Edit tour

Windows Analysis Report
3qr7JBuNuX.exe

Overview

General Information

Sample name:	3qr7JBuNuX.exe renamed because original name is a hash value
Original sample name:	34cdeda14b795125dcd164bdb038928d4febef64615d8f5b41318ec9e3ae990d.exe
Analysis ID:	1588869
MD5:	35540c3d857437f1f715981f6d2a5930
SHA1:	fb1fe8c43078023fbb8002b89ebbd01ac5dd149d
SHA256:	34cdeda14b795125dcd164bdb038928d4febef64615d8f5b41318ec9e3ae990d
Tags:	exeMassLoggeruser-adrian__luca
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

3qr7JBuNuX.exe (PID: 4828 cmdline: "C:\Users\user\Desktop\3qr7JBuNuX.exe" MD5: 35540C3D857437F1F715981F6D2A5930)

powershell.exe (PID: 3140 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7380 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

3qr7JBuNuX.exe (PID: 1880 cmdline: "C:\Users\user\Desktop\3qr7JBuNuX.exe" MD5: 35540C3D857437F1F715981F6D2A5930)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "SMTP", "From": "rock@supamemo.sbs", "Password": "W0kz);5}7i_aesKD", "Server": "mail.supamemo.sbs", "To": "rocee@supamemo.sbs", "Port": 587}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xee6f:$a1: get_encryptedPassword 0xf197:$a2: get_encryptedUsername 0xec0a:$a3: get_timePasswordChanged 0xed2b:$a4: get_passwordField 0xee85:$a5: set_encryptedPassword 0x107d6:$a7: get_logins 0x10487:$a8: GetOutlookPasswords 0x10279:$a9: StartKeylogger 0x10726:$a10: KeyLoggerEventArgs 0x102d6:$a11: KeyLoggerEventArgsEventHandler
00000004.00000002.3020404812.0000000002A83000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3bbe7:$a1: get_encryptedPassword 0x52607:$a1: get_encryptedPassword 0x24a5a7:$a1: get_encryptedPassword 0x3bf0f:$a2: get_encryptedUsername 0x5292f:$a2: get_encryptedUsername 0x24a8cf:$a2: get_encryptedUsername 0x3b982:$a3: get_timePasswordChanged 0x523a2:$a3: get_timePasswordChanged 0x24a342:$a3: get_timePasswordChanged 0x3baa3:$a4: get_passwordField 0x524c3:$a4: get_passwordField 0x24a463:$a4: get_passwordField 0x3bbfd:$a5: set_encryptedPassword 0x5261d:$a5: set_encryptedPassword 0x24a5bd:$a5: set_encryptedPassword 0x3d54e:$a7: get_logins 0x53f6e:$a7: get_logins 0x24bf0e:$a7: get_logins 0x3d1ff:$a8: GetOutlookPasswords 0x53c1f:$a8: GetOutlookPasswords 0x24bbbf:$a8: GetOutlookPasswords
Process Memory Space: 3qr7JBuNuX.exe PID: 4828	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: 3qr7JBuNuX.exe PID: 4828	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3qr7JBuNuX.exe PID: 4828	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 3qr7JBuNuX.exe PID: 4828	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 3qr7JBuNuX.exe PID: 4828	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1cfb:$a1: get_encryptedPassword 0x2014:$a2: get_encryptedUsername 0x1aaa:$a3: get_timePasswordChanged 0x1bcb:$a4: get_passwordField 0x1d11:$a5: set_encryptedPassword 0x3609:$a7: get_logins 0x32ba:$a8: GetOutlookPasswords 0x30ac:$a9: StartKeylogger 0x3559:$a10: KeyLoggerEventArgs 0x3109:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: 3qr7JBuNuX.exe PID: 1880	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: 3qr7JBuNuX.exe PID: 1880	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3qr7JBuNuX.exe PID: 1880	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 3qr7JBuNuX.exe PID: 1880	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1e78:$a1: get_encryptedPassword 0x2191:$a2: get_encryptedUsername 0x1c27:$a3: get_timePasswordChanged 0x1d48:$a4: get_passwordField 0x1e8e:$a5: set_encryptedPassword 0x3786:$a7: get_logins 0x3437:$a8: GetOutlookPasswords 0x3229:$a9: StartKeylogger 0x36d6:$a10: KeyLoggerEventArgs 0x3286:$a11: KeyLoggerEventArgsEventHandler
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.3qr7JBuNuX.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
4.2.3qr7JBuNuX.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.3qr7JBuNuX.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.3qr7JBuNuX.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf06f:$a1: get_encryptedPassword 0xf397:$a2: get_encryptedUsername 0xee0a:$a3: get_timePasswordChanged 0xef2b:$a4: get_passwordField 0xf085:$a5: set_encryptedPassword 0x109d6:$a7: get_logins 0x10687:$a8: GetOutlookPasswords 0x10479:$a9: StartKeylogger 0x10926:$a10: KeyLoggerEventArgs 0x104d6:$a11: KeyLoggerEventArgsEventHandler
4.2.3qr7JBuNuX.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x13ffd:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x134fb:$a3: \Google\Chrome\User Data\Default\Login Data 0x13809:$a4: \Orbitum\User Data\Default\Login Data 0x14601:$a5: \Kometa\User Data\Default\Login Data
0.2.3qr7JBuNuX.exe.4dac598.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.3qr7JBuNuX.exe.4dac598.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3qr7JBuNuX.exe.4dac598.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.3qr7JBuNuX.exe.4dac598.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd26f:$a1: get_encryptedPassword 0xd597:$a2: get_encryptedUsername 0xd00a:$a3: get_timePasswordChanged 0xd12b:$a4: get_passwordField 0xd285:$a5: set_encryptedPassword 0xebd6:$a7: get_logins 0xe887:$a8: GetOutlookPasswords 0xe679:$a9: StartKeylogger 0xeb26:$a10: KeyLoggerEventArgs 0xe6d6:$a11: KeyLoggerEventArgsEventHandler
0.2.3qr7JBuNuX.exe.4dac598.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x121fd:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x116fb:$a3: \Google\Chrome\User Data\Default\Login Data 0x11a09:$a4: \Orbitum\User Data\Default\Login Data 0x12801:$a5: \Kometa\User Data\Default\Login Data
0.2.3qr7JBuNuX.exe.4d95b78.2.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.3qr7JBuNuX.exe.4d95b78.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3qr7JBuNuX.exe.4d95b78.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.3qr7JBuNuX.exe.4d95b78.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd26f:$a1: get_encryptedPassword 0xd597:$a2: get_encryptedUsername 0xd00a:$a3: get_timePasswordChanged 0xd12b:$a4: get_passwordField 0xd285:$a5: set_encryptedPassword 0xebd6:$a7: get_logins 0xe887:$a8: GetOutlookPasswords 0xe679:$a9: StartKeylogger 0xeb26:$a10: KeyLoggerEventArgs 0xe6d6:$a11: KeyLoggerEventArgsEventHandler
0.2.3qr7JBuNuX.exe.4d95b78.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x121fd:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x116fb:$a3: \Google\Chrome\User Data\Default\Login Data 0x11a09:$a4: \Orbitum\User Data\Default\Login Data 0x12801:$a5: \Kometa\User Data\Default\Login Data
0.2.3qr7JBuNuX.exe.4dac598.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.3qr7JBuNuX.exe.4dac598.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3qr7JBuNuX.exe.4dac598.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.3qr7JBuNuX.exe.4dac598.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf06f:$a1: get_encryptedPassword 0x20700f:$a1: get_encryptedPassword 0xf397:$a2: get_encryptedUsername 0x207337:$a2: get_encryptedUsername 0xee0a:$a3: get_timePasswordChanged 0x206daa:$a3: get_timePasswordChanged 0xef2b:$a4: get_passwordField 0x206ecb:$a4: get_passwordField 0xf085:$a5: set_encryptedPassword 0x207025:$a5: set_encryptedPassword 0x109d6:$a7: get_logins 0x208976:$a7: get_logins 0x10687:$a8: GetOutlookPasswords 0x208627:$a8: GetOutlookPasswords 0x10479:$a9: StartKeylogger 0x208419:$a9: StartKeylogger 0x10926:$a10: KeyLoggerEventArgs 0x2088c6:$a10: KeyLoggerEventArgs 0x104d6:$a11: KeyLoggerEventArgsEventHandler 0x208476:$a11: KeyLoggerEventArgsEventHandler
0.2.3qr7JBuNuX.exe.4d95b78.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.3qr7JBuNuX.exe.4d95b78.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.3qr7JBuNuX.exe.4d95b78.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.3qr7JBuNuX.exe.4d95b78.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf06f:$a1: get_encryptedPassword 0x25a8f:$a1: get_encryptedPassword 0x21da2f:$a1: get_encryptedPassword 0xf397:$a2: get_encryptedUsername 0x25db7:$a2: get_encryptedUsername 0x21dd57:$a2: get_encryptedUsername 0xee0a:$a3: get_timePasswordChanged 0x2582a:$a3: get_timePasswordChanged 0x21d7ca:$a3: get_timePasswordChanged 0xef2b:$a4: get_passwordField 0x2594b:$a4: get_passwordField 0x21d8eb:$a4: get_passwordField 0xf085:$a5: set_encryptedPassword 0x25aa5:$a5: set_encryptedPassword 0x21da45:$a5: set_encryptedPassword 0x109d6:$a7: get_logins 0x273f6:$a7: get_logins 0x21f396:$a7: get_logins 0x10687:$a8: GetOutlookPasswords 0x270a7:$a8: GetOutlookPasswords 0x21f047:$a8: GetOutlookPasswords
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\3qr7JBuNuX.exe", ParentImage: C:\Users\user\Desktop\3qr7JBuNuX.exe, ParentProcessId: 4828, ParentProcessName: 3qr7JBuNuX.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe", ProcessId: 3140, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\3qr7JBuNuX.exe", ParentImage: C:\Users\user\Desktop\3qr7JBuNuX.exe, ParentProcessId: 4828, ParentProcessName: 3qr7JBuNuX.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe", ProcessId: 3140, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:33:30.095168+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.3qr7JBuNuX.exe.4dac598.1.raw.unpack

Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "rock@supamemo.sbs", "Password": "W0kz);5}7i_aesKD", "Server": "mail.supamemo.sbs", "To": "rocee@supamemo.sbs", "Port": 587}

Multi AV Scanner detection for submitted file

Source: 3qr7JBuNuX.exe	Virustotal: Detection: 75%			Perma Link
Source: 3qr7JBuNuX.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 3qr7JBuNuX.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: 3qr7JBuNuX.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49734 version: TLS 1.0

Source: 3qr7JBuNuX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 00E79731h	4_2_00E79480
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 00E79E5Ah	4_2_00E79A40
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 00E79E5Ah	4_2_00E79A30
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 00E79E5Ah	4_2_00E79D87
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E65E15h	4_2_04E65AD8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E6F700h	4_2_04E6F458
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E676D0h	4_2_04E67428
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E68830h	4_2_04E68588
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E647C9h	4_2_04E64520
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E65929h	4_2_04E65680
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E6E9F8h	4_2_04E6E750
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E6F2A8h	4_2_04E6F000
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E683D8h	4_2_04E68130
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E6E5A0h	4_2_04E6E2F8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E654D1h	4_2_04E65228
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E67F80h	4_2_04E67CD8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E65079h	4_2_04E64DD0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E67278h	4_2_04E66FD0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E6FB58h	4_2_04E6F8B0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E67B28h	4_2_04E67880
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E64C21h	4_2_04E64978
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 04E6EE50h	4_2_04E6EBA8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 054462B5h	4_2_054460D8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05446C3Fh	4_2_054460D8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 054418A0h	4_2_054415F8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05443840h	4_2_05443598
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 054426E0h	4_2_05442438
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05440740h	4_2_05440498
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 054449A0h	4_2_054446F8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 054433E8h	4_2_05443140
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then mov esp, ebp	4_2_05449120
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_054451E8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05441448h	4_2_054411A0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 054402E8h	4_2_05440040
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05444548h	4_2_054442A0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05440FF0h	4_2_05440D48
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05442F90h	4_2_05442CE8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 054440F0h	4_2_05443E48
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05442152h	4_2_05441EA8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05443C98h	4_2_054439F0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05440B98h	4_2_054408F0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05442B38h	4_2_05442890
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05444DF8h	4_2_05444B50
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4x nop then jmp 05441CF8h	4_2_05441A50

