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs jKqPSehspS.exe
Source: jKqPSehspS.exe, 00000000.00000002.1539533176.00000000078A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs jKqPSehspS.exe
Source: jKqPSehspS.exe, 00000009.00000002.3942304427.000000000042E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8854fa4e-ee03-4899-b0c3-2df80b3f7614.exe4 vs jKqPSehspS.exe
Source: jKqPSehspS.exe, 00000009.00000002.3942862074.0000000000F39000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs jKqPSehspS.exe
Source: jKqPSehspS.exe	Binary or memory string: OriginalFilenamejNDn.exe0 vs jKqPSehspS.exe

Source: jKqPSehspS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.jKqPSehspS.exe.4259970.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.jKqPSehspS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.jKqPSehspS.exe.4294390.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.jKqPSehspS.exe.4294390.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.jKqPSehspS.exe.4259970.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: jKqPSehspS.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: BLpvFR.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@3/2

Source: C:\Users\user\Desktop\jKqPSehspS.exe

File created: C:\Users\user\AppData\Roaming\BLpvFR.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6408:120:WilError_03
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6392:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03

Source: C:\Users\user\Desktop\jKqPSehspS.exe

File created: C:\Users\user\AppData\Local\Temp\tmp89B.tmp

Jump to behavior

Source: jKqPSehspS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: jKqPSehspS.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\jKqPSehspS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\jKqPSehspS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\jKqPSehspS.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\jKqPSehspS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: jKqPSehspS.exe	Virustotal: Detection: 79%
Source: jKqPSehspS.exe	ReversingLabs: Detection: 91%

Source: C:\Users\user\Desktop\jKqPSehspS.exe

File read: C:\Users\user\Desktop\jKqPSehspS.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\jKqPSehspS.exe "C:\Users\user\Desktop\jKqPSehspS.exe"
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BLpvFR.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp89B.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Users\user\Desktop\jKqPSehspS.exe "C:\Users\user\Desktop\jKqPSehspS.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\BLpvFR.exe C:\Users\user\AppData\Roaming\BLpvFR.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp1EF1.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process created: C:\Users\user\AppData\Roaming\BLpvFR.exe "C:\Users\user\AppData\Roaming\BLpvFR.exe"
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe"	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BLpvFR.exe"	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp89B.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Users\user\Desktop\jKqPSehspS.exe "C:\Users\user\Desktop\jKqPSehspS.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp1EF1.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process created: C:\Users\user\AppData\Roaming\BLpvFR.exe "C:\Users\user\AppData\Roaming\BLpvFR.exe"	Jump to behavior

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Section loaded: edputil.dll

Source: C:\Users\user\Desktop\jKqPSehspS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\jKqPSehspS.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\jKqPSehspS.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: jKqPSehspS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: jKqPSehspS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 0_2_0150EE60 push esp; iretd	0_2_0150EE61
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Code function: 9_2_01260C6D push edi; retf	9_2_01260C7A
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_00D0EE60 push esp; iretd	10_2_00D0EE61
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_00D0FCB8 push esp; retf	10_2_00D0FCBE
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_06FF9EAF push ebp; retf	10_2_06FF9EBE
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_06FF9E18 push ebp; retf	10_2_06FF9E26
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 10_2_06FF17F6 push es; retf	10_2_06FF1804
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Code function: 14_2_01280C6D push edi; retf	14_2_01280C7A

Source: jKqPSehspS.exe	Static PE information: section name: .text entropy: 7.794593073066602
Source: BLpvFR.exe.0.dr	Static PE information: section name: .text entropy: 7.794593073066602

Source: C:\Users\user\Desktop\jKqPSehspS.exe

File created: C:\Users\user\AppData\Roaming\BLpvFR.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\jKqPSehspS.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp89B.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: jKqPSehspS.exe PID: 1308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BLpvFR.exe PID: 2660, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\jKqPSehspS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Memory allocated: 1500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Memory allocated: 3250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Memory allocated: 3050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Memory allocated: 7FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Memory allocated: 8FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Memory allocated: 9180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Memory allocated: A180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Memory allocated: 1260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Memory allocated: 2ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Memory allocated: 2C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Memory allocated: D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Memory allocated: 2720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Memory allocated: 4720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Memory allocated: 7000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Memory allocated: 8000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Memory allocated: 8190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Memory allocated: 9190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Memory allocated: 1280000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Memory allocated: 13F0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8632	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 440	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7883	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 820	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Window / User API: threadDelayed 4765	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Window / User API: threadDelayed 5081	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Window / User API: threadDelayed 7748
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Window / User API: threadDelayed 2094

Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 2344	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5444	Thread sleep count: 8632 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5944	Thread sleep count: 440 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6396	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 796	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6744	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3356	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7288	Thread sleep count: 4765 > 30	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -99516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -99406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7288	Thread sleep count: 5081 > 30	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -99187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -99078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -98969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -98842s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -98734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -98625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -98515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -98406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -98297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -98188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -98063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -97938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -97813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -97701s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -97469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -97122s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -96990s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -96859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -96750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -96641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -96531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -96422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -96313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -96203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -96094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -95984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -95875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -95766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -95656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -95547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -95438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -95313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -95188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -95063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -94937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -94828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -94718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -94609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -94500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -94390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -94281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe TID: 7268	Thread sleep time: -94172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 2708	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7528	Thread sleep count: 7748 > 30
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7528	Thread sleep count: 2094 > 30
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -99766s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -99547s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -99438s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -99314s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -99188s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -99078s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -98969s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -98859s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -98750s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -98639s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -98531s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -98422s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -98311s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -98203s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -98094s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -97969s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -97860s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -97735s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -97610s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -97485s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -97360s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -97235s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -97110s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -96985s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -96860s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -96735s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -96610s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -96485s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -96314s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -96013s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -95906s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -95784s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -95672s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -95563s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -95453s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -95344s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -95235s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -95110s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -94985s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -94860s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -94735s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -94609s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -94500s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -94391s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -94281s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -94172s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -94047s >= -30000s
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe TID: 7524	Thread sleep time: -93938s >= -30000s

Source: C:\Users\user\Desktop\jKqPSehspS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\jKqPSehspS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\jKqPSehspS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 99187	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 99078	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 98842	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 98734	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 98625	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 98515	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 98406	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 98297	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 98188	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 98063	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 97938	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 97813	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 97701	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 97122	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 96990	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 96859	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 96750	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 96641	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 96531	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 96422	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 96313	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 96203	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 96094	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 95984	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 95875	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 95766	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 95656	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 95547	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 95438	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 95313	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 95188	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 95063	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 94937	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 94828	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 94718	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 94609	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 94500	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 94390	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 94281	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Thread delayed: delay time: 94172	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 99766
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 99547
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 99438
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 99314
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 99188
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 99078
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 98969
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 98859
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 98750
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 98639
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 98531
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 98422
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 98311
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 98203
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 98094
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 97969
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 97860
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 97735
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 97610
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 97485
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 97360
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 97235
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 97110
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 96985
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 96860
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 96735
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 96610
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 96485
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 96314
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 96013
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 95906
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 95784
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 95672
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 95563
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 95453
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 95344
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 95235
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 95110
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 94985
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 94860
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 94735
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 94609
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 94500
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 94391
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 94281
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 94172
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 94047
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Thread delayed: delay time: 93938

Source: jKqPSehspS.exe, 00000009.00000002.3944382197.0000000001325000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"
Source: BLpvFR.exe, 0000000E.00000002.3943193696.000000000100E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\jKqPSehspS.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe"
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BLpvFR.exe"
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe"	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BLpvFR.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Memory written: C:\Users\user\Desktop\jKqPSehspS.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Memory written: C:\Users\user\AppData\Roaming\BLpvFR.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe"	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BLpvFR.exe"	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp89B.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Process created: C:\Users\user\Desktop\jKqPSehspS.exe "C:\Users\user\Desktop\jKqPSehspS.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp1EF1.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Process created: C:\Users\user\AppData\Roaming\BLpvFR.exe "C:\Users\user\AppData\Roaming\BLpvFR.exe"	Jump to behavior

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Queries volume information: C:\Users\user\Desktop\jKqPSehspS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Queries volume information: C:\Users\user\Desktop\jKqPSehspS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Queries volume information: C:\Users\user\AppData\Roaming\BLpvFR.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Queries volume information: C:\Users\user\AppData\Roaming\BLpvFR.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\jKqPSehspS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.jKqPSehspS.exe.4259970.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.jKqPSehspS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jKqPSehspS.exe.4294390.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jKqPSehspS.exe.4294390.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jKqPSehspS.exe.4259970.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.3946194292.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3942304427.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3946068127.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3946068127.0000000002F4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3946194292.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jKqPSehspS.exe PID: 1308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jKqPSehspS.exe PID: 6784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BLpvFR.exe PID: 7408, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\jKqPSehspS.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\BLpvFR.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\jKqPSehspS.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\jKqPSehspS.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\BLpvFR.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.jKqPSehspS.exe.4259970.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.jKqPSehspS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jKqPSehspS.exe.4294390.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jKqPSehspS.exe.4294390.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jKqPSehspS.exe.4259970.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3942304427.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3946068127.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3946194292.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jKqPSehspS.exe PID: 1308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jKqPSehspS.exe PID: 6784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BLpvFR.exe PID: 7408, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.jKqPSehspS.exe.4259970.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.jKqPSehspS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jKqPSehspS.exe.4294390.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jKqPSehspS.exe.4294390.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jKqPSehspS.exe.4259970.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.3946194292.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3942304427.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3946068127.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3946068127.0000000002F4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3946194292.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jKqPSehspS.exe PID: 1308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jKqPSehspS.exe PID: 6784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BLpvFR.exe PID: 7408, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	2 Obfuscated Files or Information	11 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	2 Software Packing	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	211 Security Software Discovery	Distributed Component Object Model	11 Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
jKqPSehspS.exe	79%	Virustotal		Browse
jKqPSehspS.exe	91%	ReversingLabs	Win32.Trojan.AgentTesla
jKqPSehspS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\BLpvFR.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\BLpvFR.exe	91%	ReversingLabs	Win32.Trojan.AgentTesla

Name	IP	Active	Malicious	Reputation
mail.iaa-airferight.com	46.175.148.58	true	false	high
api.ipify.org	104.26.12.205	true	false	high
206.23.85.13.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.ipify.org	jKqPSehspS.exe, 00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp, jKqPSehspS.exe, 00000009.00000002.3946068127.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, jKqPSehspS.exe, 00000009.00000002.3942304427.000000000042E000.00000040.00000400.00020000.00000000.sdmp, BLpvFR.exe, 0000000E.00000002.3946194292.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://localhost/arkanoid_server/requests.php	jKqPSehspS.exe, BLpvFR.exe.0.dr	false	high
https://account.dyn.com/	jKqPSehspS.exe, 00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp, jKqPSehspS.exe, 00000009.00000002.3942304427.000000000042E000.00000040.00000400.00020000.00000000.sdmp	false	high
https://api.ipify.org/t	jKqPSehspS.exe, 00000009.00000002.3946068127.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, BLpvFR.exe, 0000000E.00000002.3946194292.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	jKqPSehspS.exe, 00000000.00000002.1534303990.0000000003286000.00000004.00000800.00020000.00000000.sdmp, jKqPSehspS.exe, 00000009.00000002.3946068127.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, BLpvFR.exe, 0000000A.00000002.1573785874.0000000002756000.00000004.00000800.00020000.00000000.sdmp, BLpvFR.exe, 0000000E.00000002.3946194292.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mail.iaa-airferight.com	jKqPSehspS.exe, 00000009.00000002.3946068127.0000000002F4C000.00000004.00000800.00020000.00000000.sdmp, BLpvFR.exe, 0000000E.00000002.3946194292.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588702
Start date and time:	2025-01-11 04:24:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jKqPSehspS.exe renamed because original name is a hash value
Original Sample Name:	23a0eed35d69811a38633d41868a1fd6a20faf3912bde628eb556124fd6e5447.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 159 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.242.162, 20.109.210.53, 13.85.23.206, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:25:25	Task Scheduler	Run new task: BLpvFR path: C:\Users\user\AppData\Roaming\BLpvFR.exe
22:25:21	API Interceptor	8170657x Sleep call for process: jKqPSehspS.exe modified
22:25:23	API Interceptor	49x Sleep call for process: powershell.exe modified
22:25:28	API Interceptor	5554198x Sleep call for process: BLpvFR.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	api.ipify.org/
	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
46.175.148.58	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse
	kzy8qg5lbR.exe	Get hash	malicious	AgentTesla	Browse
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	kzy8qg5lbR.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Shipment Dec Orders valves 2024.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
api.ipify.org	Wru9ycO2MJ.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	iNFGd6bDZX.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ukBQ4ch2nE.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	ru52XOQ1p7.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	BalphRTkPS.exe	Get hash	malicious	FormBook	Browse	104.21.32.1
	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Wru9ycO2MJ.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	iNFGd6bDZX.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	n2pGr8w21V.exe	Get hash	malicious	FormBook	Browse	104.18.73.116
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	02Eh1ah35H.exe	Get hash	malicious	FormBook, GuLoader	Browse	172.67.167.146
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
ASLAGIDKOM-NETUA	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	0PPJsQE4wD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	kzy8qg5lbR.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	INV01542 , INV01562-7500003124 JTR-0084.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Wru9ycO2MJ.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	iNFGd6bDZX.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	AJ5zYYsisA.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	AJ5zYYsisA.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.12.205
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.26.12.205

Process:	C:\Users\user\AppData\Roaming\BLpvFR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jKqPSehspS.exe.log

Download File

Process:	C:\Users\user\Desktop\jKqPSehspS.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380285623575084
Encrypted:	false
SSDEEP:	48:+WSU4xympjgZ9tz4RIoUl8NPZHUl7u1iMugeoM0Uyus:+LHxvCZfIfSKRHmOugU1s
MD5:	D9CF7738F833416DF98067988B7270F6
SHA1:	850DD37FC5CA1D2EDA84ABE415D61F9AF8E7A500
SHA-256:	952C0E59BC9FA7C1BB0515AEC11D3E3A70A6180C8A217A546C15605D9ADED106
SHA-512:	885CFEB3C9146D884229B106B82ED4B85491A9C0289B2C4CF23A051B492F2F75ECA9769078A823B3C7229E45ED0A25693B06E2675FC29BB558BC115201637D14
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0sc24soe.lpd.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5q24lbkz.fhg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bpe35po2.15g.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cyyv2pco.udk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gnwgj1tt.r4g.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j4quf2hi.t0l.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzmfehjk.g0i.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rxay05sy.ws5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp1EF1.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\BLpvFR.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1579
Entropy (8bit):	5.107462687472562
Encrypted:	false
SSDEEP:	24:2di4+S2qhtJ12iy1mcrUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtJxvn:cgeLAYrFdOFzOzN33ODOiDdKrsuT/v
MD5:	4776E633ED1558D935A431CF221DA377
SHA1:	6004B44564871062B18F8A2B171383EF34BDE117
SHA-256:	DBE5EE30D1C9C321E8F9C77DA5BE8A5999E199B3473020364E6DC868F87A1AD2
SHA-512:	BEB87E7BD593B69E700F7DC12275F77A6F39E0ADE442AFB55E73012C7150B1BF46110D20995E18EE2A36020CBFC517A134C50EDCFFAA75766ABCAABD8B1781EF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmp89B.tmp

Download File

Process:	C:\Users\user\Desktop\jKqPSehspS.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1579
Entropy (8bit):	5.107462687472562
Encrypted:	false
SSDEEP:	24:2di4+S2qhtJ12iy1mcrUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtJxvn:cgeLAYrFdOFzOzN33ODOiDdKrsuT/v
MD5:	4776E633ED1558D935A431CF221DA377
SHA1:	6004B44564871062B18F8A2B171383EF34BDE117
SHA-256:	DBE5EE30D1C9C321E8F9C77DA5BE8A5999E199B3473020364E6DC868F87A1AD2
SHA-512:	BEB87E7BD593B69E700F7DC12275F77A6F39E0ADE442AFB55E73012C7150B1BF46110D20995E18EE2A36020CBFC517A134C50EDCFFAA75766ABCAABD8B1781EF
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\BLpvFR.exe

Download File

Process:	C:\Users\user\Desktop\jKqPSehspS.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	927744
Entropy (8bit):	7.32819754870697
Encrypted:	false
SSDEEP:	12288:cIR4R52J+XtwK0LgcOE7V8oL+SuEQD+Dr/POop6hvbJ30zWA0ylgrdm4Vz0Rppp5:cIeetgclptRK+v/tYlb5FA0y
MD5:	3B1B99F3617BBE21D2BD1601E6CE73EE
SHA1:	0BA6E0FE3C8F5A0511694421D841C377C1A4DAE5
SHA-256:	23A0EED35D69811A38633D41868A1FD6A20FAF3912BDE628EB556124FD6E5447
SHA-512:	6EECD51EEA9933FAA504959F456707C0C132DBD2598B64830A94232A3A733550EFADD03FF5F52C89C658BC016AEE3328D429B2382D0B63559E49535CB4FDE14B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...piNg..............0.................. ........@.. ....................................@.................................0...O...........................`....................................................... ............... ..H............text........ ...................... ..`.rsrc..............................@..@.reloc.......`.......$..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BLpvFR.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\jKqPSehspS.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.32819754870697
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	jKqPSehspS.exe
File size:	927'744 bytes
MD5:	3b1b99f3617bbe21d2bd1601e6ce73ee
SHA1:	0ba6e0fe3c8f5a0511694421d841c377c1a4dae5
SHA256:	23a0eed35d69811a38633d41868a1fd6a20faf3912bde628eb556124fd6e5447
SHA512:	6eecd51eea9933faa504959f456707c0c132dbd2598b64830a94232a3a733550efadd03ff5f52c89c658bc016aee3328d429b2382d0b63559e49535cb4fde14b
SSDEEP:	12288:cIR4R52J+XtwK0LgcOE7V8oL+SuEQD+Dr/POop6hvbJ30zWA0ylgrdm4Vz0Rppp5:cIeetgclptRK+v/tYlb5FA0y
TLSH:	2115F18AA900E522DE586B342F33D93917356DADBD30D12E6AEC7D9B3FBBDD21414012
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...piNg..............0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	c5949296969e8473

Static PE Info

General

Entrypoint:	0x4aba82
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x674E6970 [Tue Dec 3 02:14:08 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaba30	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xac000	0x380d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa9a88	0xa9c00	e81e99576977fa7cda0364fd60a2c546	False	0.934967265740059	data	7.794593073066602	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xac000	0x380d0	0x38400	776efce66aef4203e073a89f574e744f	False	0.3072916666666667	data	5.218306193316651	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe6000	0xc	0x400	4ef96ebdaed6b531509751ef26b10fd4	False	0.025390625	data	0.05585530805374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xac490	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	0.38353658536585367
RT_ICON	0xacaf8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	0.48655913978494625
RT_ICON	0xacde0	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	0.5286885245901639
RT_ICON	0xacfc8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	0.5878378378378378
RT_ICON	0xad0f0	0x6739	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9933017975402081
RT_ICON	0xb382c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.5578358208955224
RT_ICON	0xb46d4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.6367328519855595
RT_ICON	0xb4f7c	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.6497695852534562
RT_ICON	0xb5644	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.47760115606936415
RT_ICON	0xb5bac	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.125
RT_ICON	0xc63d4	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.21113622030691612
RT_ICON	0xcf87c	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	0.21157894736842106
RT_ICON	0xd6064	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.24269870609981517
RT_ICON	0xdb4ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.22325224374114314
RT_ICON	0xdf714	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.3196058091286307
RT_ICON	0xe1cbc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.3642120075046904
RT_ICON	0xe2d64	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.5086065573770492
RT_ICON	0xe36ec	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5735815602836879
RT_GROUP_ICON	0xe3b54	0x102	data	0.5697674418604651
RT_GROUP_ICON	0xe3c58	0x14	data	1.05
RT_VERSION	0xe3c6c	0x278	data	0.46677215189873417
RT_MANIFEST	0xe3ee4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:25:26.620136976 CET	49707	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:26.620235920 CET	443	49707	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:26.620312929 CET	49707	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:26.642748117 CET	49707	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:26.642770052 CET	443	49707	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:27.111505032 CET	443	49707	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:27.111586094 CET	49707	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:27.115370035 CET	49707	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:27.115386009 CET	443	49707	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:27.115691900 CET	443	49707	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:27.193636894 CET	49707	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:27.240631104 CET	49707	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:27.283330917 CET	443	49707	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:27.347625017 CET	443	49707	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:27.347701073 CET	443	49707	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:27.347748995 CET	49707	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:27.629781008 CET	49707	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:28.779103041 CET	49708	25	192.168.2.8	46.175.148.58
Jan 11, 2025 04:25:29.959255934 CET	49708	25	192.168.2.8	46.175.148.58
Jan 11, 2025 04:25:30.968983889 CET	49711	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:30.969011068 CET	443	49711	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:30.969116926 CET	49711	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:30.972404957 CET	49711	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:30.972417116 CET	443	49711	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:31.431262016 CET	443	49711	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:31.431387901 CET	49711	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:31.477803946 CET	49711	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:31.477847099 CET	443	49711	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:31.478835106 CET	443	49711	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:31.678024054 CET	49711	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:31.842962027 CET	49711	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:31.887341976 CET	443	49711	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:31.952404976 CET	443	49711	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:31.952572107 CET	443	49711	104.26.12.205	192.168.2.8
Jan 11, 2025 04:25:31.956547976 CET	49711	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:31.958720922 CET	49711	443	192.168.2.8	104.26.12.205
Jan 11, 2025 04:25:31.959301949 CET	49708	25	192.168.2.8	46.175.148.58
Jan 11, 2025 04:25:32.533010006 CET	49712	25	192.168.2.8	46.175.148.58
Jan 11, 2025 04:25:33.553009033 CET	49712	25	192.168.2.8	46.175.148.58
Jan 11, 2025 04:25:35.568656921 CET	49712	25	192.168.2.8	46.175.148.58
Jan 11, 2025 04:25:35.959299088 CET	49708	25	192.168.2.8	46.175.148.58
Jan 11, 2025 04:25:39.584281921 CET	49712	25	192.168.2.8	46.175.148.58
Jan 11, 2025 04:25:43.959420919 CET	49708	25	192.168.2.8	46.175.148.58
Jan 11, 2025 04:25:47.599929094 CET	49712	25	192.168.2.8	46.175.148.58
Jan 11, 2025 04:25:51.701687098 CET	59576	53	192.168.2.8	162.159.36.2
Jan 11, 2025 04:25:51.706733942 CET	53	59576	162.159.36.2	192.168.2.8
Jan 11, 2025 04:25:51.708628893 CET	59576	53	192.168.2.8	162.159.36.2
Jan 11, 2025 04:25:51.713463068 CET	53	59576	162.159.36.2	192.168.2.8
Jan 11, 2025 04:25:52.183406115 CET	59576	53	192.168.2.8	162.159.36.2
Jan 11, 2025 04:25:52.188549042 CET	53	59576	162.159.36.2	192.168.2.8
Jan 11, 2025 04:25:52.188616991 CET	59576	53	192.168.2.8	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:25:26.564809084 CET	61612	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:25:26.571656942 CET	53	61612	1.1.1.1	192.168.2.8
Jan 11, 2025 04:25:28.759499073 CET	55794	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:25:28.770808935 CET	53	55794	1.1.1.1	192.168.2.8
Jan 11, 2025 04:25:51.701028109 CET	53	64194	162.159.36.2	192.168.2.8
Jan 11, 2025 04:25:52.219733953 CET	57269	53	192.168.2.8	1.1.1.1
Jan 11, 2025 04:25:52.226701975 CET	53	57269	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:25:26.564809084 CET	192.168.2.8	1.1.1.1	0xaf51	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:25:28.759499073 CET	192.168.2.8	1.1.1.1	0x4483	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:25:52.219733953 CET	192.168.2.8	1.1.1.1	0xbb98	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:25:26.571656942 CET	1.1.1.1	192.168.2.8	0xaf51	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:25:26.571656942 CET	1.1.1.1	192.168.2.8	0xaf51	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:25:26.571656942 CET	1.1.1.1	192.168.2.8	0xaf51	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:25:28.770808935 CET	1.1.1.1	192.168.2.8	0x4483	No error (0)	mail.iaa-airferight.com		46.175.148.58	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:25:52.226701975 CET	1.1.1.1	192.168.2.8	0xbb98	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	104.26.12.205	443	6784	C:\Users\user\Desktop\jKqPSehspS.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 03:25:27 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-11 03:25:27 UTC	424	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 03:25:27 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 9001ccb5895e7289-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1820&min_rtt=1819&rtt_var=684&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=769&delivery_rate=1596500&cwnd=238&unsent_bytes=0&cid=474d4a183d150a66&ts=249&x=0"
2025-01-11 03:25:27 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49711	104.26.12.205	443	7408	C:\Users\user\AppData\Roaming\BLpvFR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 03:25:31 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-11 03:25:31 UTC	424	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 03:25:31 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 9001ccd24d228c3c-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1957&min_rtt=1951&rtt_var=744&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1460000&cwnd=224&unsent_bytes=0&cid=2546c5f36ef920c3&ts=526&x=0"
2025-01-11 03:25:31 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	22:25:20
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\jKqPSehspS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\jKqPSehspS.exe"
Imagebase:	0xce0000
File size:	927'744 bytes
MD5 hash:	3B1B99F3617BBE21D2BD1601E6CE73EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1536631690.0000000004259000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:25:22
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jKqPSehspS.exe"
Imagebase:	0xc70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:25:22
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:25:23
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BLpvFR.exe"
Imagebase:	0xc70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:25:23
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:25:23
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp89B.tmp"
Imagebase:	0xb90000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:25:23
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:25:24
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\jKqPSehspS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\jKqPSehspS.exe"
Imagebase:	0xa90000
File size:	927'744 bytes
MD5 hash:	3B1B99F3617BBE21D2BD1601E6CE73EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.3942304427.000000000042E000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.3942304427.000000000042E000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.3946068127.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.3946068127.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.3946068127.0000000002F4C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:25:25
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\BLpvFR.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\BLpvFR.exe
Imagebase:	0x390000
File size:	927'744 bytes
MD5 hash:	3B1B99F3617BBE21D2BD1601E6CE73EE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 91%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:25:26
Start date:	10/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff605670000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:25:28
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLpvFR" /XML "C:\Users\user\AppData\Local\Temp\tmp1EF1.tmp"
Imagebase:	0xb90000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:25:28
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:25:29
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\BLpvFR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\BLpvFR.exe"
Imagebase:	0x980000
File size:	927'744 bytes
MD5 hash:	3B1B99F3617BBE21D2BD1601E6CE73EE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3946194292.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.3946194292.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3946194292.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	245
Total number of Limit Nodes:	11

Executed Functions

Function 07947068 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 079472A6

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1e4325e7655c4c7ad10781e0b0c38e649d2697b41385712ff2b5bbbb7c11e894
Instruction ID: da1a4c29bb55d9e883d207111be97023848cba495670f671d3c796e1f12007a9
Opcode Fuzzy Hash: 1e4325e7655c4c7ad10781e0b0c38e649d2697b41385712ff2b5bbbb7c11e894
Instruction Fuzzy Hash: 7C914CB1D0031ADFEB24DFA8CC41BDDBBB6BB48314F1485A9D808A7280DB759985CF91

Function 07947070 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 079472A6

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ab27eba216825dcc0fe95ef6d9752c645f884a8a00c66bcbad0c2a2eb6b7d101
Instruction ID: dbde1f3bf1f949ef734a536a259be78dec2470dc7fb0170d75e8a6fde65239b1
Opcode Fuzzy Hash: ab27eba216825dcc0fe95ef6d9752c645f884a8a00c66bcbad0c2a2eb6b7d101
Instruction Fuzzy Hash: C2913CB1D0071ADFEB24CFA8C841BDDBBB6BB48314F1485A9D808A7280DB759985CF91

Function 0150B0D0 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0150B326

Memory Dump Source

Source File: 00000000.00000002.1532085952.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_jKqPSehspS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a5f6f1bacfea429dcc286d593b5d437ad97b4e9b59bdcbd680acfcb85ab6fe43
Instruction ID: 857652ef3b495040d0a9f25448bd821420d2bcdca7f5b87edbb1b1d21e61237c
Opcode Fuzzy Hash: a5f6f1bacfea429dcc286d593b5d437ad97b4e9b59bdcbd680acfcb85ab6fe43
Instruction Fuzzy Hash: 3A717974A00B058FEB25CFA9D48479BBBF5FF88200F10892ED44ADBA91D774E945CB90

Function 015044B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015059A9

Memory Dump Source

Source File: 00000000.00000002.1532085952.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_jKqPSehspS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 318c98eade73734715e8d39dca495a3c4533afbaae50b42ae6b3d37dfcdd8ad7
Instruction ID: f30b86fa1b8078a538e9930bb7245248f46a27045d46700d2d4e97b1d36bb294
Opcode Fuzzy Hash: 318c98eade73734715e8d39dca495a3c4533afbaae50b42ae6b3d37dfcdd8ad7
Instruction Fuzzy Hash: AB41D270C1071DCBEB25CFA9C884B8EBBF5BF49304F20806AD408AB251DBB56945CF90

Function 015058ED Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015059A9

Memory Dump Source

Source File: 00000000.00000002.1532085952.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_jKqPSehspS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c9ddbbec59818022534b74cf4d665c0587aa9aa5d1074d8c1ca5ebcbc7cbe7c2
Instruction ID: 23068a0311f416cdfe539bdd0935a94684a65797382ef1d234c48213529f4eea
Opcode Fuzzy Hash: c9ddbbec59818022534b74cf4d665c0587aa9aa5d1074d8c1ca5ebcbc7cbe7c2
Instruction Fuzzy Hash: 8B41CF71C10719CFEB25CFA9C884B8EBBF5BF89304F60816AD408AB291DBB56945CF50