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 158.101.44.242:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49734 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: 3qr7JBuNuX.exe, 00000004.00000002.3020404812.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: 3qr7JBuNuX.exe, 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: 3qr7JBuNuX.exe, 00000000.00000002.1794545207.000000000395E000.00000004.00000800.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3020404812.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 3qr7JBuNuX.exe	String found in binary or memory: https://api.libertyreserve.com/beta/xml/
Source: 3qr7JBuNuX.exe	String found in binary or memory: https://api.libertyreserve.com/beta/xml/accountname.aspx
Source: 3qr7JBuNuX.exe	String found in binary or memory: https://api.libertyreserve.com/beta/xml/balance.aspx
Source: 3qr7JBuNuX.exe	String found in binary or memory: https://api.libertyreserve.com/beta/xml/history.aspx
Source: 3qr7JBuNuX.exe, 00000000.00000002.1794545207.0000000003569000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/history.aspxS
Source: 3qr7JBuNuX.exe	String found in binary or memory: https://api.libertyreserve.com/beta/xml/transfer.aspx
Source: 3qr7JBuNuX.exe, 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 3qr7JBuNuX.exe, 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l
Source: 3qr7JBuNuX.exe	String found in binary or memory: https://sci.libertyreserve.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.3qr7JBuNuX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.3qr7JBuNuX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.3qr7JBuNuX.exe.4dac598.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.3qr7JBuNuX.exe.4dac598.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.3qr7JBuNuX.exe.4d95b78.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.3qr7JBuNuX.exe.4d95b78.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.3qr7JBuNuX.exe.4dac598.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.3qr7JBuNuX.exe.4d95b78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: 3qr7JBuNuX.exe PID: 4828, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: 3qr7JBuNuX.exe PID: 1880, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_018C2290	0_2_018C2290
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_018C225B	0_2_018C225B
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_018C08B3	0_2_018C08B3
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_018C134A	0_2_018C134A
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A050B90	0_2_0A050B90
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A051E78	0_2_0A051E78
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A057F60	0_2_0A057F60
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A052CF8	0_2_0A052CF8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A051440	0_2_0A051440
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A059588	0_2_0A059588
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A050AF2	0_2_0A050AF2
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A053BC8	0_2_0A053BC8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A053BD8	0_2_0A053BD8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A052BE0	0_2_0A052BE0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A0518D9	0_2_0A0518D9
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A058950	0_2_0A058950
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A058960	0_2_0A058960
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A0539E0	0_2_0A0539E0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A059E88	0_2_0A059E88
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A054FD8	0_2_0A054FD8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A054FE8	0_2_0A054FE8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A052C10	0_2_0A052C10
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A058D11	0_2_0A058D11
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A054DD2	0_2_0A054DD2
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A054DE0	0_2_0A054DE0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A058222	0_2_0A058222
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A058228	0_2_0A058228
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A055268	0_2_0A055268
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A055278	0_2_0A055278
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A050006	0_2_0A050006
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A050040	0_2_0A050040
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A051620	0_2_0A051620
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A05A43A	0_2_0A05A43A
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A055454	0_2_0A055454
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A055458	0_2_0A055458
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A058559	0_2_0A058559
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A058568	0_2_0A058568
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A060040	0_2_0A060040
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A06A53C	0_2_0A06A53C
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A06B998	0_2_0A06B998
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A4F1070	0_2_0A4F1070
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A4F18D1	0_2_0A4F18D1
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A4F18E0	0_2_0A4F18E0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A4F2FB8	0_2_0A4F2FB8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A4F1498	0_2_0A4F1498
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A4F14A8	0_2_0A4F14A8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A4F1D18	0_2_0A4F1D18
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_00E7C530	4_2_00E7C530
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_00E727B9	4_2_00E727B9
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_00E72DD1	4_2_00E72DD1
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_00E79480	4_2_00E79480
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_00E7C521	4_2_00E7C521
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_00E7946F	4_2_00E7946F
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E66138	4_2_04E66138
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E613A8	4_2_04E613A8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6BC50	4_2_04E6BC50
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6AE78	4_2_04E6AE78
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E689E0	4_2_04E689E0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E65AD8	4_2_04E65AD8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E60AB8	4_2_04E60AB8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6F455	4_2_04E6F455
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6F458	4_2_04E6F458
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E67423	4_2_04E67423
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E67428	4_2_04E67428
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E68588	4_2_04E68588
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E68579	4_2_04E68579
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E64520	4_2_04E64520
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6450F	4_2_04E6450F
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E65680	4_2_04E65680
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E65670	4_2_04E65670
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6E740	4_2_04E6E740
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6E750	4_2_04E6E750
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6F000	4_2_04E6F000
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E68120	4_2_04E68120
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E66137	4_2_04E66137
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E68130	4_2_04E68130
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6E2F5	4_2_04E6E2F5
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6E2F8	4_2_04E6E2F8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E65228	4_2_04E65228
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6521B	4_2_04E6521B
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E60320	4_2_04E60320
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E60330	4_2_04E60330
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E67CC8	4_2_04E67CC8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E60CD8	4_2_04E60CD8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E67CD8	4_2_04E67CD8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E63CA3	4_2_04E63CA3
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E64DC0	4_2_04E64DC0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E64DD0	4_2_04E64DD0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6EFFD	4_2_04E6EFFD
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E66FCD	4_2_04E66FCD
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E66FD0	4_2_04E66FD0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6F8A1	4_2_04E6F8A1
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6F8B0	4_2_04E6F8B0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E67880	4_2_04E67880
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E67871	4_2_04E67871
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E64969	4_2_04E64969
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E64978	4_2_04E64978
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E65ACB	4_2_04E65ACB
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6EBA8	4_2_04E6EBA8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_04E6EB98	4_2_04E6EB98
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05448030	4_2_05448030
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054460D8	4_2_054460D8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05447390	4_2_05447390
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05446D48	4_2_05446D48
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054479E0	4_2_054479E0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054415E8	4_2_054415E8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054415F8	4_2_054415F8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05443597	4_2_05443597
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05443598	4_2_05443598
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05442427	4_2_05442427
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05442438	4_2_05442438
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05440488	4_2_05440488
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05440498	4_2_05440498
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054446E9	4_2_054446E9
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054446F8	4_2_054446F8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_0544869F	4_2_0544869F
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054486B0	4_2_054486B0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05443140	4_2_05443140
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05443132	4_2_05443132
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054451D8	4_2_054451D8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054451E8	4_2_054451E8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05441190	4_2_05441190
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054411A0	4_2_054411A0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05440040	4_2_05440040
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05448023	4_2_05448023
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_0544003D	4_2_0544003D
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054460C9	4_2_054460C9
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05447380	4_2_05447380
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05444290	4_2_05444290
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054442A0	4_2_054442A0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05440D48	4_2_05440D48
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05446D37	4_2_05446D37
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05440D39	4_2_05440D39
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05442CE7	4_2_05442CE7
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05442CE8	4_2_05442CE8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05443E45	4_2_05443E45
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05443E48	4_2_05443E48
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05441E9A	4_2_05441E9A
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05441EA8	4_2_05441EA8
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054479D0	4_2_054479D0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054439E6	4_2_054439E6
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054439F0	4_2_054439F0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054408E1	4_2_054408E1
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_054408F0	4_2_054408F0
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05442880	4_2_05442880
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05442890	4_2_05442890
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05444B40	4_2_05444B40
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05444B50	4_2_05444B50
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05441A40	4_2_05441A40
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_05441A50	4_2_05441A50

Source: 3qr7JBuNuX.exe, 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs 3qr7JBuNuX.exe
Source: 3qr7JBuNuX.exe, 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs 3qr7JBuNuX.exe
Source: 3qr7JBuNuX.exe, 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 3qr7JBuNuX.exe
Source: 3qr7JBuNuX.exe, 00000000.00000000.1761361175.0000000001070000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameyttJL.exe4 vs 3qr7JBuNuX.exe
Source: 3qr7JBuNuX.exe, 00000000.00000002.1792430607.00000000016DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 3qr7JBuNuX.exe
Source: 3qr7JBuNuX.exe, 00000000.00000002.1794545207.0000000003561000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs 3qr7JBuNuX.exe
Source: 3qr7JBuNuX.exe, 00000000.00000002.1799917884.00000000083D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs 3qr7JBuNuX.exe
Source: 3qr7JBuNuX.exe, 00000000.00000002.1803221023.000000000A8F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 3qr7JBuNuX.exe
Source: 3qr7JBuNuX.exe, 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs 3qr7JBuNuX.exe
Source: 3qr7JBuNuX.exe, 00000004.00000002.3018192739.00000000008F7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 3qr7JBuNuX.exe
Source: 3qr7JBuNuX.exe	Binary or memory string: OriginalFilenameyttJL.exe4 vs 3qr7JBuNuX.exe

Source: 3qr7JBuNuX.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.3qr7JBuNuX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.3qr7JBuNuX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.3qr7JBuNuX.exe.4dac598.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.3qr7JBuNuX.exe.4dac598.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.3qr7JBuNuX.exe.4d95b78.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.3qr7JBuNuX.exe.4d95b78.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.3qr7JBuNuX.exe.4dac598.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.3qr7JBuNuX.exe.4d95b78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: 3qr7JBuNuX.exe PID: 4828, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: 3qr7JBuNuX.exe PID: 1880, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 3qr7JBuNuX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/6@2/2

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3qr7JBuNuX.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_clusd3tj.va0.ps1

Jump to behavior

Source: 3qr7JBuNuX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 3qr7JBuNuX.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3qr7JBuNuX.exe, 00000004.00000002.3020404812.0000000002A3E000.00000004.00000800.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3020404812.0000000002A4E000.00000004.00000800.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3020404812.0000000002A5C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 3qr7JBuNuX.exe	Virustotal: Detection: 75%
Source: 3qr7JBuNuX.exe	ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Users\user\Desktop\3qr7JBuNuX.exe "C:\Users\user\Desktop\3qr7JBuNuX.exe"
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process created: C:\Users\user\Desktop\3qr7JBuNuX.exe "C:\Users\user\Desktop\3qr7JBuNuX.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe"	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process created: C:\Users\user\Desktop\3qr7JBuNuX.exe "C:\Users\user\Desktop\3qr7JBuNuX.exe"	Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 3qr7JBuNuX.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 3qr7JBuNuX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_018C1C70 push ds; ret	0_2_018C1C72
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A063440 push 69C84589h; ret	0_2_0A063448
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 0_2_0A4F418F push eax; retf	0_2_0A4F4190
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Code function: 4_2_0544BCDF push esp; retf	4_2_0544BD19

Source: 3qr7JBuNuX.exe

Static PE information: section name: .text entropy: 7.550819638547243

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 3qr7JBuNuX.exe PID: 4828, type: MEMORYSTR

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: 18C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: 3560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: 3480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: 5B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: 6B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: 6C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: 7C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: BDF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: CDF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: D280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: E280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: F480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: 10480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: 11480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Memory allocated: D90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6537			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3147			Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe TID: 1608	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7308	Thread sleep time: -5534023222112862s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 3qr7JBuNuX.exe, 00000000.00000002.1792430607.0000000001712000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@ou
Source: 3qr7JBuNuX.exe, 00000004.00000002.3018721983.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe

Code function: 4_2_04E60AB8 LdrInitializeThunk,LdrInitializeThunk,

4_2_04E60AB8

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe"
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe

Memory written: C:\Users\user\Desktop\3qr7JBuNuX.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe"			Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Process created: C:\Users\user\Desktop\3qr7JBuNuX.exe "C:\Users\user\Desktop\3qr7JBuNuX.exe"			Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Users\user\Desktop\3qr7JBuNuX.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Users\user\Desktop\3qr7JBuNuX.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 4.2.3qr7JBuNuX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4dac598.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4d95b78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4dac598.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4d95b78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3qr7JBuNuX.exe PID: 4828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3qr7JBuNuX.exe PID: 1880, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 4.2.3qr7JBuNuX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4dac598.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4d95b78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4dac598.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4d95b78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3qr7JBuNuX.exe PID: 4828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3qr7JBuNuX.exe PID: 1880, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\3qr7JBuNuX.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\3qr7JBuNuX.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 4.2.3qr7JBuNuX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4dac598.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4d95b78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4dac598.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4d95b78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3020404812.0000000002A83000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3qr7JBuNuX.exe PID: 4828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3qr7JBuNuX.exe PID: 1880, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 4.2.3qr7JBuNuX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4dac598.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4d95b78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4dac598.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4d95b78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3qr7JBuNuX.exe PID: 4828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3qr7JBuNuX.exe PID: 1880, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 4.2.3qr7JBuNuX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4dac598.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4d95b78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4dac598.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3qr7JBuNuX.exe.4d95b78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3qr7JBuNuX.exe PID: 4828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3qr7JBuNuX.exe PID: 1880, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	13 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3qr7JBuNuX.exe	75%	Virustotal		Browse
3qr7JBuNuX.exe	63%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
3qr7JBuNuX.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.16.1	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false		high
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.apache.org/licenses/LICENSE-2.0	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designersG	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/?	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers?	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.libertyreserve.com/beta/xml/history.aspx	3qr7JBuNuX.exe	false	high
http://reallyfreegeoip.orgd	3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029FC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.tiro.com	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029D3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.libertyreserve.com/beta/xml/history.aspxS	3qr7JBuNuX.exe, 00000000.00000002.1794545207.0000000003569000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.goodfont.co.kr	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.libertyreserve.com/beta/xml/	3qr7JBuNuX.exe	false	high
http://www.carterandcone.coml	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.typography.netD	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/cabarga.htmlN	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/staff/dennis.htm	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.libertyreserve.com/beta/xml/transfer.aspx	3qr7JBuNuX.exe	false	high
http://www.fontbureau.com/designers/frere-user.html	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189l	3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.comd	3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	3qr7JBuNuX.exe, 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://www.jiyu-kobo.co.jp/	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189d	3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029FC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.orgd	3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers8	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fonts.com	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sandoll.co.kr	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.zhongyicts.com.cn	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/d	3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://sci.libertyreserve.com/	3qr7JBuNuX.exe	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	3qr7JBuNuX.exe, 00000000.00000002.1794545207.000000000395E000.00000004.00000800.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3020404812.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sakkal.com	3qr7JBuNuX.exe, 00000000.00000002.1800718540.0000000009B62000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.libertyreserve.com/beta/xml/accountname.aspx	3qr7JBuNuX.exe	false	high
https://api.libertyreserve.com/beta/xml/balance.aspx	3qr7JBuNuX.exe	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	3qr7JBuNuX.exe, 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	3qr7JBuNuX.exe, 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, 3qr7JBuNuX.exe, 00000004.00000002.3020404812.00000000029DE000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.16.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
158.101.44.242	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588869
Start date and time:	2025-01-11 06:32:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3qr7JBuNuX.exe renamed because original name is a hash value
Original Sample Name:	34cdeda14b795125dcd164bdb038928d4febef64615d8f5b41318ec9e3ae990d.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/6@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 96 Number of non-executed functions: 69
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:33:26	API Interceptor	1x Sleep call for process: 3qr7JBuNuX.exe modified
00:33:28	API Interceptor	16x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.16.1	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	www.kkpmoneysocial.top/86am/
104.21.16.1	JNKHlxGvw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188387cm.n9shteam.in/videolinePipeHttplowProcessorgamelocalTemp.php
158.101.44.242	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	WGi85dsMNp.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PK5pHX4Gu5.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	dZMT94YYwO.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
reallyfreegeoip.org	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	dZMT94YYwO.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	172.64.155.59
	3.elf	Get hash	malicious	Unknown	Browse	1.1.1.1
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	wSoShbuXnJ.exe	Get hash	malicious	FormBook	Browse	104.21.86.111
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	162.159.61.3
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	C6Abn5cBei.exe	Get hash	malicious	FormBook	Browse	172.67.145.234
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
ORACLE-BMC-31898US	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	dZMT94YYwO.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	rwlPT9YJt0.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	YDg44STseR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	rlPy5vt1Dg.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	wZ6VEnOkie.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	dZMT94YYwO.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1

Process:	C:\Users\user\Desktop\3qr7JBuNuX.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380046556058007
Encrypted:	false
SSDEEP:	48:tWSU4xympgv4RIoUP7gZ9tK8NPZHUx7u1iMuge//YUyus:tLHxv2IfLZ2KRH6Oug8s
MD5:	2628E843EF7060E91426823B102E13AA
SHA1:	6FE0AD465404E6929BFEBA2D4F397D8F2D295CE1
SHA-256:	4DC6B06D7934D36877120520E8EA2999A08349B2124C51B6444F52FC6C388C85
SHA-512:	CD405D5274DB025437B70CDD2643D751431FFA83EE5BB84415F71B8F2B82EDDD0FD87BB5A77D9DDF6C198FC8193248975BE629BED5E32C0A63C6593C5F0222DF
Malicious:	false
Reputation:	low
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_clusd3tj.va0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ij1gnqe4.eor.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kucgoymk.3xr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s0l1tyyn.d2e.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.553141665755069
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	3qr7JBuNuX.exe
File size:	787'456 bytes
MD5:	35540c3d857437f1f715981f6d2a5930
SHA1:	fb1fe8c43078023fbb8002b89ebbd01ac5dd149d
SHA256:	34cdeda14b795125dcd164bdb038928d4febef64615d8f5b41318ec9e3ae990d
SHA512:	f7db1d32d42eafe559acc170b65897392edd6a73b56fa11e25d170d9f566e8105b18758ab9a900135b35ccef018ef87786d7d9737e17dca7be8837d900005970
SSDEEP:	12288:v328f2uE1zDoVEt4veWaixpQVVIgqGuLEPs7Hn4RnI18f2:v2u2uOUveWoWKcH40u2
TLSH:	D5F4BFC03F26771ECD6DA9349426DCB8A1642E787005B6E3ADDE3B97768C1129E0DF90
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg..............0......2......>.... ........@.. .......................`............@................................

File Icon


Icon Hash:	674d797961216d59

Static PE Info

General

Entrypoint:	0x4bef3e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6763EDBD [Thu Dec 19 09:56:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbeef0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x2f48	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbcf44	0xbd000	8b64a591633cd628a1626328e0767f0e	False	0.839001529431217	data	7.550819638547243	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x2f48	0x3000	ab7d702117942235e782b14d2cbe1ac2	False	0.9447428385416666	data	7.740899429196905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc4000	0xc	0x200	52da343d9dfcf9891581e95cd3eb256e	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xc00e8	0x2bf4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9942232492001422
RT_GROUP_ICON	0xc2cdc	0x14	data	1.05
RT_VERSION	0xc2cf0	0x258	data	0.485

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:33:30.095168+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	158.101.44.242	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:33:29.206903934 CET	49733	80	192.168.2.4	158.101.44.242
Jan 11, 2025 06:33:29.211986065 CET	80	49733	158.101.44.242	192.168.2.4
Jan 11, 2025 06:33:29.212527990 CET	49733	80	192.168.2.4	158.101.44.242
Jan 11, 2025 06:33:29.212888956 CET	49733	80	192.168.2.4	158.101.44.242
Jan 11, 2025 06:33:29.217701912 CET	80	49733	158.101.44.242	192.168.2.4
Jan 11, 2025 06:33:29.854826927 CET	80	49733	158.101.44.242	192.168.2.4
Jan 11, 2025 06:33:29.860528946 CET	49733	80	192.168.2.4	158.101.44.242
Jan 11, 2025 06:33:29.865394115 CET	80	49733	158.101.44.242	192.168.2.4
Jan 11, 2025 06:33:30.040638924 CET	80	49733	158.101.44.242	192.168.2.4
Jan 11, 2025 06:33:30.050005913 CET	49734	443	192.168.2.4	104.21.16.1
Jan 11, 2025 06:33:30.050045967 CET	443	49734	104.21.16.1	192.168.2.4
Jan 11, 2025 06:33:30.050530910 CET	49734	443	192.168.2.4	104.21.16.1
Jan 11, 2025 06:33:30.057894945 CET	49734	443	192.168.2.4	104.21.16.1
Jan 11, 2025 06:33:30.057912111 CET	443	49734	104.21.16.1	192.168.2.4
Jan 11, 2025 06:33:30.095168114 CET	49733	80	192.168.2.4	158.101.44.242
Jan 11, 2025 06:33:30.538526058 CET	443	49734	104.21.16.1	192.168.2.4
Jan 11, 2025 06:33:30.538603067 CET	49734	443	192.168.2.4	104.21.16.1
Jan 11, 2025 06:33:30.544349909 CET	49734	443	192.168.2.4	104.21.16.1
Jan 11, 2025 06:33:30.544374943 CET	443	49734	104.21.16.1	192.168.2.4
Jan 11, 2025 06:33:30.544682980 CET	443	49734	104.21.16.1	192.168.2.4
Jan 11, 2025 06:33:30.595114946 CET	49734	443	192.168.2.4	104.21.16.1
Jan 11, 2025 06:33:30.875581980 CET	49734	443	192.168.2.4	104.21.16.1
Jan 11, 2025 06:33:30.919334888 CET	443	49734	104.21.16.1	192.168.2.4
Jan 11, 2025 06:33:30.989353895 CET	443	49734	104.21.16.1	192.168.2.4
Jan 11, 2025 06:33:30.989434004 CET	443	49734	104.21.16.1	192.168.2.4
Jan 11, 2025 06:33:30.989480019 CET	49734	443	192.168.2.4	104.21.16.1
Jan 11, 2025 06:33:30.995640039 CET	49734	443	192.168.2.4	104.21.16.1
Jan 11, 2025 06:34:35.040237904 CET	80	49733	158.101.44.242	192.168.2.4
Jan 11, 2025 06:34:35.040360928 CET	49733	80	192.168.2.4	158.101.44.242
Jan 11, 2025 06:35:10.048731089 CET	49733	80	192.168.2.4	158.101.44.242
Jan 11, 2025 06:35:10.053605080 CET	80	49733	158.101.44.242	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:33:29.170255899 CET	65476	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:33:29.176945925 CET	53	65476	1.1.1.1	192.168.2.4
Jan 11, 2025 06:33:30.042365074 CET	52633	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:33:30.049156904 CET	53	52633	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:33:29.170255899 CET	192.168.2.4	1.1.1.1	0x9835	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:33:30.042365074 CET	192.168.2.4	1.1.1.1	0xc7be	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:33:29.176945925 CET	1.1.1.1	192.168.2.4	0x9835	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:33:29.176945925 CET	1.1.1.1	192.168.2.4	0x9835	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:33:29.176945925 CET	1.1.1.1	192.168.2.4	0x9835	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:33:29.176945925 CET	1.1.1.1	192.168.2.4	0x9835	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:33:29.176945925 CET	1.1.1.1	192.168.2.4	0x9835	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:33:29.176945925 CET	1.1.1.1	192.168.2.4	0x9835	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:33:30.049156904 CET	1.1.1.1	192.168.2.4	0xc7be	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:33:30.049156904 CET	1.1.1.1	192.168.2.4	0xc7be	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:33:30.049156904 CET	1.1.1.1	192.168.2.4	0xc7be	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:33:30.049156904 CET	1.1.1.1	192.168.2.4	0xc7be	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:33:30.049156904 CET	1.1.1.1	192.168.2.4	0xc7be	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:33:30.049156904 CET	1.1.1.1	192.168.2.4	0xc7be	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:33:30.049156904 CET	1.1.1.1	192.168.2.4	0xc7be	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	158.101.44.242	80	1880	C:\Users\user\Desktop\3qr7JBuNuX.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:33:29.212888956 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 06:33:29.854826927 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 05:33:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 533468392b425ec1a7336abc376e37b7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 06:33:29.860528946 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 06:33:30.040638924 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 05:33:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3a25570a10e2cc4899e974a3965703de Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	104.21.16.1	443	1880	C:\Users\user\Desktop\3qr7JBuNuX.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 05:33:30 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 05:33:30 UTC	863	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 05:33:30 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1888400 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N5dTqTuw7BLoo0f%2FcUpj0KSIvh1IKFThx9WI2CBEveFGrc1XOT%2FRDTEcBjLXBMsyvT6OuUDrPUdV26E%2FIakw3zHW3OjvCeHHp2dYg3fJqYUR3c2b8iNUdY6L8tPSUv%2BHO9%2Fw%2FUV%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9002884c4c1241ba-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1678&min_rtt=1672&rtt_var=639&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1695702&cwnd=192&unsent_bytes=0&cid=53e9c87f30f6f158&ts=462&x=0"
2025-01-11 05:33:30 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	00:33:24
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\3qr7JBuNuX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3qr7JBuNuX.exe"
Imagebase:	0xfb0000
File size:	787'456 bytes
MD5 hash:	35540C3D857437F1F715981F6D2A5930
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1796395085.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:33:27
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3qr7JBuNuX.exe"
Imagebase:	0x140000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:33:27
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:33:27
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\3qr7JBuNuX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3qr7JBuNuX.exe"
Imagebase:	0x470000
File size:	787'456 bytes
MD5 hash:	35540C3D857437F1F715981F6D2A5930
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.3018038223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3020404812.0000000002A83000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	00:33:30
Start date:	11/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.3%
Total number of Nodes:	239
Total number of Limit Nodes:	27