Function 07946DE0 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07946E78

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: cd1693ba175d81c66c73bf26d28eba0e5220fc600898b43bf46a9f0260533883
Instruction ID: 6663e8fd1e060c8b5f15ac0e2fed93d373822ecd9fa369d81d19857fd0e1865d
Opcode Fuzzy Hash: cd1693ba175d81c66c73bf26d28eba0e5220fc600898b43bf46a9f0260533883
Instruction Fuzzy Hash: A42177B6900309DFDB10CFAAC881BDEBBF4FF48310F108429E918A7240C7799911DBA4

Function 07946DE8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07946E78

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 459378b1e0d367bc586e58a5cde883de54cb7eaf7e9628d4f24770f8c0108982
Instruction ID: c65249fb01f674a49e25a22a9de15b8bae048519f513f1715fe1fe7ead191d72
Opcode Fuzzy Hash: 459378b1e0d367bc586e58a5cde883de54cb7eaf7e9628d4f24770f8c0108982
Instruction Fuzzy Hash: AA2166B6900309DFDB10CFAAC880BDEBBF5FF48310F10842AE918A7240C7799950CBA4

Function 07946ED0 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07946F58

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2c7e8b4e80c22077cb5dbece3e03c560c0e8715aabb0ceaacb3d46668eae66f9
Instruction ID: f5bbe70bc6cdccc66331a811b0851327fe7ccc0b7c5a9b41cd2c7611829134bc
Opcode Fuzzy Hash: 2c7e8b4e80c22077cb5dbece3e03c560c0e8715aabb0ceaacb3d46668eae66f9
Instruction Fuzzy Hash: E12134B28003599FDB10DFAAC881BEEFBF5FF48310F14842AE518A7240C7799915DBA0

Function 07946C49 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07946CCE

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 05a43f375a67a75170a0eb9c660eeda60999be3040c80e063089adb743ab19a7
Instruction ID: f63fc68e0883095410a7c8c81b462df1c31143c804b765efd913be2f2dc84de2
Opcode Fuzzy Hash: 05a43f375a67a75170a0eb9c660eeda60999be3040c80e063089adb743ab19a7
Instruction Fuzzy Hash: A12149B19003099FDB14DFAAC885BEEBBF4EF48314F14842AD519A7340C778A945CFA5

Function 0150CC40 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0150D566,?,?,?,?,?), ref: 0150D627

Memory Dump Source

Source File: 00000000.00000002.1532085952.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_jKqPSehspS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bfa055d6f0907b9b496305f240ec9d5e1723637aadc7d77be0f00dd5da7b075f
Instruction ID: 38c0f82aa162d6be7fb8e2c47cd00d460596cc1c2c116c7ca36da21003394c0c
Opcode Fuzzy Hash: bfa055d6f0907b9b496305f240ec9d5e1723637aadc7d77be0f00dd5da7b075f
Instruction Fuzzy Hash: 6B21B5B5900249DFDB10CFDAD884ADEBBF8FB48310F14841AE918A7350D375A954CFA5

Function 07946ED8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07946F58

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 32b80a3147790de4a20b51805052c19949288ef466baa2e14dfb54441a6da435
Instruction ID: f6d8ef05023cd88408408d1f5b2eeab8dd26bbd4dfdb42a23192d8f3f4fae3c3
Opcode Fuzzy Hash: 32b80a3147790de4a20b51805052c19949288ef466baa2e14dfb54441a6da435
Instruction Fuzzy Hash: 392125B18003499FDB10CFAAC881BEEFBF5FF48310F14842AE518A7240C7799911CBA1

Function 07946C50 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07946CCE

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 00036dd73033a117d92cdfc36080b70b58f884638e3447ffc3277aab2c445fa1
Instruction ID: b6b8c7f8818697c99aaa90375adee708baebe661d7860c58b6d5f5f6e2097341
Opcode Fuzzy Hash: 00036dd73033a117d92cdfc36080b70b58f884638e3447ffc3277aab2c445fa1
Instruction Fuzzy Hash: 802149B19003099FDB10CFAAC485BEEBBF4EF48314F14842AD519A7240C7789945CFA5

Function 0150D599 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0150D566,?,?,?,?,?), ref: 0150D627

Memory Dump Source

Source File: 00000000.00000002.1532085952.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_jKqPSehspS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a721cde92bb34d06597c459c6f6fb6b6085dc8d2e9f86ad50aabd8ecba01b93d
Instruction ID: 0b34a06ff80e412c9d36d629de6cd70505e1987af68e36c13b31bf3c9e2214ce
Opcode Fuzzy Hash: a721cde92bb34d06597c459c6f6fb6b6085dc8d2e9f86ad50aabd8ecba01b93d
Instruction Fuzzy Hash: 1821B3B5900249DFDB11CFEAD984ADEBBF4BB48310F14841AE918A7350D374A954CF65

Function 07946D20 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07946D96

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1d79407096dd151013850bf9244a9c21f3de95f8dc6eb7bb9363b44e6650732f
Instruction ID: 40a459c7e308f3e0b507de7c0b9f68794c3f22288296929191432aae37e2adbc
Opcode Fuzzy Hash: 1d79407096dd151013850bf9244a9c21f3de95f8dc6eb7bb9363b44e6650732f
Instruction Fuzzy Hash: F71156B6900249DFDF10DFAAC844BDFBBF5AF89320F148819E419A7250C776A551CFA0

Function 07946D28 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07946D96

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2e913cb26094d7eff88c6c4f5304b96bf5ee830691a990cb3d753da2072e03c3
Instruction ID: 19041a729dd86efc469ced41bac87eb4932c2b23dd4854e26e9e59eee94d7e15
Opcode Fuzzy Hash: 2e913cb26094d7eff88c6c4f5304b96bf5ee830691a990cb3d753da2072e03c3
Instruction Fuzzy Hash: AA1126B68003499FDB10DFAAC844BDFBBF9AF89320F148819E519A7250C776A550CFA1

Function 07946791 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 079467FA

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0cb635f7ca38f9676ce5991fe06c7a448889e42ed6b543ed3737975d763db2d8
Instruction ID: b59a394dc82af2d310bff7115afe48c91b62a99d7037d78a89eb9fa3b4ceb677
Opcode Fuzzy Hash: 0cb635f7ca38f9676ce5991fe06c7a448889e42ed6b543ed3737975d763db2d8
Instruction Fuzzy Hash: B0115BB19003498FDB14DFAAC845BDFFBF4EB48314F148819D419A7340C779A501CB94

Function 07946798 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 079467FA

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 506e1a4d206ef37a0fa1ad80438cdcfe0c36434d1647c86129101a5a503f4d40
Instruction ID: b203c16284c1650562cd87ae98e54911ea5d4a4406b30dd3abd5202265a0227c
Opcode Fuzzy Hash: 506e1a4d206ef37a0fa1ad80438cdcfe0c36434d1647c86129101a5a503f4d40
Instruction Fuzzy Hash: 18113AB5900349CFDB24DFAAC845BDFFBF8AB88714F148819D419A7340CB756541CBA5

Function 079468D4 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0794AF45

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f452bad44b0c52c42a021f8553893360c8eb270624cb7929f4daab66ef9e041e
Instruction ID: 99c70638d7a20b6ac4832b1802ba9946df50d24be2a2ef4dd592886cb6b8dfaf
Opcode Fuzzy Hash: f452bad44b0c52c42a021f8553893360c8eb270624cb7929f4daab66ef9e041e
Instruction Fuzzy Hash: 6A11F5B5804349DFDB20CF9AC885BEEFBF8EB58314F10845AE518A7210C375A544CFA1

Function 0794AEE0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0794AF45

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 5250d6dac5a9c3745a71480972e5454635a790aab5e37ffaa5b6fe353ac7b6b6
Instruction ID: 57ca25979167fc78427877a0e145b7fe944212dc9d4e4855c32a7cd3e3663e0e
Opcode Fuzzy Hash: 5250d6dac5a9c3745a71480972e5454635a790aab5e37ffaa5b6fe353ac7b6b6
Instruction Fuzzy Hash: 041103B5800749DFDB20CF9AD845BDEBBF8EB48324F10845AE518A7240C375A544CFA1

Function 0794693C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0794AF45

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 667b4f4c22b545d0afda3351ca120f8fecad6808fe87c1653a7c911d2fedb959
Instruction ID: 53c4130f22495e1557d46527bf5ec72518f1d2c145e3a07632d393f878e120a3
Opcode Fuzzy Hash: 667b4f4c22b545d0afda3351ca120f8fecad6808fe87c1653a7c911d2fedb959
Instruction Fuzzy Hash: 6C11F2B5800749DFDB20CF9AD885BDEBBF8EB58314F10845AE518A7201D3B5A944CFA1

Function 0150B2C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0150B326

Memory Dump Source

Source File: 00000000.00000002.1532085952.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_jKqPSehspS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 883801135ebf5dd29b85a620f9b3cd06133545575c3261c350a353ff9b20a40e
Instruction ID: 88a1606e871c38e81c98b5ecc451a49dbd5623b540a2b36254a3de85d875022a
Opcode Fuzzy Hash: 883801135ebf5dd29b85a620f9b3cd06133545575c3261c350a353ff9b20a40e
Instruction Fuzzy Hash: 2C110FBAC007498FDB24CF9AD444ADEFBF4AF88210F20841AD828A7240C375A545CFA1

Function 0794683F Relevance: 1.5, APIs: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 079467FA

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a73c79ae161e63d86b625fcede03576e9a6a826cbb332a43a91b6c789ced1961
Instruction ID: b554b0936c12a21d12a39b2899a5b7b5650180f1a443ea648382ecc2c71befd9
Opcode Fuzzy Hash: a73c79ae161e63d86b625fcede03576e9a6a826cbb332a43a91b6c789ced1961
Instruction Fuzzy Hash: 22F059B2504386CFD721EB79C8047CEFFE0EF42214F28888EC08A97A42CA3E4006C752

Function 014AD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528788401.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ad000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21f1b51f4f5ccc4da6be2c9361329f893d805f6a0e13536ffc4cda76b47c1ea
Instruction ID: 4a72b435af6c646d00fcdae2ed397f84ffa80b4cab03f8e465cc8995a8c64748
Opcode Fuzzy Hash: d21f1b51f4f5ccc4da6be2c9361329f893d805f6a0e13536ffc4cda76b47c1ea
Instruction Fuzzy Hash: 522148B1900244EFDB05DF54D8C0B27BF61FB98318F64C56AE8450B666C336D406CBA2

Function 014AD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528788401.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ad000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7383a5109da6d0bd762d61a7a31909640eca6d6a7d1cc46dfa89eef9531e32
Instruction ID: 9647fa2dd5815b0b35c01a5c0a34fb989e41b0257f86b1fdb108d7550c637857
Opcode Fuzzy Hash: 2c7383a5109da6d0bd762d61a7a31909640eca6d6a7d1cc46dfa89eef9531e32
Instruction Fuzzy Hash: F02136B1900304DFDB05DF94D9C0B56BB65FBA8314F61C17AE8090F666C336E446CAA2

Function 014BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1529571127.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14bd000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b54c590a894b9508c9f33d62a3e4c976cd11c69046c58bc03ae4724133b5d41
Instruction ID: 9623065366f52532696816d5d7686a330a8ff3935855bf606cab4bca933ffc0d
Opcode Fuzzy Hash: 4b54c590a894b9508c9f33d62a3e4c976cd11c69046c58bc03ae4724133b5d41
Instruction Fuzzy Hash: 2F2103B1904204DFDB15DFA8D8C0B16BB61FB8421CF24C5AAD80A0B366C336D407CA72

Function 014BD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1529571127.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14bd000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fe936822340506838fca378d770fe3ccce3559fda52b0414bf495ce5a29e6a
Instruction ID: 93b56e9af0c4fc084e6d7913a3d44d60552a03a2923b5e2d595d6ef20dd8337e
Opcode Fuzzy Hash: 84fe936822340506838fca378d770fe3ccce3559fda52b0414bf495ce5a29e6a
Instruction Fuzzy Hash: A4217F755093809FCB02CF24D9D0716BF71EB46218F28C5DAD8498F6A7C33A980ACB62

Function 014AD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528788401.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ad000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction ID: ec94804cf8a338e17cf59049f6ccdf97df51370c3f070623a376436dcf391996
Opcode Fuzzy Hash: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction Fuzzy Hash: 7911DFB6804240DFDB02CF44D9C4B56BF71FB94324F24C2AAD8090B667C33AE456CBA2

Function 014AD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528788401.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ad000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction ID: 7c452071504bbe8cfc66a6f913cce3876023d4aaa365b7208db64878f7d33be1
Opcode Fuzzy Hash: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction Fuzzy Hash: AF11E172804280DFCB02CF54D9C4B16BF71FB94318F24C6AAD8490B667C336D456CBA2

Function 014AD731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528788401.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ad000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39019ca40c214ae6a8e0b3c2b79fd4d40143d82523c6d218cd3a7cbe00f2b711
Instruction ID: 520df37557a06cccb1e364cb758f2f3f063bd90879bb55a9cb1de838cb8f6fb6
Opcode Fuzzy Hash: 39019ca40c214ae6a8e0b3c2b79fd4d40143d82523c6d218cd3a7cbe00f2b711
Instruction Fuzzy Hash: C401F775804384ABF7144AA9CC80B67BFD8EF90620F54C42BED080E6A3C2389840CAB2

Function 014AD730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528788401.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ad000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f50a6c2ac00a906e758f6dbbd5765d8ccc0b125ebf8fd0e390e4c52669c6e9
Instruction ID: f8080472342303a2375293cc2e11db1fb5c130d94edc518ef28d3bcb2cca1e4b
Opcode Fuzzy Hash: e0f50a6c2ac00a906e758f6dbbd5765d8ccc0b125ebf8fd0e390e4c52669c6e9
Instruction Fuzzy Hash: 30F0CD36404384AFE7248A1ACC84B67FFD8EB90734F18C55AED080E293C2799840CAB1

Non-executed Functions

Function 0794BD08 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e118dd5498cd1fda85f72b3f9a4eab6f7b6902d26929eecde8dcc3021b865bc3
Instruction ID: ceba114afe231665e01f271b74a9896525a9c6291d1c66078a9e99bfe21c5434
Opcode Fuzzy Hash: e118dd5498cd1fda85f72b3f9a4eab6f7b6902d26929eecde8dcc3021b865bc3
Instruction Fuzzy Hash: 57D19DB1B017068FEB29EB75C850BAEB7FAAFC9708F14446DD1469B290CB35E901CB51

Function 07944730 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ca25a83b438bb3adbd51e6937af354dbe285028e7e9e9b20ec89e4dfc32d2e
Instruction ID: f9b52f4be86b35c91106b8a64d19f85b5c55ce3d214aef025f36d42599e65a71
Opcode Fuzzy Hash: 46ca25a83b438bb3adbd51e6937af354dbe285028e7e9e9b20ec89e4dfc32d2e
Instruction Fuzzy Hash: 39E1E6B4E002598FDB14DFA9C580AAEFBB6FF89305F248169D814AB355D731AD41CFA0

Function 07945F70 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be02da22710e761d7ee9463e286c5e16a95bd79728bf23fe8318277ca80e9bad
Instruction ID: 4ec5b6eab3b4f45be080293fdf067482a2e8ccc0d0e5dad1c31d91669f0dc39e
Opcode Fuzzy Hash: be02da22710e761d7ee9463e286c5e16a95bd79728bf23fe8318277ca80e9bad
Instruction Fuzzy Hash: 34E1F8B4E002198FDB14DFA9C580AAEBBB6FF8A305F248169D814AB355D731AD41CF61

Function 07943EC0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d4314f4b83005cf606eeee6294e18a20fa4fb5fe4c82889bedf72e898ac8a7
Instruction ID: f05168358a5b68c51450cfa28ec0f173d38c5fb3acdc6fef94bb1b2b35ab5412
Opcode Fuzzy Hash: 19d4314f4b83005cf606eeee6294e18a20fa4fb5fe4c82889bedf72e898ac8a7
Instruction Fuzzy Hash: B8E115B4E002598FDB14DFA8C580AAEFBB6FF89305F248169D814AB355D731AD41CFA0

Function 07945B38 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4517e133802b689a5bd4b4fb5521f9a679a6a09717e0b7553b5a18332e1797f
Instruction ID: 50f3d4179e25d456d55c0ca61a8f8721e34a753ef2358c2a8ddf9b8f4e7189d4
Opcode Fuzzy Hash: a4517e133802b689a5bd4b4fb5521f9a679a6a09717e0b7553b5a18332e1797f
Instruction Fuzzy Hash: DEE1F8B4E002198FDB14DFA9C584AAEBBF6FF89305F248169D814AB355D730AD41CFA1

Function 079442F8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1539769716.0000000007940000.00000040.00000800.00020000.00000000.sdmp, Offset: 07940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7940000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dab69d5354813f022fd8ea1ef3de6db61f2acf5e7a6da2c9c4a5a64798c1a0e
Instruction ID: 6f78e978ae449636fed10a831cc764ec23b440be126f18684213e050baa47c75
Opcode Fuzzy Hash: 6dab69d5354813f022fd8ea1ef3de6db61f2acf5e7a6da2c9c4a5a64798c1a0e
Instruction Fuzzy Hash: 93E1E5B4E002598FDB14DFA9C580AAEBBF6FF89305F248169D814AB355D731AD41CFA0

Function 0150DF14 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1532085952.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b588cbb4b18490353b16a24c6c806ccda8819c8731341a2e767e68fcb0605aa7
Instruction ID: c538caaedc01fce51027af65a812a3958490572a7342bb8b9d1ba2b16ec03fa6
Opcode Fuzzy Hash: b588cbb4b18490353b16a24c6c806ccda8819c8731341a2e767e68fcb0605aa7
Instruction Fuzzy Hash: 82A16F32E0020A8FCF16DFF5C84059EBBB6FF84300B15856AE915AF2A5DB75D945CB80

Analysis Process: jKqPSehspS.exePID: 6784, Parent PID: 1308COMMON

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	4

Executed Functions

Function 0126A968 Relevance: 2.8, Instructions: 2805COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f77d9a3f9c677abf48b0814174ffd706f0eef3e0a96d2670eb8aaed08568cec
Instruction ID: 150620d201c9b57916f3fccf774f2211e253427a1502c7a4dbdd969f53cc4aba
Opcode Fuzzy Hash: 0f77d9a3f9c677abf48b0814174ffd706f0eef3e0a96d2670eb8aaed08568cec
Instruction Fuzzy Hash: E7531831D10B5A8ACB51EF68C8846A9F7B1FF99300F50D79AE44877121FB70AAD5CB81

Function 01264A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10dfe8b13f79145242b00909be505707e8f2fc9dafd43fff4d8319d1324e7de6
Instruction ID: 5d1de84bd74ec67ad4e419e398c59c9e6fd6937799232023e56db5e20993f85b
Opcode Fuzzy Hash: 10dfe8b13f79145242b00909be505707e8f2fc9dafd43fff4d8319d1324e7de6
Instruction Fuzzy Hash: C9B18070E1024ACFDB10DFA9C88179DBBF6AF98314F148129D954E7394EB759885CB81

Function 01263E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1fe08f1cee4d3f636f1d4774e5714d5f1d6f261cdb306f473acd19f74be9e92
Instruction ID: b0e33e847003a64f6af2c1e5163b34acf6539d6643467acfdbc8f31fc517dc94
Opcode Fuzzy Hash: b1fe08f1cee4d3f636f1d4774e5714d5f1d6f261cdb306f473acd19f74be9e92
Instruction Fuzzy Hash: 1E919C70E1024ACFDF14DFA9C8817DEBBF6BF88304F148129E559A7294EB749885CB81

Function 06AEE950 Relevance: 1.6, APIs: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.3959512169.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ae0000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 746868802e7a51ac8f1379b5e89fd2de187e0ea3fd7029fcf4dbb4d0d410e590
Instruction ID: 2f40618752c4ceffde47b7d8f2521fe85bd22a2da05af1ff0101da141c1cf25a
Opcode Fuzzy Hash: 746868802e7a51ac8f1379b5e89fd2de187e0ea3fd7029fcf4dbb4d0d410e590
Instruction Fuzzy Hash: D4412472D047858FDB04DF75D40439EBBF1BF89310F15856AD508AB381EB789889CBA1

Function 06AEEA38 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 06AEEA9F

Memory Dump Source

Source File: 00000009.00000002.3959512169.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ae0000_jKqPSehspS.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 76d52f090a8f46445375236aec8471d434019a26b0585e1d7bb9d000af42a053
Instruction ID: 9b4c27d68b85d9fc3d19bd7d05d953e9367813b73bcbf62496a8fbf9fb151931
Opcode Fuzzy Hash: 76d52f090a8f46445375236aec8471d434019a26b0585e1d7bb9d000af42a053
Instruction Fuzzy Hash: 7111F0B1C006599BDB10DFAAC844BDEFBF4BF48320F15816AD918A7240D778A944CFA5

Function 012686C8 Relevance: .6, Instructions: 564
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4365fbf122b4b69002e81e0a51c1ea38e14075c41eb6962dcd9d0b1ad5392a29
Instruction ID: 0b6f9d88ecdf2ff3a87f21b95c935393bfeec6b0348244d3ae19614bc365d005
Opcode Fuzzy Hash: 4365fbf122b4b69002e81e0a51c1ea38e14075c41eb6962dcd9d0b1ad5392a29
Instruction Fuzzy Hash: 65226D30B012069BDB26AB7CE4946AC33A6FBC9651B104E3DE205CB795DF71EC96C781

Function 01268720 Relevance: .6, Instructions: 556
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e3141a2d46677982b440f7f4f0dcb9b5d6a935496030f5dc46f3740121c9a4
Instruction ID: 13003609e96e3b3a303b63afeb67603f065725a2bc16ae9a981cb55f4ccc2f09
Opcode Fuzzy Hash: c5e3141a2d46677982b440f7f4f0dcb9b5d6a935496030f5dc46f3740121c9a4
Instruction Fuzzy Hash: 65125E30B012079BDB26AA7CE4946AC33A6FBC9651B144E3DE205CB785DF71EC96C781

Function 0126A182 Relevance: .4, Instructions: 417
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 978dcb6f15727d63279a48a8f21562d7831e17751062a483ea03d6144a123d3b
Instruction ID: fde7e6b468df2da5b8d48f4ff3b7026bb7ac96068c0b9d4e633e41e2eb7d448e
Opcode Fuzzy Hash: 978dcb6f15727d63279a48a8f21562d7831e17751062a483ea03d6144a123d3b
Instruction Fuzzy Hash: 2DE19434B1020A8FDF15DB68D8946ADBBB6FF88310F244529E606E7391DB35DD82CB91

Function 01264A8E Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2852a698de512d545e6b1d1cfab558b2a03cae3d58a1ad50f7499dbfd0970664
Instruction ID: 654148d0eeb66cae2f20c39afe300636b83b1796dd229676195e6ae699828508
Opcode Fuzzy Hash: 2852a698de512d545e6b1d1cfab558b2a03cae3d58a1ad50f7499dbfd0970664
Instruction Fuzzy Hash: 23A17E70E1024ACFDB10EFA9C8817DDBBF9AF98314F148129D954EB394EB759885CB81

Function 01263E74 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e702116af5184ae942a24100a35f5131688de28ab1168dbb8d35df708a1f40
Instruction ID: 12ebb361db001d9f6f9e0d99d6a641b621fd500418e82e2aa26ca58d9415254a
Opcode Fuzzy Hash: e0e702116af5184ae942a24100a35f5131688de28ab1168dbb8d35df708a1f40
Instruction Fuzzy Hash: 12A19C70E1025ACFDF14DFA8C8817DEBBF6BF98314F148129E558A7294EB749885CB81

Function 01264810 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd1fbefae413a4059a8d53a894d796446fed1d8fa3e3245020cd6239c380eff
Instruction ID: 4ebc42dcf827c366e4223afdcd9e81534fca17e07e6fc8b5beb247243e78f3b6
Opcode Fuzzy Hash: 5dd1fbefae413a4059a8d53a894d796446fed1d8fa3e3245020cd6239c380eff
Instruction Fuzzy Hash: 5E71A170E10389DFDB14EFA9C8807DEBBF6BF88314F148129E554A7290DB749881CB85

Function 01264806 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d685b077cde28db2b98e809cde6f187ee677323f32f79509421f691473d126
Instruction ID: c47eb8848b9b79f3b26b0389e02096913266f8d889d2d0569f35d602a5191ba0
Opcode Fuzzy Hash: e7d685b077cde28db2b98e809cde6f187ee677323f32f79509421f691473d126
Instruction Fuzzy Hash: D8719E70E1028ADFDB10EFA9C8857DEBBF6BF88314F148129E554A7290DB749881CF95

Function 01266ECF Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa660d8cf67f89759995ee80d0060e2e8e9d45d6cdd8348d4bf5ece4757369c6
Instruction ID: 3d33e9b35c4dcd7482592c6b3deb317bbf6c24b2a58b8f85fd2f71cb5df62447
Opcode Fuzzy Hash: aa660d8cf67f89759995ee80d0060e2e8e9d45d6cdd8348d4bf5ece4757369c6
Instruction Fuzzy Hash: F6519034720215CFDB14DB68D558AAE7BB6EF88704F204069E506EB3E1DB75DC81CBA1

Function 0126A6C8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55fd12535522dc000a567da895979468eb017d5963764b760f22d4635bb5880c
Instruction ID: 0c35c56774f8bef8cee9fe85789331bdc9280417651473077bab89127478548c
Opcode Fuzzy Hash: 55fd12535522dc000a567da895979468eb017d5963764b760f22d4635bb5880c
Instruction Fuzzy Hash: 12513975A00209CFDB14DFA9E884799FBB5FF88310F14C2BAE9089B395E7709945CB90

Function 01260CCB Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4824d131b9d100d55d64e3bea8b086aefcaa836a5e10196b786c1990d605f16
Instruction ID: 8d9ca32ccd1bdd72b45d3e9102e26e2099b2039f590a022ab3e244596d25f9fb
Opcode Fuzzy Hash: e4824d131b9d100d55d64e3bea8b086aefcaa836a5e10196b786c1990d605f16
Instruction Fuzzy Hash: E4512370D202198FDB18CFA9C895B9DFBF5BF48304F18811AD915AB391D774A884CB95

Function 01266CD4 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4210274cda1f5ddf2a49add76a7b1b316ef7f84dffffd50dde84569808570ed
Instruction ID: d33d7315801fce67d16c270651db49a2971e46475cfbdf7f114ec33a9109dea9
Opcode Fuzzy Hash: e4210274cda1f5ddf2a49add76a7b1b316ef7f84dffffd50dde84569808570ed
Instruction Fuzzy Hash: 5B512270D20219CFDB18CFA9C889B9DBBF5BF48314F14812AE915AB391D774A884CF95

Function 01266CE0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85633f53773fb41febd79223f1ea13f3211812a651fc1796aa899d9bc10722e
Instruction ID: 93f2e2013724786da31db6fc31bb7595f5268200a9eb68e045b9109a07026ff7
Opcode Fuzzy Hash: f85633f53773fb41febd79223f1ea13f3211812a651fc1796aa899d9bc10722e
Instruction Fuzzy Hash: 01510270D20219CFDB18CFA9C889B9DBBF5BF48314F14812AE915AB391D774A884CF95

Function 01261128 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 772d786ef42762038d10fa59de5eeecb3fd063cff266530b3f726fbdc6d76e2b
Instruction ID: b175700fe2981acb64233297f009aa021ad3446e6e72a59fbe59dff7ceb302fb
Opcode Fuzzy Hash: 772d786ef42762038d10fa59de5eeecb3fd063cff266530b3f726fbdc6d76e2b
Instruction Fuzzy Hash: CC513230613256CFCB0AFB7EF8C09943B62B7992057049B75D2044BA6EE7713966CB91

Function 01261138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f1c6a25f8ca9d43298e179b5ab991c6d175a9f37850ecd7a7d66d139e2e282
Instruction ID: 405cd5dbfb15a20becc6622461e082ab2abb3bc93e0b400c58c9c99acbdd4964
Opcode Fuzzy Hash: e4f1c6a25f8ca9d43298e179b5ab991c6d175a9f37850ecd7a7d66d139e2e282
Instruction Fuzzy Hash: CB511130613256CFCB0AFB7EF8C09943B72B7992057049B75D2044BA6EEB713966CB91

Function 0126DE6A Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6875b905d714d805ce011230df66d110db4b447a7be2c0180cde32e4b2e6e6
Instruction ID: 6b7b6ea890394b9bec8316166c7611353934d30c313b6b1561c30d89d6b63c84
Opcode Fuzzy Hash: ee6875b905d714d805ce011230df66d110db4b447a7be2c0180cde32e4b2e6e6
Instruction Fuzzy Hash: 10316075B00616EFD705DF68D890E3AB76ABFC4600F54C158E5419B299CB32EC42CB90

Function 01267D90 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ea0b2ade0a3cc19c006dba442b502a5b29e3dfa32c1adf246efea14d6b5ae5
Instruction ID: cd98ca051b1fa801c18a1797589531f6603f07071339819883595d9565cc0b74
Opcode Fuzzy Hash: 51ea0b2ade0a3cc19c006dba442b502a5b29e3dfa32c1adf246efea14d6b5ae5
Instruction Fuzzy Hash: 77318431E2020ACFDB25DF69E8507AEB7B6FF85314F204929E505EB280DB71AD85CB40

Function 012626DC Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60b7e19693c1ab3bb3173afc5947ae770fc8e5f7a6dea4d860d42fdf0c5ff48
Instruction ID: 12bfe008f9dd67c6ffbb9b3b03e8013e6140075403acd833c1ab6b8d16f82318
Opcode Fuzzy Hash: c60b7e19693c1ab3bb3173afc5947ae770fc8e5f7a6dea4d860d42fdf0c5ff48
Instruction Fuzzy Hash: 1B41EEB4D10349DFEB14DFA9C884ADEBBF5FF48310F148029E819AB250DB759985CB91