Executed Functions

Function 0A060040 Relevance: 15.7, Strings: 10, Instructions: 3237COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0A062C53
4'^q, xrefs: 0A061F11
$^q, xrefs: 0A062D00
4'^q, xrefs: 0A062CAE
4'^q, xrefs: 0A06102B
4|cq, xrefs: 0A062E43
4'^q, xrefs: 0A060EA3
4|cq, xrefs: 0A062E28
(o^q, xrefs: 0A060116
4'^q, xrefs: 0A062CDE

Memory Dump Source

Source File: 00000000.00000002.1802176029.000000000A060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a060000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4|cq$4|cq$$^q
API String ID: 0-2723476363
Opcode ID: f47b0936a45956eae55839ce0ad3f86ca869d325ae12f426c743deba91479305
Instruction ID: 1d5315e80b882d1b60f4428efdc3b8378be102d0e3a03d5ec6a5ada107d36052
Opcode Fuzzy Hash: f47b0936a45956eae55839ce0ad3f86ca869d325ae12f426c743deba91479305
Instruction Fuzzy Hash: C5632974A01219DFCB68DF28C898A9DBBB2BF89304F1585D9D449AB361DB31ED81CF50

Function 0A06A53C Relevance: 6.9, Strings: 5, Instructions: 623
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 0A06C10D
Hbq, xrefs: 0A06BFFC
Hbq, xrefs: 0A06BF69
Hbq, xrefs: 0A06C1CB
Hbq, xrefs: 0A06C083

Memory Dump Source

Source File: 00000000.00000002.1802176029.000000000A060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a060000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq$Hbq$Hbq
API String ID: 0-1677660839
Opcode ID: ab29e12fa25f6f86b0f196f37c3cf765161f9d04bcd26287e90ed0f025ee2406
Instruction ID: 5237e7a91fff5adc6c5c202ee8290a9e732b8853f4edbc3671c85bdf1ffba899
Opcode Fuzzy Hash: ab29e12fa25f6f86b0f196f37c3cf765161f9d04bcd26287e90ed0f025ee2406
Instruction Fuzzy Hash: 84326A70A002588FDB54DFB8C8507AEBBF2BF89304F1485AAD449EB395DB349985CF91

Function 0A052BE0 Relevance: 4.1, Strings: 3, Instructions: 330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 0A052FC4
ry, xrefs: 0A052FCB
ry, xrefs: 0A052FE2

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: ry$ry$ry
API String ID: 0-128149707
Opcode ID: bc8d7f3ac10750f6c79793520e58424f3f1fa6d03f3eaa59506f0858384484ed
Instruction ID: 95fae11f92344cbb0290be085b2a4d8ed961b12204fcdf0c97a62312bdca4e88
Opcode Fuzzy Hash: bc8d7f3ac10750f6c79793520e58424f3f1fa6d03f3eaa59506f0858384484ed
Instruction Fuzzy Hash: 81E19C71E0434ADFCB14CFA9D4854EEFBB2FF89340B159455D802AB219D734AA42CFA5

Function 0A052C10 Relevance: 4.1, Strings: 3, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 0A052FC4
ry, xrefs: 0A052FCB
ry, xrefs: 0A052FE2

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: ry$ry$ry
API String ID: 0-128149707
Opcode ID: aa13ab807bacf0dc7e244abca404ae244d3726fd0f95f4d3c6ab518b67416431
Instruction ID: 7e7da839c60a8ab1f3558422fb88623726e533847ac22589b8cdf08d0f037cfb
Opcode Fuzzy Hash: aa13ab807bacf0dc7e244abca404ae244d3726fd0f95f4d3c6ab518b67416431
Instruction Fuzzy Hash: A0E1AA71E1424ADFCB14CFA9D4854EEFFB2FF89340B199455D802AB219D734AA42CFA4

Function 0A052CF8 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 0A052FC4
ry, xrefs: 0A052FCB
ry, xrefs: 0A052FE2

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: ry$ry$ry
API String ID: 0-128149707
Opcode ID: ae02adc896056bb0232163fd41a94486e4631da1a4da1931e8f9a5a0baac4f6b
Instruction ID: f5f3176d66e22765e233071af3ae57cf7648219b56b607d5065591d2f3c12711
Opcode Fuzzy Hash: ae02adc896056bb0232163fd41a94486e4631da1a4da1931e8f9a5a0baac4f6b
Instruction Fuzzy Hash: F7C13C74D0520ADFCB14CFA9C4858AEFBB2FF89340F11D555D816AB218D734AA42CF95

Function 0A050AF2 Relevance: 4.0, Strings: 3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 0A050BF9
Te^q, xrefs: 0A050E00
z^I, xrefs: 0A050D51

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: Te^q$Te^q$z^I
API String ID: 0-2886491258
Opcode ID: f59eff7e2260aa2ed188a61ec97944c3eff29a09320abb150254939b127be293
Instruction ID: 2004b2ba5b7b2083c899296248147d660d8e68152f793dd78ae149483f8977be
Opcode Fuzzy Hash: f59eff7e2260aa2ed188a61ec97944c3eff29a09320abb150254939b127be293
Instruction Fuzzy Hash: B6B13374E002498FCB04CFAAC4846DEBFF2EF8A300F28902AD455AB265D7349946CF64

Function 0A050B90 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 0A050BF9
Te^q, xrefs: 0A050E00
z^I, xrefs: 0A050D51

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: Te^q$Te^q$z^I
API String ID: 0-2886491258
Opcode ID: a637ab4a8ff93eee32e33f3764e1c00ee39610e8a4fb3e2e596c0604438b2201
Instruction ID: 883e62bf1992991ae5d6394035fd3d36140c78b9c546e9b44581bf96b1e666b5
Opcode Fuzzy Hash: a637ab4a8ff93eee32e33f3764e1c00ee39610e8a4fb3e2e596c0604438b2201
Instruction Fuzzy Hash: D791B274E002199FCB58CFAAC58499EFBB2FF89300F24942AD815BB364D7749945CF64

Function 0A059588 Relevance: 2.7, Strings: 2, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UC;", xrefs: 0A059786
TuA, xrefs: 0A059708

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: TuA$UC;"
API String ID: 0-2071649361
Opcode ID: df6a01ae2aca2446634151ba6043b92cecc4cb4cfda43b5ae731d62cc0b2ff52
Instruction ID: bc3b67499d27e5cb0ff18713dacee33bdf66cca23f489d8664bac1545e860536
Opcode Fuzzy Hash: df6a01ae2aca2446634151ba6043b92cecc4cb4cfda43b5ae731d62cc0b2ff52
Instruction Fuzzy Hash: 02A1F774D0520DEFCB18CFAAE5C05AEFBB2EF89350F10942AE815AB264D7749952CF50

Function 018C08B3 Relevance: 2.7, Strings: 2, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 018C0F1B
Te^q, xrefs: 018C102F

Memory Dump Source

Source File: 00000000.00000002.1793637764.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18c0000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 8aff0f7f13207ffddde265ca337a72fdcec4304f1ff57b731b8f9a7258c5b14d
Instruction ID: f41dfa15a3460124486a7a2d3a483d5be50a34747439ff4348424370faafb3fe
Opcode Fuzzy Hash: 8aff0f7f13207ffddde265ca337a72fdcec4304f1ff57b731b8f9a7258c5b14d
Instruction Fuzzy Hash: 4981E038A11215CFC7158F28C48456ABBF2FF8AB48B24845EF445DB361CB31DA46CB92

Function 018C2290 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

|-, xrefs: 018C2515

Memory Dump Source

Source File: 00000000.00000002.1793637764.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18c0000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: |-
API String ID: 0-2980719050
Opcode ID: e9c38b0c0da9935f256795425cf2b79e9a65af7c4532fd5183f0117bc0008cc3
Instruction ID: 9e608f87f34221a89156ce66306fa25d505281422547d361a336fd8372b62b6f
Opcode Fuzzy Hash: e9c38b0c0da9935f256795425cf2b79e9a65af7c4532fd5183f0117bc0008cc3
Instruction Fuzzy Hash: 9F71C371604115CFD74ACF68C58042EBBB7FB85B04B46896AE802EF2D6C730EE45CB66

Function 0A057F60 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

5=6, xrefs: 0A05809E

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: 5=6
API String ID: 0-2897083178
Opcode ID: 381ff946af5f9011d27c32840f4806eb624a737c2b28cdb9cd16bd97830e63b7
Instruction ID: 2fb7a10ece0860e77b7d0bf31e8f2fe83596530cd81d4e8247fde52bfab0ae81
Opcode Fuzzy Hash: 381ff946af5f9011d27c32840f4806eb624a737c2b28cdb9cd16bd97830e63b7
Instruction Fuzzy Hash: BA712874E0521AAFCB48CFE5D9444AEFBF2FF89200F10992AD41AF7254D7B49A018F65