Function 01267D80 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 084a999e30b1075c0be8f73bbd3a9a9357257f0ce9ab9c851ee1e06899a16088
Instruction ID: ab6e3f68be4c7205e2e7f1f6171124c5c9c7bb739dab4a59fc8f1461c4336741
Opcode Fuzzy Hash: 084a999e30b1075c0be8f73bbd3a9a9357257f0ce9ab9c851ee1e06899a16088
Instruction Fuzzy Hash: 01316131E2020ACBDB25CF79D8907AEB7B6EF95314F204529E505EB281DBB59886CB40

Function 01265097 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea79b1fcde5d26a4fc3705c4d87751f3d02aec34aa7322ca58af0027e1467b9a
Instruction ID: ee052c6d00af78f44e6b28b3ceefd2ef309e7debb0e650182c953e91656a8321
Opcode Fuzzy Hash: ea79b1fcde5d26a4fc3705c4d87751f3d02aec34aa7322ca58af0027e1467b9a
Instruction Fuzzy Hash: 89316030711216CFDB15EF38C9506AD77F6AF89240F1005A8DA01AB3D4DB36DC91CB91

Function 012626E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4782c7b976346fc84782e6c2fbbb4e74cfef494f5b5d7e0cf8e1a42cbf64d9
Instruction ID: 752755fc74884e7bc9d18197134ae7db5fe3e811d3ebba6c8b42e4e360dbbfaa
Opcode Fuzzy Hash: db4782c7b976346fc84782e6c2fbbb4e74cfef494f5b5d7e0cf8e1a42cbf64d9
Instruction Fuzzy Hash: 2741E170D10349DFEB14DFA9C884ADEBBF9FF48310F148029E409AB250DB75A945CB91

Function 012650A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fcab019388db8e47a036e920b49d9138253eeab0d38b25cf5dc0537d11b0ea
Instruction ID: 98030f86d68910aa987e19b822b9de4d502edcaf5419031b11f87d3750ee7475
Opcode Fuzzy Hash: 33fcab019388db8e47a036e920b49d9138253eeab0d38b25cf5dc0537d11b0ea
Instruction Fuzzy Hash: 9D317234710226CFDB14EB78D5506AD77FAAF88240F1005A8D601AB3D4DB36DC81CB91

Function 0126A068 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f0974531814efffac5b76032886989f1b3b9a672b95496706e06e33c1087e4
Instruction ID: 11624eb330109e6973a12edb139fed003c0d6d5f86256555728ece8432efc3a1
Opcode Fuzzy Hash: 99f0974531814efffac5b76032886989f1b3b9a672b95496706e06e33c1087e4
Instruction Fuzzy Hash: 75318174E1024ACBDB15CFA8D99179EFBB2BF89300F108659E905FB281DB759985CB80

Function 0126A078 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b1406a194224acf64e99596211f3f21905162a40f8624dac267fb65c27ed84
Instruction ID: a52be74b6e22f787b6cd4342c1edba41296af455728bf76a5e4668349e5da1e0
Opcode Fuzzy Hash: d7b1406a194224acf64e99596211f3f21905162a40f8624dac267fb65c27ed84
Instruction Fuzzy Hash: 7B216274E1020ADBDB15CFA9D89069EF7B6FF89340F108659E905FB281DB719885CB90

Function 0126169F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580d17ea47b695b2b1417e7fded7f44b9a747d88a3bfdf729e68bf2e7e04474c
Instruction ID: a86288edca3839f8fa5e9ff992a27be1abdc354e1f2ffd7d2747a6e33e36a9f7
Opcode Fuzzy Hash: 580d17ea47b695b2b1417e7fded7f44b9a747d88a3bfdf729e68bf2e7e04474c
Instruction Fuzzy Hash: 94218338A111128FDF17BB7DF884759335AE785204F104B71D105C729AEB29A8A1CB92

Function 01269F68 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ac4c35d6d3284fc2bf957eadbd1a0e30acc0a046da728ba25aa7a01f1a73bf
Instruction ID: dd9b9eab34841142bd0f93f429afb43de4648992bc55c354b0486b81f8d16f2a
Opcode Fuzzy Hash: 59ac4c35d6d3284fc2bf957eadbd1a0e30acc0a046da728ba25aa7a01f1a73bf
Instruction Fuzzy Hash: 1C21C130E1020ACBCB19CF68D8906DEF7B6EF89310F10852AE815FB381DB70A885CB51

Function 01261382 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66f66bb1b8198332dfaba480ccefe7a13aacb7de1ddd5573e638584a35e3b47
Instruction ID: 14161628009a75e2ed9efc20c56e5366a6db05541c96ee457d4e4e103ba55266
Opcode Fuzzy Hash: f66f66bb1b8198332dfaba480ccefe7a13aacb7de1ddd5573e638584a35e3b47
Instruction Fuzzy Hash: AE210830A102528BEB37172CE4843683729E782311F014A2AE607CB7C5D624E8F58752

Function 0126A860 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64eb23ba41ce973afa9e267970860b75a5712f2bba88bd4d965d6f93d4c2094a
Instruction ID: 31c342f38cf0f4457bff978faa424a1b3f150248301406866399c85834ab78db
Opcode Fuzzy Hash: 64eb23ba41ce973afa9e267970860b75a5712f2bba88bd4d965d6f93d4c2094a
Instruction Fuzzy Hash: 03219875B201058FEB14DB69C954BAD7BF9AF88710F218129E505FB3E0DA71CD40C790

Function 01261878 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bdafc4980dc4df1a1547c99da9d47d7443ad1f2d37e8f96789a31bc3cb64d1d
Instruction ID: 471222cfa042d533ae37852480e5fe9b6d4c2422f7718bb304c53a3740ef956a
Opcode Fuzzy Hash: 2bdafc4980dc4df1a1547c99da9d47d7443ad1f2d37e8f96789a31bc3cb64d1d
Instruction Fuzzy Hash: BD218130B11216CFDF24DB78C5147AD77F6AF89300F200468C605EB290DB36ADA1CB91

Function 0126A852 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef786549c5bb757bac351b5f0e1a2b01735096de667a4d1b8c55d7e046a1506
Instruction ID: 8f6eb590bd8188790ce4729be4a7f86f67dcbf82d33b6ede5bcb6c9e8106a8a1
Opcode Fuzzy Hash: 7ef786549c5bb757bac351b5f0e1a2b01735096de667a4d1b8c55d7e046a1506
Instruction Fuzzy Hash: D521B075F202058FEB14CB68C955BAE77F9AF88710F258029E505FB3A0DA71CD408B90

Function 01264F8A Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d2ae10c145a84d6b3482fd2e386c043ba73b4d5590c2feb5220d38e6638150
Instruction ID: 485044ccb102976b8eb6ccb1d42b7599df4547e883a4f97c0eb1187ddd952dbd
Opcode Fuzzy Hash: 74d2ae10c145a84d6b3482fd2e386c043ba73b4d5590c2feb5220d38e6638150
Instruction Fuzzy Hash: C9213D34B10215CFCB54EB78D658AADB7F5EF8D244B104468E506EB3A4DB31ED80CB91

Function 0110D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3943394583.000000000110D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0110D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110d000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea96264e6dae1a27029a9e4d6cd5b4653a9902fa7d6c32d08cecc1c35089d474
Instruction ID: 41f22b58d81638dcb51b3050eb1987441dedf85cf8d39c2f44d68d3a170afb6b
Opcode Fuzzy Hash: ea96264e6dae1a27029a9e4d6cd5b4653a9902fa7d6c32d08cecc1c35089d474
Instruction Fuzzy Hash: A9212571A04304DFDF1ADF94E980B26BB61FB84314F24C56DE80D0B29AC3B6D447CA62

Function 01261888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d894d021ec603c36a3d9beb2e97e062e34d44a25c8543f2f4302433c92872b1
Instruction ID: 6d0620417d5163a617d793efc890fdc396230573a5fcf4c969a69630d4e9629f
Opcode Fuzzy Hash: 0d894d021ec603c36a3d9beb2e97e062e34d44a25c8543f2f4302433c92872b1
Instruction Fuzzy Hash: CC213130B11216CFDF24EB78C5147AD77FAAF89241F100468D605EB294DB36AD90CBA1

Function 01269F78 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46ee4e592683a0f4f4df417680556f40bfd00d28d661c8bb1a8036e6060e73a
Instruction ID: b04212ad2ee2cd9e34ca3459b98d226a7f2d3f5c1ce41814c6cd0ed7d37ea7f7
Opcode Fuzzy Hash: e46ee4e592683a0f4f4df417680556f40bfd00d28d661c8bb1a8036e6060e73a
Instruction Fuzzy Hash: 52216230E1020ADFCB19CF68D49069EF7B6AF89314F50851AE915FB381DB71A885CB50

Function 012616B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1679e7c6d5119659f7d04d980519991b08cf1e32ab2869ad58972cb4c99c0aab
Instruction ID: 02114d5da19313afea95c8edfd5a6bb82d0296ca7a14bebd4b40b1edfad8a8f3
Opcode Fuzzy Hash: 1679e7c6d5119659f7d04d980519991b08cf1e32ab2869ad58972cb4c99c0aab
Instruction Fuzzy Hash: B12142386111168BDF17E77DF884759335AF785604F104B31D105CB29AEB29ACA1CB92

Function 012617C0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f14389d36fbf37b08152c6fb6a36bd03b16d435338cb00b3ccc584cf498d40
Instruction ID: d081d2df733c8e5df42df341e5694cd53e818093523435e44b3d3bb9ca268d65
Opcode Fuzzy Hash: 33f14389d36fbf37b08152c6fb6a36bd03b16d435338cb00b3ccc584cf498d40
Instruction Fuzzy Hash: 64112C76F012569FCB116F7568442AF7FF9EB45210B104625E941D7344EB399962CBC0

Function 01264F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462d2469090bdfe2dbdb8d125283b000c4fd1b5335a33fc278c23edfb9c5f604
Instruction ID: 906acec9509139218c8cdc8044a625e3b69c1505fbdd129e56693760a7234bc9
Opcode Fuzzy Hash: 462d2469090bdfe2dbdb8d125283b000c4fd1b5335a33fc278c23edfb9c5f604
Instruction Fuzzy Hash: FF212A34B10215CFDB18EB78D658AADB7F5AF8D240F100468E506EB3A4DB31ED80CB90

Function 01260AFB Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a721ca1448da3980e88c45949eb40e6910fcc109d7774d36f07419d941d65c93
Instruction ID: 6b8f2a5b70ee468d99e80719fb63d874a56d9417754152df2351712eb325e189
Opcode Fuzzy Hash: a721ca1448da3980e88c45949eb40e6910fcc109d7774d36f07419d941d65c93
Instruction Fuzzy Hash: 141138317182058FC31A5B78849026E7FAAFFC5210F1484AFC106DB285EA398846C752

Function 01260838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 756f2f214a1b43c11b905ceb663c12186a6819e881137b4604040849544fb0e5
Instruction ID: 7a775fed3989ccf91c966395c49086400b6f286c5c3e437ea5cae912cd8922c2
Opcode Fuzzy Hash: 756f2f214a1b43c11b905ceb663c12186a6819e881137b4604040849544fb0e5
Instruction Fuzzy Hash: 7011C630A213165BEF26967DD45036A325DF782214F148979F502CF2C2EA61CCD5ABC6

Function 01260848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d8149d0285e62ec65aece78258d28c53881b8090f7acbcb149ccf9c65627f03
Instruction ID: df194e1518463e33d7189e23aecb5b5c665b904643ba779f4c6e2c74ff0240f3
Opcode Fuzzy Hash: 5d8149d0285e62ec65aece78258d28c53881b8090f7acbcb149ccf9c65627f03
Instruction Fuzzy Hash: E611A330B2120A5BEF66EABDD4447693359FB86610F208979F116CF2C2EA61CCC59BC5

Function 01261488 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2c2c0d462e625694ca2ecd8186ac2b5df5cf413142daa2996f89281b23425e
Instruction ID: 8e51a9bb0822058989f34b19017398722feb4a818ba8ff3b548140c343bcbeee
Opcode Fuzzy Hash: 4e2c2c0d462e625694ca2ecd8186ac2b5df5cf413142daa2996f89281b23425e
Instruction Fuzzy Hash: 4C118271E202168FCB25AFBC84501AD76F9EB88210B1404B9D905E7381EB35D891CBD5

Function 01261498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5c1c0b5ff04460af29cd3e8f789fb0dba42d7532181480372013037d2de0d2
Instruction ID: 7435242d48d30d7b4ae91c17bf7a2a7ac38f5b1265f3144759b67b207c8c8d8f
Opcode Fuzzy Hash: fc5c1c0b5ff04460af29cd3e8f789fb0dba42d7532181480372013037d2de0d2
Instruction Fuzzy Hash: 63014431A102169FCB15EFBC94501ADBBF9EF88210B140479D505E7381EB35D891CBD5

Function 0110D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3943394583.000000000110D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0110D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_110d000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction ID: 68f16fe1072c6682fe5b4b836abab6257c30466c002707ad3ad157bf3f76e9b4
Opcode Fuzzy Hash: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction Fuzzy Hash: 0911BE75904280DFCB16CF94D5C0B15FF61FB84314F24C6AAD8494B697C37AD44ACB62

Function 0126A6C5 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2464d7f187550de2f71020c7b15b004ac634c5125f3d3cbecc7b0f61ca000de
Instruction ID: d89b74cc1125ea29ea052300af82e06194d51579333d242fa815eb63d416efb2
Opcode Fuzzy Hash: e2464d7f187550de2f71020c7b15b004ac634c5125f3d3cbecc7b0f61ca000de
Instruction Fuzzy Hash: 0E01B535A102058BDB04EFA8D9847DABB65FFD4310F54C174C90C6F296EB749945C791

Function 01266B98 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23f806faa56891dec99b199af8d876b8d9b682cab9623e84e014115ed335dbc
Instruction ID: 9b53ae5a6154655e97aeb7b84de3196adc2aef7e617a79d545556e20723611e2
Opcode Fuzzy Hash: b23f806faa56891dec99b199af8d876b8d9b682cab9623e84e014115ed335dbc
Instruction Fuzzy Hash: 6A01F231B002119FD314AB78D4107AE7BA7EBCA311F10857EC10ACB780DE368C81C791

Function 01268F08 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3991ad8aff0be460ab804997daee5c2ea02cd1e8bfa8eb377d3dbcbb9abb88c9
Instruction ID: 2a453b114dcccd85cf1c6492ebc8504352692ed3f023a06f1df211fa15d3dbc0
Opcode Fuzzy Hash: 3991ad8aff0be460ab804997daee5c2ea02cd1e8bfa8eb377d3dbcbb9abb88c9
Instruction Fuzzy Hash: 2B014B74901209EFDF51FBB9F991ADC7BB1FB84200F5047A9C009AB245EB322A15DB92

Function 01261524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c427392874a33c226b4a22409900467b3c599261cce4f4a4d520f92a8e24a3a
Instruction ID: 4db5ea8c506fc7de58fff915096a745adb452cb48ea80812631796c8c82e4eb7
Opcode Fuzzy Hash: 5c427392874a33c226b4a22409900467b3c599261cce4f4a4d520f92a8e24a3a
Instruction Fuzzy Hash: 18F02B73A24151CFD7128BF8A4911ACBFB8FAE421171D40E7D902DB2C1D725E4D6C755