Function 0A051620 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

-2m, xrefs: 0A051563

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: -2m
API String ID: 0-2686427999
Opcode ID: 79fd0a16af375e0b164fdd8eb1094cc2e8d908dba4ee1bf8f465b51a1c05c435
Instruction ID: e4e1d007aeab1a415a0b9f8af420e636190d499253cd6c8c903a8c026c1080b5
Opcode Fuzzy Hash: 79fd0a16af375e0b164fdd8eb1094cc2e8d908dba4ee1bf8f465b51a1c05c435
Instruction Fuzzy Hash: 25611774E0420ADFCB44DFA9C4805AEFBF2FF89301F24956AD816A7254D7749A41CF50

Function 0A051440 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

-2m, xrefs: 0A051563

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: -2m
API String ID: 0-2686427999
Opcode ID: 80dbcf309f0ef83362ef746bdfb2066712b0bc5e2f3e665a5545b004cfd99a80
Instruction ID: e7a523218421f02aa21ff1726f0c7d2072373b5053ce5dd1fd4ad90900b3b3b2
Opcode Fuzzy Hash: 80dbcf309f0ef83362ef746bdfb2066712b0bc5e2f3e665a5545b004cfd99a80
Instruction Fuzzy Hash: D3513B70D04219DFCB08DFAAD4446AEFBF2EF88301F24D16AD81AA7254E7349941CF65

Function 0A06B998 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802176029.000000000A060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a060000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6299f08e9aa126e4b6354491a5895b9f2daecc6fdc9c10df872bcd601a1b7336
Instruction ID: 34934270b7c2a9a70a8183cc708b04349fa81222536b1d4dea412b7d8139eca6
Opcode Fuzzy Hash: 6299f08e9aa126e4b6354491a5895b9f2daecc6fdc9c10df872bcd601a1b7336
Instruction Fuzzy Hash: A0C159B0E00218DFDF64DFA8C880799BBF2AF89314F14C1AAD449AB255EB70D985CF50

Function 018C225B Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1793637764.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18c0000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64df42647a031906610f4f37f58ada53e93a6724536aa404288dc7d1684c8345
Instruction ID: 1377fa15356fc161fd27f4c93d76cdb03cec4b32e89c553622740fdc73adcd2d
Opcode Fuzzy Hash: 64df42647a031906610f4f37f58ada53e93a6724536aa404288dc7d1684c8345
Instruction Fuzzy Hash: B881E471604215CFD74ACF68C58046ABBB3FF85704B56859AE802EF2E5C730EE45CB56

Function 0A051E78 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9efaad9aacd705cb0d4e19ac8ad52c2f53f8ccdef2eb9739d1916eee2c4948c9
Instruction ID: 0f13346517d9c5d125dea4384dd16125a824b7c4ed4984642cc5fd1372502efd
Opcode Fuzzy Hash: 9efaad9aacd705cb0d4e19ac8ad52c2f53f8ccdef2eb9739d1916eee2c4948c9
Instruction Fuzzy Hash: 3D31F771E016188BEB58CFAAD9443DEFBB3BFC8310F14C16AD409AA268DB341A55CF50

Function 0A4F3CA5 Relevance: 1.7, APIs: 1, Instructions: 244processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0A4F3EE6

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 11693546c7fcf26b3b6080d63317834ac50b4ec3b12eece2cf82d5e74aeb1e2d
Instruction ID: b7d0c6e628f9ef539a1d980282c83b013aa522754ff97c74bd03b5052fd17356
Opcode Fuzzy Hash: 11693546c7fcf26b3b6080d63317834ac50b4ec3b12eece2cf82d5e74aeb1e2d
Instruction Fuzzy Hash: C5A16D71D00619DFDB20CF68C8417EEBBB2BF44314F1485AAE928AB354DB74A985CF91

Function 0A4F3CB0 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0A4F3EE6

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2a85c8c86268c210a3f6152da4964f4315ba77de8bdf943754ec7395a38ee79b
Instruction ID: 39cbe768db99b0840f3959e5f1a04a12df23a67ff835b1cb7f04319930ce90d4
Opcode Fuzzy Hash: 2a85c8c86268c210a3f6152da4964f4315ba77de8bdf943754ec7395a38ee79b
Instruction Fuzzy Hash: 36917E71D00619DFDB10CFA8C8417DEBBB2BF44314F1485AAE928AB344DB74A985CF91

Function 018C8D15 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 018C8DD1

Memory Dump Source

Source File: 00000000.00000002.1793637764.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18c0000_3qr7JBuNuX.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7e15f5b3b1412c6eb54cc9600df019ad035428ec0ae4b1ad21dac061eb0b46dd
Instruction ID: c4a7326862ccdbf211344dd57082394b3835bff5496a7b735c4e4bd54c1ed228
Opcode Fuzzy Hash: 7e15f5b3b1412c6eb54cc9600df019ad035428ec0ae4b1ad21dac061eb0b46dd
Instruction Fuzzy Hash: B641F1B1C0061DDFDB24CFA9C884BDEBBB5BF89704F24806AD408AB255DB756946CF90

Function 018C7824 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 018C8DD1

Memory Dump Source

Source File: 00000000.00000002.1793637764.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18c0000_3qr7JBuNuX.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b750749c0636b0f9cb11bee68f741b0bd5e675abf1f12598b88a0b17ab27dd1c
Instruction ID: f8c286b61abea9fe9b682741dc305e26b5ee23c6df603889e8d7047fc7b8d212
Opcode Fuzzy Hash: b750749c0636b0f9cb11bee68f741b0bd5e675abf1f12598b88a0b17ab27dd1c
Instruction Fuzzy Hash: A341F1B0C0061DDFDB24CFA9C844B9EBBF5BF4A704F20806AD408AB255DB756945CF90

Function 0A06C2D0 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802176029.000000000A060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a060000_3qr7JBuNuX.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 901d30188ed4054f312aa14eb127b38316f4d262b9096926bf32baf5a82080d5
Instruction ID: 0736c9079a8c2f239a644fc440b34ea0979a3a474b007e12ff7d5b5f9cba0533
Opcode Fuzzy Hash: 901d30188ed4054f312aa14eb127b38316f4d262b9096926bf32baf5a82080d5
Instruction Fuzzy Hash: 243178729043989FDB11CFA9D844AEEBFF8EF49310F14846AE994A7221C3359850DFA1

Function 0A4F3A20 Relevance: 1.6, APIs: 1, Instructions: 73injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0A4F3AB8

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ead23a44e0b01ffc1e85be2b08b389a46e632260fe2af90be6d77c7a5ddcef6e
Instruction ID: d5973bc1520918b0d5367a23f9d4f865ccb126fa23430e4487a21773ea50b465
Opcode Fuzzy Hash: ead23a44e0b01ffc1e85be2b08b389a46e632260fe2af90be6d77c7a5ddcef6e
Instruction Fuzzy Hash: 9E2159719002499FDB10CFAAC885BEEBBF1FF48310F10882AE569A7350C774A545CF94

Function 0A06B5D0 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 0A06B66F

Memory Dump Source

Source File: 00000000.00000002.1802176029.000000000A060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a060000_3qr7JBuNuX.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 14ca253657c898d59fb24a11bded96c31bd3757dd362aaf392f8fd488b33c6c2
Instruction ID: 0602806a9a2beca612795163c913f4dd09133eba22fb8653ab90bb7225cd44a3
Opcode Fuzzy Hash: 14ca253657c898d59fb24a11bded96c31bd3757dd362aaf392f8fd488b33c6c2
Instruction Fuzzy Hash: 3431D1B5D002099FDB14DF99D884AEEFBF4FB48314F24842AE819A7210D374A544CFA0

Function 0A4F3A28 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0A4F3AB8

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fa5bfca4f8a536b78ad8204313d3a37b9252ba27211fd7232da19d95fe8ecff4
Instruction ID: 46a68a4c9c4224c54168c1b93572c752f3ad1cdf7a2ebfe0464eba189a01092a
Opcode Fuzzy Hash: fa5bfca4f8a536b78ad8204313d3a37b9252ba27211fd7232da19d95fe8ecff4
Instruction Fuzzy Hash: 072117B59003599FDB10CFAAC845BDEBBF5FB48310F10842AE568A7250D778A544CBA4

Function 0A06B5D8 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 0A06B66F

Memory Dump Source

Source File: 00000000.00000002.1802176029.000000000A060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a060000_3qr7JBuNuX.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 4252cb84c062575bb1db682c61a7fbc38444ba111ec18db32ea272098bf12424
Instruction ID: 02f0d85aa76280e79ecb15e9fe015e42a96338e7e3a3f0146b445a0bb195021c
Opcode Fuzzy Hash: 4252cb84c062575bb1db682c61a7fbc38444ba111ec18db32ea272098bf12424
Instruction Fuzzy Hash: 2E21CCB5D003099FDB10DF9AD884AAEFBF5FB48324F14842AE919A7210D774A944CFA4

Function 0A4F3888 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0A4F390E

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2ea16e6a83fbfe5832c3bd471a1cbf52e07e7f3d0f167f7422601ef160575181
Instruction ID: 0251d8b377317c06f284010b415912973c329351a1262d83efb659034522e4ac
Opcode Fuzzy Hash: 2ea16e6a83fbfe5832c3bd471a1cbf52e07e7f3d0f167f7422601ef160575181
Instruction Fuzzy Hash: 122128B59003098FDB10DFAAC485BEEBBF4EB49314F14842AD569A7241C778A985CFA4

Function 0A4F3B18 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0A4F3B98

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d9d3bc650858e2dae694f57a06220a0c9df399d8950d4df2872b71d8facd0347
Instruction ID: 2f272b0677aa38fec59f4bdb25d6850f8311ca1c1ce2b25686d09a7b000bfed7
Opcode Fuzzy Hash: d9d3bc650858e2dae694f57a06220a0c9df399d8950d4df2872b71d8facd0347
Instruction Fuzzy Hash: 1A2116B18003599FCB10DFAAC845BEEFBF5FF48310F10882AE559A7251C778A544CBA5

Function 0A4F3890 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0A4F390E

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f00367a298d34cd187bf68a61d7a37293e7a953a3c96b332ac9b658e5ec12ab1
Instruction ID: 9380fb7abead39e4f5d8050da461aa0257f0905165cad7b02796fefba8867c62
Opcode Fuzzy Hash: f00367a298d34cd187bf68a61d7a37293e7a953a3c96b332ac9b658e5ec12ab1
Instruction Fuzzy Hash: 7F2109759003098FDB10DFAAC4857EEBBF4EB48314F14842AD569A7241C778A945CFA5

Function 0A4F3B11 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0A4F3B98

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0fb12ff9ce619f70c762af6dc44b6006a6cdd76c63c72af04575ab685109450e
Instruction ID: 272c8e8d9a20f5ba6fcd5e95a8b4b7644f60501a42932c667813548f77fcecf7
Opcode Fuzzy Hash: 0fb12ff9ce619f70c762af6dc44b6006a6cdd76c63c72af04575ab685109450e
Instruction Fuzzy Hash: 172139B18002598FCB10DF99C985BDEBBF1FF48310F10842AE519A7251C738A544CFA4

Function 0A4F3960 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0A4F39D6

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7c9e7db3ee59484d6d081a4376f1cbc67e75f8be92e0c80601981f21b72f0e9d
Instruction ID: 3c60ffd1406587efaafc161b6826426d11ef148f46a1d4d3164c70b44eb0690d
Opcode Fuzzy Hash: 7c9e7db3ee59484d6d081a4376f1cbc67e75f8be92e0c80601981f21b72f0e9d
Instruction Fuzzy Hash: 36115C719002499FCB10DF99C845BDFBFF5EF48324F10841AD565A7250C775A540CFA4

Function 0A057B8A Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0A057C03

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: efe776288478bbd52d7b817e47b49121581e7bcd38588b0cfa549a7f8b5e1648
Instruction ID: 0199706f9f061e3e602c7d9209cdc430e6a365d35a0f74706c81c8dfd6884871
Opcode Fuzzy Hash: efe776288478bbd52d7b817e47b49121581e7bcd38588b0cfa549a7f8b5e1648
Instruction Fuzzy Hash: 9A21F4B5900249DFCB10CF9AC485BDEFBF4AB48320F10842AE858A7251D378A544CFA5