Function 01267EA8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57adb5edbd93e04efce60ed79336712ce832054265bee2902b57a542053cf42
Instruction ID: da795cc828d89141c67c0b2b1a34dc6f64310184eb941c125c9ea185cc233fdc
Opcode Fuzzy Hash: a57adb5edbd93e04efce60ed79336712ce832054265bee2902b57a542053cf42
Instruction Fuzzy Hash: DCF03735B40104CFCB04EB74E598BAC73B2EF89715F2186A8E5068B3A4CB32AD52CF40

Function 01268F18 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3944140997.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1260000_jKqPSehspS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e3d848a7caa992e3f1a94e20d686cb84a11988a88e601c6d9c19b6fd0e4781
Instruction ID: 0e3a3bd59cf7c6add943185404436ea7c11f668296580786056f65a3761f1724
Opcode Fuzzy Hash: 93e3d848a7caa992e3f1a94e20d686cb84a11988a88e601c6d9c19b6fd0e4781
Instruction Fuzzy Hash: 67F01434A0120DEBDF05FBB9F990ADD77B5FB84201F505BA9C105AB254EF322A149B82

Analysis Process: BLpvFR.exePID: 2660, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	213
Total number of Limit Nodes:	16

Executed Functions

Function 00D0D357 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D0D3D6
GetCurrentThread.KERNEL32 ref: 00D0D413
GetCurrentProcess.KERNEL32 ref: 00D0D450
GetCurrentThreadId.KERNEL32 ref: 00D0D4A9

Memory Dump Source

Source File: 0000000A.00000002.1573193825.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_BLpvFR.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0fca777d88f45f0bbb6894c78a6995ba0bc2c12d7aa7dfed68b56bf5d34a967b
Instruction ID: cbe6d9fca0647d2977a8b479ef43ade1058a1f9f6152d7a7e5ca507ff3fd0565
Opcode Fuzzy Hash: 0fca777d88f45f0bbb6894c78a6995ba0bc2c12d7aa7dfed68b56bf5d34a967b
Instruction Fuzzy Hash: B95137B0900749CFEB14DFAAD548B9EBBF2EB48304F24805AE419A7391D774A944CB66

Function 00D0D358 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D0D3D6
GetCurrentThread.KERNEL32 ref: 00D0D413
GetCurrentProcess.KERNEL32 ref: 00D0D450
GetCurrentThreadId.KERNEL32 ref: 00D0D4A9

Memory Dump Source

Source File: 0000000A.00000002.1573193825.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_BLpvFR.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 68e5303d4dc9a066b53b67c888b512df37f9ae5b9d9111f222ac9ed86c4dd64f
Instruction ID: 5494a3e78f92fd6152f94c65239ac6c10d8ebe8fc73428b76e0638d20ef24f89
Opcode Fuzzy Hash: 68e5303d4dc9a066b53b67c888b512df37f9ae5b9d9111f222ac9ed86c4dd64f
Instruction Fuzzy Hash: AC5137B0900749CFEB14DFAAD548B9EBBF2EB48304F24805AE419A7391D774A944CB66

Function 06FF706F Relevance: 1.7, APIs: 1, Instructions: 244
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06FF72A6

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 51e0e4603ff432de09d6354001af2ac7b77f6b1cadaa9f95ba0a37a6915df363
Instruction ID: 8ff485a445236add905e2957c8e3f20408d17c50c14f27f45aadeec84585874e
Opcode Fuzzy Hash: 51e0e4603ff432de09d6354001af2ac7b77f6b1cadaa9f95ba0a37a6915df363
Instruction Fuzzy Hash: 59917871D10319DFEB60DFA8D841BDEFBB2AF48310F0485A9E948A7290DB749985CF91

Function 06FF7070 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06FF72A6

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2f96432d39f1af571f7aa2f85be3d1a7d6e9c148ac0042df7da6b333aa1a7ea4
Instruction ID: 3e4315c37eab970978b2e2b57f5482280fef84f761c7f1db2a4a8be310cc8a4f
Opcode Fuzzy Hash: 2f96432d39f1af571f7aa2f85be3d1a7d6e9c148ac0042df7da6b333aa1a7ea4
Instruction Fuzzy Hash: 26917871D10319DFEB60DFA8D841BDEFBB2AF48310F0485A9E948A7290DB749985CF91

Function 00D05A64 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1573193825.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8707a84cbd063e4b630b173213ec370ecd5459e2d745827a134b811170d7554
Instruction ID: e114340c3328bf3eebe623b6f44919e12da94f85d93db30e29e867f6336a05d3
Opcode Fuzzy Hash: d8707a84cbd063e4b630b173213ec370ecd5459e2d745827a134b811170d7554
Instruction Fuzzy Hash: 2B410471905B48CFEB11CFA8E8447EFBBB1AF56314F14418AC489AF299C7356906CF21

Function 00D044B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D059A9

Memory Dump Source

Source File: 0000000A.00000002.1573193825.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_BLpvFR.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a9833f1afb04beb3d883520b2feb55579602a7c5979a65b92cb0d331d5270a85
Instruction ID: af03168ec52409095d3ac6c2be3f44096268889e0e0cbf85a476ca49bf0bea70
Opcode Fuzzy Hash: a9833f1afb04beb3d883520b2feb55579602a7c5979a65b92cb0d331d5270a85
Instruction Fuzzy Hash: CC41E3B0D00719CFEB24DFA9C844BDEBBB6BF49304F20816AD408AB255DB756945CFA0

Function 00D058ED Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D059A9

Memory Dump Source

Source File: 0000000A.00000002.1573193825.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_BLpvFR.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e81fa005755c79536b45333d47ebf450c9ec6914d5496b5eb747172a73a4a711
Instruction ID: 6a87d5f535b1a20378c50c9ed787ff71388228ca67749825a09a02d9b31ca115
Opcode Fuzzy Hash: e81fa005755c79536b45333d47ebf450c9ec6914d5496b5eb747172a73a4a711
Instruction Fuzzy Hash: BA41E370D00719CFEB24DFA9C8447CEBBB5BF49304F24816AD408AB295DB756945CF61

Function 059527C0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1586739897.0000000005950000.00000040.00000800.00020000.00000000.sdmp, Offset: 05950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5950000_BLpvFR.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: d31c8718d0ba286b8b67613d84d74f8cebaf973be8f2ec59220a4a95ca9cfb6b
Instruction ID: ab3bb88232f1d7d54e94314f9a30987cc913e31f4e454aef7c5bffcd413846ee
Opcode Fuzzy Hash: d31c8718d0ba286b8b67613d84d74f8cebaf973be8f2ec59220a4a95ca9cfb6b
Instruction Fuzzy Hash: E1318D76904359DFCB11CFA9C844ADEBFF8EF49320F14805AEA54A7211C339A854DFA1

Function 06FF6DE0 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06FF6E78

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4eabff9a49cd7773534b522640ff30a01644849806b268281bf40ad2b5300308
Instruction ID: e84279093d42e8035695bba7da59e21d712d13861c07fa56d4986dae44a3c141
Opcode Fuzzy Hash: 4eabff9a49cd7773534b522640ff30a01644849806b268281bf40ad2b5300308
Instruction Fuzzy Hash: D8212476900309DFDB10CFAAC881BDEBBF5FF48310F148429E958A7250CB789945CBA5

Function 06FF6DE8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06FF6E78

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2be45e1b4377796141303b7d4ea3cedb1f72a6f02e51c4728103dc56cc199d16
Instruction ID: f852242f86b26468ea7e19e440e6bd586e3233ea9cd28ee7717de85da338153e
Opcode Fuzzy Hash: 2be45e1b4377796141303b7d4ea3cedb1f72a6f02e51c4728103dc56cc199d16
Instruction Fuzzy Hash: 2D212472900349DFDB10CFAAC885BDEBBF5FF48310F14842AEA58A7250C7789951CBA5

Function 06FF6ED0 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06FF6F58

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 25c6eb74d411c026550829d9c127749434082406baef08c1a8904dc3db76ccbb
Instruction ID: a56dc20533e4b3d31e02d0205f2c33e9a355c7021931e37f109fb6cfc5279823
Opcode Fuzzy Hash: 25c6eb74d411c026550829d9c127749434082406baef08c1a8904dc3db76ccbb
Instruction Fuzzy Hash: 112125718003499FDB10CFAAC881AEEFBF5FF48310F108429E518A7240DB799915CBA5

Function 06FF6C49 Relevance: 1.6, APIs: 1, Instructions: 68
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06FF6CCE

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 63f461fdafb0bea982bc078da5f8b787a43167eb3d544ccc0bf9368013e2d659
Instruction ID: e617ab5ae3fc5ff712a64a824faa11b051285c8870bcaf2f23fc6b080a272b17
Opcode Fuzzy Hash: 63f461fdafb0bea982bc078da5f8b787a43167eb3d544ccc0bf9368013e2d659
Instruction Fuzzy Hash: 26213871D103099FEB10DFAAC8857EFBBF4EF88214F14842AE559A7240CB789945CFA5

Function 06FF6ED8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06FF6F58

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1d79d97493e201d244f688bc6309af21343949cd5504a57e3de735407000d31a
Instruction ID: b9cdac3a55e8ff1d46a992753f703d67eef3b86fee0062bd8c94ef67b8b53adc
Opcode Fuzzy Hash: 1d79d97493e201d244f688bc6309af21343949cd5504a57e3de735407000d31a
Instruction Fuzzy Hash: 772114718003499FDB10CFAAC880BEEFBF5FF48310F14842AE519A7250D7799911CBA5

Function 06FF6C50 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06FF6CCE

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6dc93d3345f039bc503f86dbfacfcd7560f50feae6a5814309b4cad5cbc7e0b6
Instruction ID: 7841b322d3b10071fe739e3d43e283f5e0734ed68bf146b9719edecd1cac399a
Opcode Fuzzy Hash: 6dc93d3345f039bc503f86dbfacfcd7560f50feae6a5814309b4cad5cbc7e0b6
Instruction Fuzzy Hash: E9213571D103098FDB10CFAAC8857AEBBF4EF88214F14842AD559A7240CB789945CFA5

Function 00D0D59F Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D0D627

Memory Dump Source

Source File: 0000000A.00000002.1573193825.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_BLpvFR.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d78f6795973f40e2b0d3c976b96d0f1d67eba1ed40e81f6d13429d0eba9cb2ae
Instruction ID: e2bc634c93227be351a2eee2901632c61798e942f8c5d1a3dfbcd5d3b27a29ed
Opcode Fuzzy Hash: d78f6795973f40e2b0d3c976b96d0f1d67eba1ed40e81f6d13429d0eba9cb2ae
Instruction Fuzzy Hash: 6721E2B5900248EFDB10CFAAD884ADEFBF5EB48310F14841AE918A7350C379A940CFA5

Function 00D0D5A0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D0D627

Memory Dump Source

Source File: 0000000A.00000002.1573193825.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_BLpvFR.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ddc1641e325f8d0094acecdfece7a2475fb222712650bca0fb7d5bd327545198
Instruction ID: 77724e918e4aef4bd19f27da5231db5183b9feb5f4a15f79ba465e9a029fcea0
Opcode Fuzzy Hash: ddc1641e325f8d0094acecdfece7a2475fb222712650bca0fb7d5bd327545198
Instruction Fuzzy Hash: 1B21C4B5900348DFDB10CFAAD884ADEFBF9EB48310F14841AE958A7350D379A954CF65

Function 06FF6D20 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06FF6D96

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 98a40da92d3315e1619f24fdb35a29a3bdd7f7f26712a10ba8e27f1df4be079e
Instruction ID: e740bece6e1a758611feec4b527b6f639841de8afd1e4c9456db952fd647b1df
Opcode Fuzzy Hash: 98a40da92d3315e1619f24fdb35a29a3bdd7f7f26712a10ba8e27f1df4be079e
Instruction Fuzzy Hash: D41144769003499FDB20DFAAC845BDFBBF5AF48320F248819E559A7250CB75A940CBA1

Function 0595211C Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,059527DA,?,?,?,?,?), ref: 0595287F

Memory Dump Source

Source File: 0000000A.00000002.1586739897.0000000005950000.00000040.00000800.00020000.00000000.sdmp, Offset: 05950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5950000_BLpvFR.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: baed72e989de9640e0230eea6361c710639c328e37cb0e4a654339ce8213bbb9
Instruction ID: b6c0b7c359ae30c39cf6c63e3765534906c280f2b5acf23bd809450686e3295a
Opcode Fuzzy Hash: baed72e989de9640e0230eea6361c710639c328e37cb0e4a654339ce8213bbb9
Instruction Fuzzy Hash: F8113AB5800349DFDB10CF9AC844BDEBFF8EB48320F14841AEA54A7250C379A954CFA5

Function 06FF6791 Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06FF67FA

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 109f05f087b004474201921af6d1c0bfc78fe441d83cc46e99d258c46d9eda06
Instruction ID: a37d80b74c836fa92930ea90fd7164578bd9fcd3ab58b0f4fdccf9eeb7165c72
Opcode Fuzzy Hash: 109f05f087b004474201921af6d1c0bfc78fe441d83cc46e99d258c46d9eda06
Instruction Fuzzy Hash: DB115871D003488FDB20DFAAD8457DFFBF5EF88214F248829D519A7240CB79A945CBA5

Function 06FF6D28 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06FF6D96

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 01924204dd7675a1b368aaf3d37f118d35f1361925ce6f1a1241dc18748cfe05
Instruction ID: 35bc6d6323ead1b0511ce09b21ac0477f442e9e3fac6f34a9a01f17b83bb081a
Opcode Fuzzy Hash: 01924204dd7675a1b368aaf3d37f118d35f1361925ce6f1a1241dc18748cfe05
Instruction Fuzzy Hash: CB1126718003499FDB20DFAAC844BDFBBF5AF48320F248819E519A7250CB75A540CBA5

Function 06FF6798 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06FF67FA

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: bd53c1ce69653d275d82bec4a6d1f29e12d9073f599da941b2f67dd1957fb9b9
Instruction ID: d464b30a0a0d6418d6ac1865654d8322a4963c4ee33612c1994409fb19874e4b
Opcode Fuzzy Hash: bd53c1ce69653d275d82bec4a6d1f29e12d9073f599da941b2f67dd1957fb9b9
Instruction Fuzzy Hash: 53113671D003488FDB20DFAAC84579FFBF5AF88324F248829D519A7250CB79A941CBA5

Function 06FF9D80 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06FF9DE5

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a2a62d108208f4ba861aaabbe66306a98ca9b4192458c09e28d5752026fff892
Instruction ID: 02e247f4e2ab1079531dbfca4a2fc18c336fff74f3c021693f87c37dd6b2b278
Opcode Fuzzy Hash: a2a62d108208f4ba861aaabbe66306a98ca9b4192458c09e28d5752026fff892
Instruction Fuzzy Hash: 8B11F5B5800349DFDB20CF9AD885BDEFBF8EB48314F208419E598A7610C375A584CFA5

Function 00D0B2C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D0B326

Memory Dump Source

Source File: 0000000A.00000002.1573193825.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_BLpvFR.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 93f9c5aa72fc3bd6f1d5b663cc6aa474b1157cd3a8a9b43a0b57c53ba043740d
Instruction ID: d102451983ecbdf46fb0adb120ad8b33b33b032840cf357a091bf0762c537e29
Opcode Fuzzy Hash: 93f9c5aa72fc3bd6f1d5b663cc6aa474b1157cd3a8a9b43a0b57c53ba043740d
Instruction Fuzzy Hash: 8811FDB58007498BDB20CF9AD444B9EFBF4AB88320F24842AD468A7250C379A545CFA5

Function 00D0B2BF Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D0B326

Memory Dump Source

Source File: 0000000A.00000002.1573193825.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_BLpvFR.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fdc5e6c53d1e5648b1642c3fd59a7a5b790d324bfb6869e851b0d34bc2d379b6
Instruction ID: 6f5ebfb77db7067a2c0d6b18f361aad31ec0a0ac0bb82731f54d04c568984cfe
Opcode Fuzzy Hash: fdc5e6c53d1e5648b1642c3fd59a7a5b790d324bfb6869e851b0d34bc2d379b6
Instruction Fuzzy Hash: C911FDB58007498BDB20CF9AD444BDEFBF4AB88320F24842AD468A7250C379A545CFA1

Function 06FF693C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06FF9DE5

Memory Dump Source

Source File: 0000000A.00000002.1587241808.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6ff0000_BLpvFR.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fd79f7647772801ff366cf44c39ccf5ac093f904929e4fba72478ed3f6b8541a
Instruction ID: 2b640bef971ba26d7f7f4a9b21f69f015379771dcdb39a30246eab1eb348cbea
Opcode Fuzzy Hash: fd79f7647772801ff366cf44c39ccf5ac093f904929e4fba72478ed3f6b8541a
Instruction Fuzzy Hash: D811F5B5800749DFDB20DF9AC885BDEFBF8EB48314F208419E558A7211C3B5A944CFA5

Function 00A8D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1571542480.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a8d000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b461e5e7855a6acdcafa19234fef427c079ee641f6a30aeeed26d5f6e79eda6
Instruction ID: d73a580a98a7b9826f1bd56d592c484334af64c2e5ba076e4ab860aa7691a1de
Opcode Fuzzy Hash: 6b461e5e7855a6acdcafa19234fef427c079ee641f6a30aeeed26d5f6e79eda6
Instruction Fuzzy Hash: F521F871504244EFDB19EF14D9C0F26BF65FB84718F24C56AE8050B296C336D856CBA2

Function 00A9D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1571693767.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a9d000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d4a16761288b974e06c6a7cf9cbd3ba1b86bfb8ef26077e1eb9a8efad2db68
Instruction ID: 065385d1385313d3d8f63f837347531b99e2cb1ce87f46c24f82847df1587388
Opcode Fuzzy Hash: 64d4a16761288b974e06c6a7cf9cbd3ba1b86bfb8ef26077e1eb9a8efad2db68
Instruction Fuzzy Hash: C921F271604344EFDF14DF24D984B26BBA5FB84314F24C569E84A4B286C33AD887CA62

Function 00A9D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1571693767.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a9d000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21acb93e24e15a95e07091f200764ee86239bc43e4c5c452174949b9e00a6e59
Instruction ID: 7856a85382edfb58e0e4793ae879487915e891e17b46d7d90805c60b6ab588b4
Opcode Fuzzy Hash: 21acb93e24e15a95e07091f200764ee86239bc43e4c5c452174949b9e00a6e59
Instruction Fuzzy Hash: 052192755093809FDB02CF20D990715BFB1EB45314F28C5DAD8498B697C33AD84ACB62

Function 00A8D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1571542480.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a8d000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction ID: 0bfc69befcd88e22f78f3f0abef288c3fd9a57212a1020de09018358a6ea584b
Opcode Fuzzy Hash: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction Fuzzy Hash: 7A11E676504280DFCB15DF10D9C4B16BF71FB94318F24C6AAD8490F656C336D856CBA2

Function 00A8D731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1571542480.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a8d000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19e9629ae2a45af91cb4feebdfdae2294816b10c19ee78c4e2481a8da91d1b7
Instruction ID: 1f826ebc0f332a32a1c3bdbb7e79f021f449ebf31ee72232a2cab766fd469f02
Opcode Fuzzy Hash: b19e9629ae2a45af91cb4feebdfdae2294816b10c19ee78c4e2481a8da91d1b7
Instruction Fuzzy Hash: 4F01A271404744ABEB106B65DD84B66FBE8EF81724F28C46AED095E2C2C6789840CBB2

Function 00A8D730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1571542480.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a8d000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20913c63533fd7cc3b815d75e6fc72fa0d07d3661a37acc58fd89365af311677
Instruction ID: bd92f08043a10b74de2904f5946bd995048f7cca17ddfab785d35d3a51ed2b77
Opcode Fuzzy Hash: 20913c63533fd7cc3b815d75e6fc72fa0d07d3661a37acc58fd89365af311677
Instruction Fuzzy Hash: EDF0CD32004344AFEB109F16C884B66FFE8EB80734F28C45AED081E2C3C2789840CBB1

Analysis Process: BLpvFR.exePID: 7408, Parent PID: 2660COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	4

Executed Functions

Function 0128A968 Relevance: 2.8, Instructions: 2821COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9917a4640474b3d8627dcca824fa99a0c6a94f6dfb21ddd93005a5e8ab215f44
Instruction ID: 56f6fcd46fffa19f1acbefb47e0bafc164c166e70d654066ba3634b7a2ddb186
Opcode Fuzzy Hash: 9917a4640474b3d8627dcca824fa99a0c6a94f6dfb21ddd93005a5e8ab215f44
Instruction Fuzzy Hash: FB530831C10B5A8ACB51EF68C8846A9F7B1FF99300F51D79AE44877121FB70AAD5CB81

Function 0128DBE0 Relevance: 2.3, Instructions: 2288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a50a9cf5576cc35b9f4dbd816de0e9bc3fcba7b2568e7c3e09bd2b84b24c0d67
Instruction ID: ed867b35aaac182a4f753e121a88bb6ab3523efa65b2e4d169aa90e6f27cbd3f
Opcode Fuzzy Hash: a50a9cf5576cc35b9f4dbd816de0e9bc3fcba7b2568e7c3e09bd2b84b24c0d67
Instruction Fuzzy Hash: E8332C31D1071A8EDB11EF68C8846ADF7B1FF99300F15C79AE458A7251EB70AAC5CB81

Function 0128A182 Relevance: .4, Instructions: 418
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0af9a07853d0548a3fa40c93617a75426fd48da30e1fb6899d205c6ba68f5ce4
Instruction ID: 584f22022beada56d2681000148cbbe23fcca2f40a290be365c1c2fad6f027b7
Opcode Fuzzy Hash: 0af9a07853d0548a3fa40c93617a75426fd48da30e1fb6899d205c6ba68f5ce4
Instruction Fuzzy Hash: CAE1CF34B112198FDF15EB6CD494AADBBB2FB88310F24442AE606D7395DB35EC42CB90

Function 01284A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19441e07c4f82cab6d2285b8c2a7db0e788f2e6c0337c520144d35edc6e9d617
Instruction ID: dbf46e4950b28e76bae7a29068b75f12955308906c07d472efdf25d3189f4882
Opcode Fuzzy Hash: 19441e07c4f82cab6d2285b8c2a7db0e788f2e6c0337c520144d35edc6e9d617
Instruction Fuzzy Hash: EAB18F70E2124ACFDB10EFA9C8817ADBBF6AF88314F148129D914E7294EB759845CB81

Function 01283E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f5bec882474aaf2caa323f9898a46a947a8a5ea834129cb60e0b500061310f
Instruction ID: 9b292ce466b1340dac5f87cb97d0fda3cf4094517ee5a21396c21a3ab968aff6
Opcode Fuzzy Hash: e8f5bec882474aaf2caa323f9898a46a947a8a5ea834129cb60e0b500061310f
Instruction Fuzzy Hash: 26917070E2124ACFDB14EFA9C8817DEBBF2BF98714F148129E505A7294EB749845CB81

Function 0689E950 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.3959819982.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6890000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2543bca9ccc0f17d26b8c7d0a1de451eb7825dbe2c7da8cbbfa1d4c1f08bf79
Instruction ID: 82b25c360866183b053705e4ac9565235d115c27384d80995b4bc9cd3d9a2e5b
Opcode Fuzzy Hash: d2543bca9ccc0f17d26b8c7d0a1de451eb7825dbe2c7da8cbbfa1d4c1f08bf79
Instruction Fuzzy Hash: 4E412232D043899FCB14DF79D8042AEBFF1AFD9210F19856AD944E7341EB749889CBA1

Function 0689EA38 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0689EA9F

Memory Dump Source

Source File: 0000000E.00000002.3959819982.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6890000_BLpvFR.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 92f81d0ace5d000429101198597587d0443c56fac80b18b3008163520bac7bc0
Instruction ID: f97c8c9d5c12e00dc24a0e7f09d927c4deb9a453254702db1996ee369ee8741b
Opcode Fuzzy Hash: 92f81d0ace5d000429101198597587d0443c56fac80b18b3008163520bac7bc0
Instruction Fuzzy Hash: B511F3B1C106599BDB10DFAAC844BDEFBF4BF48320F15816AD918B7240D378A944CFA5

Function 01288720 Relevance: .6, Instructions: 554
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf10c8d93c68e70ab4fe8e671a83f7ac47752304c2738ba2886c6f22d3a667c
Instruction ID: 1eba62b3f205ef9469f8a59426722e44e065347335554454059175722ea4af60
Opcode Fuzzy Hash: 3bf10c8d93c68e70ab4fe8e671a83f7ac47752304c2738ba2886c6f22d3a667c
Instruction Fuzzy Hash: 2D124931721206DBDB16BA7CE44426C33A6FBC9315F504939E106CB395EF39EC4A8BA5

Function 01284A8E Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa3c6ec0ab7dec13c945d8330b388ef065f385027d6ec927d61d41f435789b6
Instruction ID: 048580483cb9ec876ea3884b5d3dac6ae607b8c81d1250107d0b39bd7caad000
Opcode Fuzzy Hash: daa3c6ec0ab7dec13c945d8330b388ef065f385027d6ec927d61d41f435789b6
Instruction Fuzzy Hash: FFA17C70E2124ACFEB10EFA9D8817DDBBF5BF88314F148129D914EB294EB759845CB81

Function 01283E74 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eef59286e442af0764a09f3fdedaac99bad64c7cebc3ce126f0b8076d6e8656
Instruction ID: 3397e3c6ca4460b427a495081ec8741fe09e213e160fc4378e03a5fae506e0bd
Opcode Fuzzy Hash: 5eef59286e442af0764a09f3fdedaac99bad64c7cebc3ce126f0b8076d6e8656
Instruction Fuzzy Hash: 4AA18C70E2124ACFDF14EFA8D8817DEBBF1BF98714F148129E514A7294EB749846CB81

Function 01286ECF Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5314fd6d9d7d7f9b3cb612b8319bfe174dde092b6c31ccb7e90464aaa83ef363
Instruction ID: cf7315a0a1177c240c84e8074581fc46bc8bcd381504d10f16f4b866d3e945f6
Opcode Fuzzy Hash: 5314fd6d9d7d7f9b3cb612b8319bfe174dde092b6c31ccb7e90464aaa83ef363
Instruction Fuzzy Hash: C7516B34721205CFDB14EB68C558AAD7BB6AF89704F2040A9E506EB3E1DB75DC41CBA1

Function 0128A6C8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60ad901404687cbc83ee0f821d122b936824403470414ac38b904c9b6289dab
Instruction ID: 5c1c397dbb68faa657d6dcce55c00a9899ce5f9806885706e26aa5240a5d7d3f
Opcode Fuzzy Hash: d60ad901404687cbc83ee0f821d122b936824403470414ac38b904c9b6289dab
Instruction Fuzzy Hash: 4A513D71A01209DFDB14DF69E88479DFBB2FF88310F14C16AEA099B395E7709945CB90

Function 01286CD4 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da5440bb5fe3b2a36a8ff03179e662bea0a4784000da4f8d689bd1764b8c3c4d
Instruction ID: b3234af05cabf9ea6a4963a92e55623e40e0ad0640fec4a169acbad9c3c45f42
Opcode Fuzzy Hash: da5440bb5fe3b2a36a8ff03179e662bea0a4784000da4f8d689bd1764b8c3c4d
Instruction Fuzzy Hash: A35131B4D21219CFEB18DFA9C885B9DBBF1BF48300F14812AD915AB391D774A844CB95

Function 01286CE0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04802d243b0847493e0afe0205532f810dd34b0ce9bacc8da79d926d4d31cb31
Instruction ID: bbcac7dde6694b6eb09c0a08f58a31909d3be19345d2835708da8541b1a4bc45
Opcode Fuzzy Hash: 04802d243b0847493e0afe0205532f810dd34b0ce9bacc8da79d926d4d31cb31
Instruction Fuzzy Hash: 2D512070D21219CFEB18DFA9C884B9DBBB1BF48310F14812AE915AB391D774A844CB95

Function 01281128 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d37aa60d5208949e291fa0e93852b96ca99803f57a03d1ddc7b8e4bf98e5b34
Instruction ID: fd190a57e866c738615e080c4594b36d7920552300aa63b4c656572d64325647
Opcode Fuzzy Hash: 0d37aa60d5208949e291fa0e93852b96ca99803f57a03d1ddc7b8e4bf98e5b34
Instruction Fuzzy Hash: 4451D833611285CFC706FB7CF8849993BB2B7967047049AAED0444B36EFB316906DBA1

Function 01281138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ddb8770a51311537cf13b80a3aa2307cdf22d6baccd8f5fb3e6414bd7d2767e
Instruction ID: 0113eacc305110407d085d9e76e6091224ae4d5143c1f891a6ce33a1aaae5159
Opcode Fuzzy Hash: 9ddb8770a51311537cf13b80a3aa2307cdf22d6baccd8f5fb3e6414bd7d2767e
Instruction Fuzzy Hash: 7051C633611285CFC706FF6CF8849993BB2B79A7047049AAED0444B36EFB716905DBA1

Function 01287D90 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf747774ec740f77f8f2fc3c1695fa77a19b6093a6db139a2771ed18ba89dd9c
Instruction ID: 06403b6cb133fc7ead48e751e26ff6bea59d9cc9606410d6590eea16f527c3cc
Opcode Fuzzy Hash: cf747774ec740f77f8f2fc3c1695fa77a19b6093a6db139a2771ed18ba89dd9c
Instruction Fuzzy Hash: E5315231E2120ADBDB15EFA9D4407AEB7B2FF85300F208525E505EB381EB75AD41CB50

Function 012826DC Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e8bc62c1318cac29a8236b31797006a182a24fd02ecc67d3ca4c75f92b3ba7
Instruction ID: 41973fe1a94c410753ec93813b3266cb38d1bc563bb71db179d767896a289bac
Opcode Fuzzy Hash: a4e8bc62c1318cac29a8236b31797006a182a24fd02ecc67d3ca4c75f92b3ba7
Instruction Fuzzy Hash: D441FEB4D11349DFEB14DFA9C880ADEBBF5BF48300F14842AE819AB250DB759945CB90