Function 0A06A584 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,0A06C2EA,?,?,?,?,?), ref: 0A06C38F

Memory Dump Source

Source File: 00000000.00000002.1802176029.000000000A060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a060000_3qr7JBuNuX.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 716b3bd1376e6511cf8b253ffef9207a2d43375679f3f20a9ba37903bd7105ab
Instruction ID: 659f79fbb49f229d087911b596e82252fa8e908cf20f911c0b74530ebe9d045a
Opcode Fuzzy Hash: 716b3bd1376e6511cf8b253ffef9207a2d43375679f3f20a9ba37903bd7105ab
Instruction Fuzzy Hash: 071137B580035D9FDB10CFAAC844BEEBFF8EB48324F14841AE954A7210C379A954DFA4

Function 0A057B90 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0A057C03

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 036af14ca8317f13625e2c8abad00e1fb86fae79e0df2b6684f0e49fec86a217
Instruction ID: fdfd7697b0963c57bee9d165513d4a17d36cd35711a124b067e3ba97e9129282
Opcode Fuzzy Hash: 036af14ca8317f13625e2c8abad00e1fb86fae79e0df2b6684f0e49fec86a217
Instruction Fuzzy Hash: 6021D3B5900249DFCB10DFAAC985BDEFBF4EB49320F108429E958A7251D378A544CFA5

Function 0A4F3968 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0A4F39D6

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ed04a4569a3550456b557fc1978626d04246567302ec110340d4892329ce2065
Instruction ID: 5c46458821c77dd31a9ccc334b2f8a79bfd015e05d98fed6c0b3b0711d560fe2
Opcode Fuzzy Hash: ed04a4569a3550456b557fc1978626d04246567302ec110340d4892329ce2065
Instruction Fuzzy Hash: E11129759002499FCB10DFA9C845BDFBFF5EB88320F10881AD565A7250C775A544CFA4

Function 0A4F37D9 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0A4F3842

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 40d24afea02425cc814324a3ebf7ce76fcc41653010040046704baed9a536815
Instruction ID: 1c5bb4a00ca1c4ededbd6eb275e1a60f216833a1000f0206a775180523d39db9
Opcode Fuzzy Hash: 40d24afea02425cc814324a3ebf7ce76fcc41653010040046704baed9a536815
Instruction Fuzzy Hash: 771128B5D003488BDB10DFAAC4457DEFBF4EB88324F20882AD569A7250C779A944CF94

Function 0A4F37E0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0A4F3842

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1f41a7c3be2ef317cacdf7ff2841ac456172a2f38f7ebedc8c52daa22cddce90
Instruction ID: ce9cb6f9c31ad73ae18d8f625284a91561aa48f6b570e3bc1a833afec8ca3073
Opcode Fuzzy Hash: 1f41a7c3be2ef317cacdf7ff2841ac456172a2f38f7ebedc8c52daa22cddce90
Instruction Fuzzy Hash: A31128B59003488BDB10DFAAC4457DEFBF4EB88324F20882AD569A7250C779A544CF94

Function 0A4F05B4 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0A4F665D

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 71077e8b3fba1d093712c1c152666a4e28cea1e5e54cf8ff33ef6e397e8d3763
Instruction ID: 19de331bcdf55c0f38b68aa5054c49973a140becb21e2909e6d96b791d02114e
Opcode Fuzzy Hash: 71077e8b3fba1d093712c1c152666a4e28cea1e5e54cf8ff33ef6e397e8d3763
Instruction Fuzzy Hash: CA11F5B58003489FDB10DF99D845BDEFBF8EB49310F10881AE568A7210C375A944CFA5

Function 018CE500 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 018CE566

Memory Dump Source

Source File: 00000000.00000002.1793637764.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18c0000_3qr7JBuNuX.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 856261e7335dffcdd9d1a89d54589d56aada6e970ec257e7337e48dd786cc344
Instruction ID: e38be4f7142389588a11da007c8cf111995a841f995d79fa78b84ac1e15aaf6c
Opcode Fuzzy Hash: 856261e7335dffcdd9d1a89d54589d56aada6e970ec257e7337e48dd786cc344
Instruction Fuzzy Hash: FE11FDB6C002498BDB10CF9AC444A9EFFF4AB88720F10842AD528A7610D379A645CFA1

Function 0A4F65FA Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0A4F665D

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 5580b9b2c89600bce3a627b9b1e81831da88cfc8690a787a0397bab294632ff3
Instruction ID: 53126b8b2f69d81303a82192e6cd00953b5d6a7fb79c6965b8e62b3207630609
Opcode Fuzzy Hash: 5580b9b2c89600bce3a627b9b1e81831da88cfc8690a787a0397bab294632ff3
Instruction Fuzzy Hash: 481133B58003888FDB10CF99C889BEEFFF4EB58310F14845AE568A7211C375A944CFA4

Function 0187D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1793228579.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_187d000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 800e42d7d937f8951e0f7342578f8eabf281ea0597382c1200c6d8b79821b8a1
Instruction ID: 82ce3dac609880fcb79af6b539ca3a709621ad848d6c5f99ea70abd42b22afde
Opcode Fuzzy Hash: 800e42d7d937f8951e0f7342578f8eabf281ea0597382c1200c6d8b79821b8a1
Instruction Fuzzy Hash: 5F213771614204DFDB01DF98D5C0B26BBA5FF84328F24C66DD9098B252C336E547CA61

Function 0187D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1793228579.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_187d000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2afbbc0797a91dde9bdf4f6a24e5b1e36085ad3a4c58e075e8ad9c0978904854
Instruction ID: b00ca8b3eb4ab34becde0120ad060e154d5bb409d0c459551f4401536e09464e
Opcode Fuzzy Hash: 2afbbc0797a91dde9bdf4f6a24e5b1e36085ad3a4c58e075e8ad9c0978904854
Instruction Fuzzy Hash: F9212271604204DFCB16DF58D9C4B26BFA5EF84318F20C66DD80A8B256C33AD547CA61

Function 0187D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1793228579.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_187d000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 7912cb0c55922cb99894247c516513731acca7d2f5e342e5bb316293b42c038e
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: E611BE75504280CFDB12CF54D5C4B15BF61FB44314F24C6AAD8098B656C33AD50ACB61

Function 0187D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1793228579.000000000187D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_187d000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 630e0163aedaca3a22d407a1e6d9cf340468ad7ae5aeee7c7a772fbaf2203c76
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 8B11BB75504280DFDB02CF54C5C4B15BFA2FF84324F28C6AADC498B296C33AE40ACB61

Function 0186D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1793067568.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_186d000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0e9261167aa9301ff336edf8b730f650caa552e0751a83e960ab09d21ca5f1
Instruction ID: f427e7787e09cac67abfb51b3e551c9246182dd6d1de854ddc33b032215788f5
Opcode Fuzzy Hash: 4a0e9261167aa9301ff336edf8b730f650caa552e0751a83e960ab09d21ca5f1
Instruction Fuzzy Hash: BA012B312083849AE7104E69CD84B67FFDCDF41324F08CA2AED488E286C27DD940CBB2

Function 0186D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1793067568.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_186d000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c49cdcad5546949c1f355eaadd7632215cab58e6018bff2c8bb68563c4abe9
Instruction ID: 3fe321fb95e25294f9ad755a2ef17fd52bcf8e2375be4b8a98e2b85f3bda7d0f
Opcode Fuzzy Hash: f4c49cdcad5546949c1f355eaadd7632215cab58e6018bff2c8bb68563c4abe9
Instruction Fuzzy Hash: 93F062715083849AE7118E1ADC88B62FFACEB81734F18C55AED484A286C2799844CBB1

Non-executed Functions

Function 0A05A43A Relevance: 1.6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

Strings

{#L, xrefs: 0A05A620

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: {#L
API String ID: 0-1361971085
Opcode ID: 5eb66b3a712f4ff3c5534c16a4c4fa040f06487ffca064242732303b2510f0bc
Instruction ID: d861d78c5073b595c42017220a5c975658aeac43e83dd32103ecbb853dbc6977
Opcode Fuzzy Hash: 5eb66b3a712f4ff3c5534c16a4c4fa040f06487ffca064242732303b2510f0bc
Instruction Fuzzy Hash: A2D10270E05259DFCB18CFEAD98859EFBF2BF88350F14D52AD419AB224DB7499428F10

Function 0A0539E0 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

l|, xrefs: 0A0538EB

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: l|
API String ID: 0-1955549514
Opcode ID: fb121c1143feb38ed1afb255348b55125f6f3fa84bf58b42258b8b1613f63c80
Instruction ID: e00fff8840ed375e0aa0501207ca7c416465a5a81c86c1437ab264876f468815
Opcode Fuzzy Hash: fb121c1143feb38ed1afb255348b55125f6f3fa84bf58b42258b8b1613f63c80
Instruction Fuzzy Hash: 81717EB4E0520EAFCB08CFA9C4914AFFBB2FF88240F14D569D805AB215D7749A41CF52

Function 0A0518D9 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

98R, xrefs: 0A051A43

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: 98R
API String ID: 0-576591972
Opcode ID: d4cb120d5034e2a4e65d01994f7e55d7356706243db01ffff9900b5b23b2222c
Instruction ID: 0bbb5fc8348746be2ff9b4ca99386230befd0c88a917a7d24f81a4a1cf7d81f8
Opcode Fuzzy Hash: d4cb120d5034e2a4e65d01994f7e55d7356706243db01ffff9900b5b23b2222c
Instruction Fuzzy Hash: 8A711774E0520EEFCB18DFA9D581AAEFBB1FB89310F148529D815AB314D3749A42CF94

Function 0A058559 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

iUfo, xrefs: 0A05867E

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: iUfo
API String ID: 0-3820436262
Opcode ID: f5f93de5af35d5e77f21d765dd5c6404674ad6f72c01a5e88ca3a61f9bc0fe49
Instruction ID: 480cce5b269b6e5d58000d1619e13f37296c59ea0cd1780f7adcfb44bc191a8b
Opcode Fuzzy Hash: f5f93de5af35d5e77f21d765dd5c6404674ad6f72c01a5e88ca3a61f9bc0fe49
Instruction Fuzzy Hash: 3A5102B4E052199FCB18CFA9D9455AEFBF2BF88300F10802AD805F7250E7B49A05CF65

Function 0A058568 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

iUfo, xrefs: 0A05867E

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: iUfo
API String ID: 0-3820436262
Opcode ID: 421aecd8a0cfa3683664e445c669715d7e164fbf7a4b98f49962300ed701059c
Instruction ID: 55ea6167f9b5faac462c9b8904839dcf907d744f6c12cbc34fd5aeb32b6e8313
Opcode Fuzzy Hash: 421aecd8a0cfa3683664e445c669715d7e164fbf7a4b98f49962300ed701059c
Instruction Fuzzy Hash: 7951F2B4E052199FCB14CFA9D9845AEFBF2BF88300F10D42AD805B7254E7749A45CF55

Function 0A058950 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

w7e^, xrefs: 0A058A95

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: w7e^
API String ID: 0-1657886525
Opcode ID: 507989b1b77e7caa58c11edc976c45b64191e13606784e7016ac9f056b053620
Instruction ID: 3de81acedb58646ed4a8bfddf8f8b9ab0e0538c130e127a60f0488f1099400e2
Opcode Fuzzy Hash: 507989b1b77e7caa58c11edc976c45b64191e13606784e7016ac9f056b053620
Instruction Fuzzy Hash: F7413570D0520ADFDB14CFA6D8416EEFBF1BB89201F18D46AC801B7254D3788646DF59

Function 0A058960 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

w7e^, xrefs: 0A058A95

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: w7e^
API String ID: 0-1657886525
Opcode ID: 2448c9b6fcac265fe98a6650a9a46360f09fec35b0d7d180dc9fe62ea87f8e2a
Instruction ID: b4117b67047829c189c37170ed2e01dd7cabca6ee1fac5fc89ee1b5aaa70c6fa
Opcode Fuzzy Hash: 2448c9b6fcac265fe98a6650a9a46360f09fec35b0d7d180dc9fe62ea87f8e2a
Instruction Fuzzy Hash: 5B4112B0D0520DEBCB04CFAAD9406EEFBB1BB89201F18D42AC816B7254D3784646CF69

Function 0A055458 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

0ni, xrefs: 0A0555C3

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: 0ni
API String ID: 0-1488673370
Opcode ID: 6b07677d2609ce6516083b49c84072a6a02089efb931dceef6ddd5b8565b54db
Instruction ID: 44f415586c02e76b8522f275a6d4b8f9c8e83fe4f8184801bf851d5e8c9adc9e
Opcode Fuzzy Hash: 6b07677d2609ce6516083b49c84072a6a02089efb931dceef6ddd5b8565b54db
Instruction Fuzzy Hash: 1D513971E056188BDB58DF6B9D4579EFAF3AFC8300F14C5BA950CA6224DB301A868F51

Function 0A055454 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

0ni, xrefs: 0A0555C3

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: 0ni
API String ID: 0-1488673370
Opcode ID: 8fd8392251a842cbe4d25fc2f162590f71c32bd009617c8d08687a079952c830
Instruction ID: b4cc7fa2e10388fbd838341da68d200200e5b11ba0c2da73a12a4caeb0fb2fd7
Opcode Fuzzy Hash: 8fd8392251a842cbe4d25fc2f162590f71c32bd009617c8d08687a079952c830
Instruction Fuzzy Hash: 3C412871E016188BEB58CF6B9D4579EFBF3AFC8300F14C1BA950DA6224DB341A868F51

Function 0A4F1070 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968f9ec6502257e431f4b014d7ab29cb169f39f6192ccc5f94c9203656e5ca0d
Instruction ID: 2d55ad0aaa68824a6dec40660ee1d773778ee79e5304b87546a102db853c6eec
Opcode Fuzzy Hash: 968f9ec6502257e431f4b014d7ab29cb169f39f6192ccc5f94c9203656e5ca0d
Instruction Fuzzy Hash: 91E1D874E00119CFDB14CFA9C5909AEBBB2FF89304F24965AE914AB356D730AD42CF61

Function 0A4F18E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30af851dab400c80388a094bfc6c4e68a29166ca215dc1aeb1a64c3814c622fa
Instruction ID: 72e3943dc5ea2fa62857cc24e4934a92370a1d49c04866def0218d5c9bdb163c
Opcode Fuzzy Hash: 30af851dab400c80388a094bfc6c4e68a29166ca215dc1aeb1a64c3814c622fa
Instruction Fuzzy Hash: F5E1E774E00159CFCB14CFA9C5909AEBBB2FF89304F24966AD519AB356D730AD42CF60

Function 0A4F2FB8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93a92cd1781c7abd9be9afd068e3738b626d37457cc6afa16f30fa9ff0e4e8b
Instruction ID: ee3ef003722389190fe2b5fbc22030a79e326823043712be5ed1e227f927115d
Opcode Fuzzy Hash: f93a92cd1781c7abd9be9afd068e3738b626d37457cc6afa16f30fa9ff0e4e8b
Instruction Fuzzy Hash: 78E1C774E001198FCB14CFA9C5809AEBBF2FF89304F24956AD925AB356DB31AD41CF61

Function 0A4F14A8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009b37364894a4a0b7470ab6a0aa417bdc56469dbeaaabc72d96dd7901e7013d
Instruction ID: be0c4f06f1dc8bc28c3395fec726f25c36d8ab40c783f3aa562bbd99698e9680
Opcode Fuzzy Hash: 009b37364894a4a0b7470ab6a0aa417bdc56469dbeaaabc72d96dd7901e7013d
Instruction Fuzzy Hash: D5E1C674E00119CBDB14CFA9C5809AEFBF2EF89304F24966AD519AB356D730AD42CF61

Function 0A4F1D18 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f22d1c2305e17234036d5d07ebda5e8a09fcb9cbe06cec3d4a0fb82f114c71
Instruction ID: 18d1c65a1cbd54e50511f942fd787d3ae884d91f43e56ccbd61ba8b708decb22
Opcode Fuzzy Hash: 74f22d1c2305e17234036d5d07ebda5e8a09fcb9cbe06cec3d4a0fb82f114c71
Instruction Fuzzy Hash: 4BE1D674E101198FCB14CFA9C5809AEBBF2FF89304F24966AE514AB356D734AD42CF61

Function 0A053BC8 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca11ec77f4894d2c373eda8c40bcb0a5143be8881b54aac2ea49f34f062360d
Instruction ID: cd4200c38bed17fcc517773bc76d5756e1b579150cf55bf21d0d3051ba2950c7
Opcode Fuzzy Hash: 3ca11ec77f4894d2c373eda8c40bcb0a5143be8881b54aac2ea49f34f062360d
Instruction Fuzzy Hash: D1D13574A1520ADFCB04CFA9D59589EFBF2FF89340F249569E805EB221D330AA41CF52

Function 0A059E88 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99aff5ada87c000ab0ef4e87e45b088c2b358bc4326bf6cade509c2cb44f66ee
Instruction ID: 0d71c3d4e4b385f751b4d6c7b1d2880147d7935da1dc0c5b6d82dfcba08b442d
Opcode Fuzzy Hash: 99aff5ada87c000ab0ef4e87e45b088c2b358bc4326bf6cade509c2cb44f66ee
Instruction Fuzzy Hash: 71B1D575D05209DFCF68CFAAD98069EFBB2BF89340F20942AD419AB254D7749A06CF10

Function 0A053BD8 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c763512261d1b8a047a4247b5de72148528bfa7213dc837b14d5f0cddcccb7e
Instruction ID: 67e88da453c66e260abb63b547a4e5af74a4922f889d8f20e49c770acae20f8d
Opcode Fuzzy Hash: 1c763512261d1b8a047a4247b5de72148528bfa7213dc837b14d5f0cddcccb7e
Instruction Fuzzy Hash: 6491F174A1421ADFCB04CFA9D58489EFBF2FF89350F249569E415AB320D330AA42CF51

Function 0A054FD8 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a604b31c1e3d3da4df0406d48e2de55195c62144f87df35573c533434656ca7
Instruction ID: 843b24ec03229686e4ef1b508422baaf495a9affd52fdd33a2906b3dfefbd73f
Opcode Fuzzy Hash: 3a604b31c1e3d3da4df0406d48e2de55195c62144f87df35573c533434656ca7
Instruction Fuzzy Hash: 0581F474E15609DFCF04CFA9C9805DEFBF2FB89310F24A42AD815B7214D375AA428BA4

Function 0A058D11 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc4da1a26d513a17a30d1c231ea98956bf0ddc4588e72143bb9761df92e62ed
Instruction ID: 9dccc812496b38ae48172e4d6651a7a7a043c5e5dbd1a351497b20dadf5105f0
Opcode Fuzzy Hash: 8fc4da1a26d513a17a30d1c231ea98956bf0ddc4588e72143bb9761df92e62ed
Instruction Fuzzy Hash: A881F974E10259CFCB54CFA9C5809AEFBF2FB89305F24D5A9D818A7216D7309A41CF61

Function 0A054FE8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81bc2db45873ac9d7d39a42e14b8025ec494e4e5a22174da0efbc82a3f8da9c0
Instruction ID: 93baee848a9700fa4fb7e825d9791561b6cf367820a4c41c9371cefc056e2b0c
Opcode Fuzzy Hash: 81bc2db45873ac9d7d39a42e14b8025ec494e4e5a22174da0efbc82a3f8da9c0
Instruction Fuzzy Hash: 5771F474E1560DDFCF14CFA9C9809DEFBF2EB89310F24A42AD905BB214D375AA418B64

Function 0A054DD2 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27fbbf5af7bbf734c1d1e21e39ab26724fce0f116164873ac836d89687dad08c
Instruction ID: 99ea6e4d631fb6e2662895c3ae5ac202f2c0843434bf00d53ed3db00941dec4a
Opcode Fuzzy Hash: 27fbbf5af7bbf734c1d1e21e39ab26724fce0f116164873ac836d89687dad08c
Instruction Fuzzy Hash: 43510570E0460EDFCB48CFAAD4905EEFBF2FB89200F14C46AD815A7254D7759A828F94

Function 0A4F18D1 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0660e63e7c93768cf83e90f6182e3eec9ea2ddc23d6ff0c8a5033872feb976a
Instruction ID: 71946f51f59cdc1507f7b34a1087388fb58a3eab1949713d95572414fcf54105
Opcode Fuzzy Hash: c0660e63e7c93768cf83e90f6182e3eec9ea2ddc23d6ff0c8a5033872feb976a
Instruction Fuzzy Hash: 0E51D974E002198BDB14CFA9C5809AEFBF2EF89304F24966AD518A7316D7319E41CFA1

Function 0A4F1498 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803159496.000000000A4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4f0000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986c6a45a423f80f8e8f9c61483c42688bd6a5131cbc84d531700fa914c5beab
Instruction ID: 376db94f1ceed69ddf17b003e613c4b1041e55b0e7c5ea619bf99776edad83a0
Opcode Fuzzy Hash: 986c6a45a423f80f8e8f9c61483c42688bd6a5131cbc84d531700fa914c5beab
Instruction Fuzzy Hash: 5951F974E002198BDB14CFA9C9845AEFBF2FF89304F24966AD518A7316D7319D42CF61

Function 0A055268 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ec3c256ab3f8ced2b8e8493e431fa05e323685a954e7c47dc5211aaa2ea5c3
Instruction ID: e5162b8cfd21a1ad173b39a98894865503743094eb48af10117cfb2916678b07
Opcode Fuzzy Hash: 41ec3c256ab3f8ced2b8e8493e431fa05e323685a954e7c47dc5211aaa2ea5c3
Instruction Fuzzy Hash: 244119B0E0520ADFCB44CFA9C4815AEFBF2EF89300F14D46AC819F7215D774AA418B55

Function 018C134A Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1793637764.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18c0000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9944857c82f0bd66611ec23c2abec6eff981c502cb4262fb491d3afa1454b472
Instruction ID: 7ad6d2a69a70183e3169ec9fc1cfb3dbcba4cb8366114d673eb81c7c65fde1d3
Opcode Fuzzy Hash: 9944857c82f0bd66611ec23c2abec6eff981c502cb4262fb491d3afa1454b472
Instruction Fuzzy Hash: C1419F75B04219CFCB14CEA9D4D45BEFBFBEB88714F25806AE505E7652D634CE028B90

Function 0A055278 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 026f2cb08db2a54f5e7e3254b47bb09871c08ec0a01cd861456b9388b377f3fc
Instruction ID: b409df0b03aa0a5a94dd5d59933e69f6576d04f7f42e1a8f5843960e6c6d0ae6
Opcode Fuzzy Hash: 026f2cb08db2a54f5e7e3254b47bb09871c08ec0a01cd861456b9388b377f3fc
Instruction Fuzzy Hash: F541F9B0E0520EDBCB44CFA9C9815AEFBF2FF89300F24D569D819B7214D774AA418B95

Function 0A058228 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c80d45a4b948481b7727946d4e10ba7e9a4746cf287502ec04c45ddc8043f68
Instruction ID: a316b0f07533f6925b2ce4767f8b4034f5ba927a9436c0ac3a916b3c8edb87fa
Opcode Fuzzy Hash: 3c80d45a4b948481b7727946d4e10ba7e9a4746cf287502ec04c45ddc8043f68
Instruction Fuzzy Hash: BC414970E0A60EDFCB54CFA6D5416AFFBF2AB98300F20D46AC805B7264E77487058B94

Function 0A058222 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c7efbd20a2157d52638165c81db3980125ebaf976bceb7ee846ca4b5145b74
Instruction ID: 3885019b44af9775d2d9398052b518cecf4f7fbe2b98c0fd5ef00a66b309f761
Opcode Fuzzy Hash: 07c7efbd20a2157d52638165c81db3980125ebaf976bceb7ee846ca4b5145b74
Instruction Fuzzy Hash: 11411870E0660EDFCB54CFA6D5416AFFBF2AB98300F20D46AC805B7264E77497458B94

Function 0A054DE0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba835da79b12c0ff0cd052022279f11366d3157527ce46b6262f6909e9f64ad
Instruction ID: e0ee4f23800da7089f9eab1987a3355bdc2aecd86bfe3dda5bacd5c803048400
Opcode Fuzzy Hash: 4ba835da79b12c0ff0cd052022279f11366d3157527ce46b6262f6909e9f64ad
Instruction Fuzzy Hash: 4041B6B0E0560EDBCB48CFAAD4815EEFBF2AB88200F14D46AD815A7254D7759A818F94

Function 0A050006 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc36e0ec4fa5c9f408546ce42fda80c07317c778dd96c35876736d274335ef8
Instruction ID: 345bd4552b85d2ac35096a51ba4c84a92e75abc76de8e773d3d868bde0c65f08
Opcode Fuzzy Hash: edc36e0ec4fa5c9f408546ce42fda80c07317c778dd96c35876736d274335ef8
Instruction Fuzzy Hash: 98210371E097589FD749CF6B881069EBFF3AFCA300F09C0B7C448A6266D63405558B11

Function 0A050040 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802088040.000000000A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a050000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b5a4d713559bd84db31ab5e926404f011491b349ea55f5e3c6ac869ff338f79
Instruction ID: 8d290e4d54151fba650ae79a591d32562763888732c4bbd90ad599abfef355e9
Opcode Fuzzy Hash: 8b5a4d713559bd84db31ab5e926404f011491b349ea55f5e3c6ac869ff338f79
Instruction Fuzzy Hash: 1711E971E006189BEB58CFABD80069EFAF7AFC8300F04C07AC91CB6224EB7406568F51

Analysis Process: 3qr7JBuNuX.exePID: 1880, Parent PID: 4828COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	21.7%
Total number of Nodes:	69
Total number of Limit Nodes:	12

Executed Functions

Function 00E7C530 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 00E7F910

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 0bdd7fc33ba2e65523871c7c0a6e08aba5ed2ff76cfdcb013a08b0ad15f1f820
Instruction ID: a554e5f3c14e620f506aceb59cb7d6bc7e4ff7f3071e2ae95a475affec04c52c
Opcode Fuzzy Hash: 0bdd7fc33ba2e65523871c7c0a6e08aba5ed2ff76cfdcb013a08b0ad15f1f820
Instruction Fuzzy Hash: 3273D531D10B5A8EDB11EF68C854A99FBB1FF99300F51D69AE44877221EB70AAC4CF41

Function 04E60AB8 Relevance: 3.5, APIs: 2, Instructions: 530
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 04E60D70

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b0f194e8358b422448315530d03b45177191a9f9ddbd1505b02f0b3a77ca8162
Instruction ID: 7a623a38b756cba65694550176adc83169e018cd66a58de6bd8486768cb6d2f1
Opcode Fuzzy Hash: b0f194e8358b422448315530d03b45177191a9f9ddbd1505b02f0b3a77ca8162
Instruction Fuzzy Hash: 4B224B74E00228CFDB14DFA9C984B9DBBB2BF88344F1095A9E409AB355DB35AD85CF50

Function 00E727B9 Relevance: 3.2, Strings: 2, Instructions: 691
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 00E72C95
Xbq, xrefs: 00E72CBE

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: 47f6a79db68665e007cf6930218b02c11adf1fe3c2195c603b678726df4af7cd
Instruction ID: 6f8ee8a1543fdfb8c86d0790334ef2784bcdf9ba2945f0eb993bf5c986d719af
Opcode Fuzzy Hash: 47f6a79db68665e007cf6930218b02c11adf1fe3c2195c603b678726df4af7cd
Instruction Fuzzy Hash: 54128F62F982E58FF717953A08AD2F0EBE156AD304F48C96DD8C3C3445F75C468B8A19

Function 00E72DD1 Relevance: 2.8, Strings: 2, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 00E72E0F
$^q, xrefs: 00E72DF6

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: 9153ea24b87111f275b263f9aa81251d69f1d2315ef432e9d5b882133e9dd2f8
Instruction ID: 2a1013b5255ce130fdfd8057b2663fffadccf9ac0030f5acdd7a1e123e681536
Opcode Fuzzy Hash: 9153ea24b87111f275b263f9aa81251d69f1d2315ef432e9d5b882133e9dd2f8
Instruction Fuzzy Hash: C491D670B00258CFDB58EB78885867EBBB3BFC4700B19C92DD04AF7294DE3589029781

Function 04E60CD8 Relevance: 1.6, APIs: 1, Instructions: 88libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04E60D70

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4974e189d2f5537b22d04913be9de72c1e4d3b6eaa84e99140a1a0d48ca923cd
Instruction ID: ab53bd84489e40f85c148d026850ae0a90cea08171eccc6106247a37d6592645
Opcode Fuzzy Hash: 4974e189d2f5537b22d04913be9de72c1e4d3b6eaa84e99140a1a0d48ca923cd
Instruction Fuzzy Hash: 9D31E8B1D016189BEB18CFAAD8847DDFBF2BF88314F14D16AE419A72A4DB705945CF10

Function 054460D8 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d56402445ae7ae5d428c8198199287d8b40329dec1b7f65d4421538338df37
Instruction ID: 3e31960b578c49501dd0624655749fd74b7ea2e47132f1bc9504cbb62a87ed26
Opcode Fuzzy Hash: e2d56402445ae7ae5d428c8198199287d8b40329dec1b7f65d4421538338df37
Instruction Fuzzy Hash: 7372BE74E052288FEB64DF69C984BEDBBB2BB49300F1491EAD409A7355DB309E81CF50

Function 04E65AD8 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fffca49b7dd9a26f0236ac78041fb80171fded580241fbe04f65c96e6bc950
Instruction ID: ab9df55ab495e583f80efa02d226e16d4b5f7c924cb80c1c6a11b58d3c97130c
Opcode Fuzzy Hash: 84fffca49b7dd9a26f0236ac78041fb80171fded580241fbe04f65c96e6bc950
Instruction Fuzzy Hash: FFE1C274E01218CFEB64DFA5D944B9DBBB2BF89304F2081AAD409BB395DB355A85CF10

Function 00E79480 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45b2a0818dcc10920cf6ea7f6f6050dbd2a27881c5219559aacb867c060e526
Instruction ID: 1e1eb668f8cc48c7bb6e077c9ee0156b569a510b038f947ae241a63e6f5171d3
Opcode Fuzzy Hash: c45b2a0818dcc10920cf6ea7f6f6050dbd2a27881c5219559aacb867c060e526
Instruction Fuzzy Hash: 00C19074E01218CFDB14DFA5D994B9DBBB2BF88300F2085AAD809AB355DB359E85CF11

Function 00E7C521 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8cf45e5d20a9d1492438c9e8a10ea1f65ab764182147f92bd23df6604c886a5
Instruction ID: c7ac1f8219343d2bf5630a61fb673afa20ba3a6a279ea58a2015a52e4e4eedfc
Opcode Fuzzy Hash: e8cf45e5d20a9d1492438c9e8a10ea1f65ab764182147f92bd23df6604c886a5
Instruction Fuzzy Hash: 5EA10471D016198EDB14DFA9C8446DDFBB1EF89304F14D2AAE418BB261EB70AA85CF41

Function 00E79A30 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b685d0f6bd9f4e6600268dfbc2d1dee192897a14f72e4f2cdd2347c42b7460
Instruction ID: d35695b31ba57f3d56af15655d8d4b445438b7f3775be2747b564a2938e1f7a0
Opcode Fuzzy Hash: d7b685d0f6bd9f4e6600268dfbc2d1dee192897a14f72e4f2cdd2347c42b7460
Instruction Fuzzy Hash: 2BA10470D002088FEB14DFA9D994BDDBBB1FF89304F209269E409A73A1DB759985CF54

Function 00E79A40 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1717c9a5f9dace5d56f00df016421c8d735c1dd6e49c2604db1ebfff7a6fa73e
Instruction ID: e011dd343f2fdfdb3dc785cc529914a2913fd2e212e200b99e97b83fb1b95d24
Opcode Fuzzy Hash: 1717c9a5f9dace5d56f00df016421c8d735c1dd6e49c2604db1ebfff7a6fa73e
Instruction Fuzzy Hash: 22A10470D002088FDB24DFA9D994BDDBBB1FF49304F209269E409A73A2DB749985CF55

Function 00E79D87 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fab7d74bc4a9ee4d19c6d931ac838a093f2ceef7f9857c56fec047557ab501
Instruction ID: d8c2fb6d07e80f0d74675a1203d11fb477f5ab631d3b84e2c8deeb7e80887eab
Opcode Fuzzy Hash: e9fab7d74bc4a9ee4d19c6d931ac838a093f2ceef7f9857c56fec047557ab501
Instruction Fuzzy Hash: F091E270900208CFDB20DFA8D998BDCBBB1FF49314F249269E509BB292DB759985CF15

Function 00E7946F Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9ce5baf0395e308b2002b4d678177c5b885d6d5e7bd9b0e800bebd4d7125a1f
Instruction ID: a8c6cbbdbab66189b733ee3c5f1568fa58e1e8c33965ef50a41e2cea34d994e1
Opcode Fuzzy Hash: e9ce5baf0395e308b2002b4d678177c5b885d6d5e7bd9b0e800bebd4d7125a1f
Instruction Fuzzy Hash: 5241E574D01208CBEB18CFA6D8546DDBBF2AF88300F24D12AD419BB355EB385946CF50

Function 00E70B30 Relevance: 7.7, Strings: 6, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\v, xrefs: 00E70BB5
\v, xrefs: 00E70BF3
\v, xrefs: 00E70C12
\v, xrefs: 00E70B96
\v, xrefs: 00E70BD4
LR^q, xrefs: 00E70B62

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: LR^q$\v$\v$\v$\v$\v
API String ID: 0-931508885
Opcode ID: 2d14c0ea6c29167e63342e21489123c1abb353f20cc6ff248ae3776dc6ec5de2
Instruction ID: e04330b40e6b406976c88d4eafc7efa2d8b9fcf77f9013f0e740af041c0970c2
Opcode Fuzzy Hash: 2d14c0ea6c29167e63342e21489123c1abb353f20cc6ff248ae3776dc6ec5de2
Instruction Fuzzy Hash: 47A1BA74A05209CFCF45EFA8E995D9DBBB1FB88304B105629E405AB379DB70AD46CF80

Function 00E7B500 Relevance: 6.6, Strings: 5, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 00E7B6EA
8cq, xrefs: 00E7B941
Hbq, xrefs: 00E7B54E
Hbq, xrefs: 00E7B749
TJcq, xrefs: 00E7B97A

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: 8cq$Hbq$Hbq$Hbq$TJcq
API String ID: 0-1895975235
Opcode ID: cdf610c6932f8f4d37e9fc705267894e24a5c728c9c