Function 01287D80 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e32ff995cb29a74d9676213eda83488b9954b3196bfcba1e610d7c38962dfa2
Instruction ID: 30e265ee7989b5e6c5a9d6e54dbe7b46c25572425e5f0f130514d40c7fe821b8
Opcode Fuzzy Hash: 8e32ff995cb29a74d9676213eda83488b9954b3196bfcba1e610d7c38962dfa2
Instruction Fuzzy Hash: 2A315031E2121ADBDB16DFB9C4517AEB7B2FF85300F208429E905FB291EB759941CB50

Function 012826E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7590b647fafe88ee19724ffdb3fa652396e18dd090fa423a90d1871c7c93161c
Instruction ID: 9d66f5c8625f447a57307f37665b41fafcd41cbcce1c8ade0121cdbe645db880
Opcode Fuzzy Hash: 7590b647fafe88ee19724ffdb3fa652396e18dd090fa423a90d1871c7c93161c
Instruction Fuzzy Hash: 0F4100B0D11349DFEB14DFAAC884ADEBBF5FF48310F148029E809AB250DB75A945CB90

Function 0128169F Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f85999192dc3f66d506da8ca7bcfe942e1625c43a384ddba9b4a71c4b21d0b
Instruction ID: ed0f393f452d3b8d61b4dd4bb52353b743548ccaa63ed4d5092345773330a25f
Opcode Fuzzy Hash: 19f85999192dc3f66d506da8ca7bcfe942e1625c43a384ddba9b4a71c4b21d0b
Instruction Fuzzy Hash: 5031C035622202CFEB17BB78E8847A937A9F745214F144965D506CB3CAFB35D8128791

Function 0128A068 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b678e7b192f8dee5f29a3f329f4a8458e2b27131dacd427873005ccb6c156d47
Instruction ID: aae4fa3d3d473231ff02544d20d72f2189465b0cbb37c867adaa9248ee5eb2e0
Opcode Fuzzy Hash: b678e7b192f8dee5f29a3f329f4a8458e2b27131dacd427873005ccb6c156d47
Instruction Fuzzy Hash: 03318430A1124A9BDB15DF68D85079EF7B2BF89300F10861AE905EB281DB71A946CB90

Function 0128A078 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 504a36cc0b57d24292128abbdc437ff61f656f729dfe0b5d4afcb1976d95a7c1
Instruction ID: d3acf79d41f13668a0fb97fd41b2ee6efa2cbcd348f9e5c5a237f96203f234f5
Opcode Fuzzy Hash: 504a36cc0b57d24292128abbdc437ff61f656f729dfe0b5d4afcb1976d95a7c1
Instruction Fuzzy Hash: 33217134E1120ADBDB15DF68D85079EF7B2BF89300F10C62AE905EB381DB71A946CB90

Function 0128A852 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f0fde30b825a1812919a28d9dc82ebb17812bbabdfd19e4a592b84b3e1cc7dc
Instruction ID: 59327f9c47cc4a424a564be9a1e13e38cd9f59db59d28e8a87d8b6dd07449e19
Opcode Fuzzy Hash: 2f0fde30b825a1812919a28d9dc82ebb17812bbabdfd19e4a592b84b3e1cc7dc
Instruction Fuzzy Hash: DC21C735B211058FEB14DB68C854BAD7BF5BF88710F14816AE501EB3E0DE718C008760

Function 01289F68 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918176b49aa2ea622f0dcc2058e2edb59e1118d08177636428ed46d2c673b66c
Instruction ID: f2ce0e8ec4364af58825f2277c90405ca24e889371288fbe659c6f76c95fde55
Opcode Fuzzy Hash: 918176b49aa2ea622f0dcc2058e2edb59e1118d08177636428ed46d2c673b66c
Instruction Fuzzy Hash: E421A430E1120A9FCB19DF68D5516EEB7B2AF89300F20851AE906F7381DB74A886CB40

Function 01281382 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b08e8106c925c3de76cfd3ec5373a6bdab9cad3a0927f74117ffd1f20dadc7
Instruction ID: cf67de6fdaea805319dfd747a04e1d511f4bd8b1cf68d28a9910b3e4c39f7337
Opcode Fuzzy Hash: b0b08e8106c925c3de76cfd3ec5373a6bdab9cad3a0927f74117ffd1f20dadc7
Instruction Fuzzy Hash: 4221A5706223469FEB32777CE48937C3B65EB07315F580859E606CB3C2DA2888968756

Function 01284F8A Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae6ca0f2719069a627f06ebaf85f380a4b2dd8385eb17d8cd85eb152e467ff4
Instruction ID: b3ae558766712838630eaa1f791affc935751653e2644ef1efc227de67f762b0
Opcode Fuzzy Hash: 5ae6ca0f2719069a627f06ebaf85f380a4b2dd8385eb17d8cd85eb152e467ff4
Instruction Fuzzy Hash: 72214634B11205CFDB54EB78D958AAD7BF1AF8D304B100468E606EB3A4DB329C41CBA5

Function 0123D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3944536959.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_123d000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6682b2c92bd7229f49030de96d2dbd62db4ea779600633b034f8ab2822dd2e4
Instruction ID: 1c0a6df74100a5317b1d3d658fd3a754f8aa691dc6f09da7b3465f1058d78191
Opcode Fuzzy Hash: d6682b2c92bd7229f49030de96d2dbd62db4ea779600633b034f8ab2822dd2e4
Instruction Fuzzy Hash: 132122B1614308EFDB11DFA4D980B26FBA5FBC4B14F64C56DE9090B242C376D847CA62

Function 01281878 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf1324efe7ab09a44a6466965287dfbd564f0cbc81f3c8c098755e56945e9260
Instruction ID: 58ef7e9e2f2c8060932769a1c5b9cc8539aeb47ceaba6e706ee1a15cc63534f1
Opcode Fuzzy Hash: bf1324efe7ab09a44a6466965287dfbd564f0cbc81f3c8c098755e56945e9260
Instruction Fuzzy Hash: C3216D35B21216CFDB25EB68C9157AD77B2AF49301F100868C205EB3D4EB368C52CB61

Function 01281888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737046bc58ca402a18cf7dfacd01271548bb16b7849ed3e25339e3295e990e7a
Instruction ID: 7ec20e40c940bdc462935b03c4d092441d586f764537ae8250cb2a993b898ce3
Opcode Fuzzy Hash: 737046bc58ca402a18cf7dfacd01271548bb16b7849ed3e25339e3295e990e7a
Instruction Fuzzy Hash: A8215130B21215CFDB24FB68C5147AD77F2AF49200F100468C605EB3D4EB369C52CBA2

Function 01289F78 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d47fd09940bf92816cec3dab6825e108f68635dadacef9b7fb41993e6696f8
Instruction ID: 7cb19458d2c2acb411f61537740a6d5895e9323847b27ae78777e38fd317fb31
Opcode Fuzzy Hash: f8d47fd09940bf92816cec3dab6825e108f68635dadacef9b7fb41993e6696f8
Instruction Fuzzy Hash: A7218730E1120ADFDF19DF68D4506AEF7B2AF89304F20851AE916F7381DB71A846CB50

Function 012816B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2b11c721ffcfc0c56e7019b264c3bb23841eacbba3581f642ac0ebbdfd6e3e
Instruction ID: 2b210b7c911e544a2377b82b62307adbc21e940f299cfc1b56d97bb7ce0c4ed6
Opcode Fuzzy Hash: 6f2b11c721ffcfc0c56e7019b264c3bb23841eacbba3581f642ac0ebbdfd6e3e
Instruction Fuzzy Hash: 85218E35621202CFEB12B77CF884B9937AAF785204F104A25D106CB3DAFB35D8528B95

Function 01284F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c14c5e0824d57f8060ee851e419e2cd234abd63c1fac3fbe226f8b5905167c2b
Instruction ID: df71792d895b411b0ecf682b23e4145929a15c4aeffc6e0ac34d186889611063
Opcode Fuzzy Hash: c14c5e0824d57f8060ee851e419e2cd234abd63c1fac3fbe226f8b5905167c2b
Instruction Fuzzy Hash: 0A214834B10205CFDB14EB78D958AAD77F1AF8C304F100468E606EB3A4DB329D41CBA5

Function 01280848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c247c131639a01003bfef93263b8fec9b80d681b2a026f1cbedb4bd6e55729
Instruction ID: 1a4077803cb75c084671dea32fb2efeb5ff4993d90587873a431f170596d1389
Opcode Fuzzy Hash: 83c247c131639a01003bfef93263b8fec9b80d681b2a026f1cbedb4bd6e55729
Instruction Fuzzy Hash: D9119430B3620A8BEF55BABCD4443693395FB86614F108839F106CF382EA61CCC98BC5

Function 01280838 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e6f753e488d2b4a3385b60c4bae1173e4034d5619034456321cf243a893764
Instruction ID: bbb3f8df644ddd485f6c8c40b667bcb1d1fc6c4ab4f9eda0ecb6b180945cb7f3
Opcode Fuzzy Hash: 35e6f753e488d2b4a3385b60c4bae1173e4034d5619034456321cf243a893764
Instruction Fuzzy Hash: C411C631A363069BEF6276BCD44536A3395FB46614F108839F516CB2C2EA25C8C98BC9

Function 012817C0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca313326d9b8badea06b656a8081f2c3ae36756f5dd12ec9904d1f6923a9930
Instruction ID: 362609be3d705ce3f7295d371fe968e43005dffa97d63860b6349d0a4fc2a7d3
Opcode Fuzzy Hash: 2ca313326d9b8badea06b656a8081f2c3ae36756f5dd12ec9904d1f6923a9930
Instruction Fuzzy Hash: BF11C276F213129FCB11BBB9A84966EBFE9EB49750F100429E905D7380EB3588128798

Function 0128148E Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd60b3fab3f5ad5fbdf69ec2d56453339a3600e8597c3218d21a3980f131aad
Instruction ID: 0ef67ebd63fb9aeec26df25cc06703ece55b44ce6489755c4f39f9d124982bf1
Opcode Fuzzy Hash: 7dd60b3fab3f5ad5fbdf69ec2d56453339a3600e8597c3218d21a3980f131aad
Instruction Fuzzy Hash: 34116131A222168FCB25FFBC94501AE7BF5EF58210B1444B9E505E7281DB35C852CB94

Function 01281498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e304c9de8ef1c4d42d0212a3d9b9801af20010f4fea5e71029588bb0e35c4784
Instruction ID: 2dd698968b3252525c7ee4e8094e099036375bb1a3aeb4fa03e8d4057f246d58
Opcode Fuzzy Hash: e304c9de8ef1c4d42d0212a3d9b9801af20010f4fea5e71029588bb0e35c4784
Instruction Fuzzy Hash: 96018031A222168FCB21FFBC94501AE7BF5EB58220B144479D905E7381EB35C842CBE5

Function 0123D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3944536959.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_123d000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction ID: a479a32558c28f0aec906cca36c9b37fafbf18cc186d4c9b0ed036b9fce6ab98
Opcode Fuzzy Hash: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction Fuzzy Hash: 8F11BBB5504284DFCB12CF54D9C0B15FFA1FB84714F28C6AAD9494B657C33AD44ACB62

Function 01286B98 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10aceeafbf3512641f7c4a04555cefa41e7c64b81a0b02e5268323acd761b345
Instruction ID: d4368b7c78b3581af6b2d8185fc7e96845f36233543aa183deb3a086077f59b7
Opcode Fuzzy Hash: 10aceeafbf3512641f7c4a04555cefa41e7c64b81a0b02e5268323acd761b345
Instruction Fuzzy Hash: B801F1357142419FD319AB78845136EBBF2EFCA301F1488AEC10ACB790DA398C42D795

Function 0128A6C5 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c123281b1ec51d07a4fe9b0542a151917a015bced60df612e86fe50d4ccb7f4e
Instruction ID: 77704d3e5986f05e2650924e66855c4475083de0f8b6fa50fa0ac54a5ab982c9
Opcode Fuzzy Hash: c123281b1ec51d07a4fe9b0542a151917a015bced60df612e86fe50d4ccb7f4e
Instruction Fuzzy Hash: 2D018031A112058FDB04EFA8D9847DABB62FFD9310F54C275C9085B296EB70AD06CBA1

Function 01281524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50820e975a74ac351c5325b4aef92677c3ac27bacca889f2b42da0cf5379ce0b
Instruction ID: 49fefcd7306a306e7c84f2f9ba99d9063c279d6ef251d921ab7c0433fef35514
Opcode Fuzzy Hash: 50820e975a74ac351c5325b4aef92677c3ac27bacca889f2b42da0cf5379ce0b
Instruction Fuzzy Hash: 91F08B33A26110CFD712ABF8A4A01ACBFB0FA6422071C40E7D906CB2C0C329C417C765

Function 01288F08 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c365b8219390bc21ae7928e59c37a1f33773b9c640554a148f7129c4dc667ff
Instruction ID: 9a900e678ad0c4a32420cdf82ce8f449b1da1da42d80e9126569ff053ecdbb3a
Opcode Fuzzy Hash: 5c365b8219390bc21ae7928e59c37a1f33773b9c640554a148f7129c4dc667ff
Instruction Fuzzy Hash: 3301A23550024ADBDB16FBB8F9406DD77B1FB84200F4046A8C0064B395EE362A05E781

Function 01287EA8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b948dbe2db066869ff2e7dbd27a588c641bd107009be8c269058efe5178791dd
Instruction ID: 4b4239411c73466992248b71e67d97a969f7dd89cd52c274e03efe85b7680be5
Opcode Fuzzy Hash: b948dbe2db066869ff2e7dbd27a588c641bd107009be8c269058efe5178791dd
Instruction Fuzzy Hash: 07F0C435B00204CFC704EB74D5A8A6C77B2EF89715F6444A8E5069B3A0DF31AD42CB54

Function 01288F18 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3945213793.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1280000_BLpvFR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1596be3e17938b192c97d474f2e8a40d92e6bc20fb9f6f070c0ac1e08a0ee83
Instruction ID: a2119d08565eac0c35849e9ca85164c9c595dc49c5e9710d42722227c86a101b
Opcode Fuzzy Hash: f1596be3e17938b192c97d474f2e8a40d92e6bc20fb9f6f070c0ac1e08a0ee83
Instruction Fuzzy Hash: 80F0193491020DEFDB45FBB8F950ADD77B5FB84200F504668C00597254FF352A09AB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jKqPSehspS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BLpvFR.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jKqPSehspS.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0sc24soe.lpd.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5q24lbkz.fhg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bpe35po2.15g.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cyyv2pco.udk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gnwgj1tt.r4g.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j4quf2hi.t0l.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzmfehjk.g0i.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rxay05sy.ws5.ps1

C:\Users\user\AppData\Local\Temp\tmp1EF1.tmp

C:\Users\user\AppData\Local\Temp\tmp89B.tmp

Windows Analysis Report
jKqPSehspS.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre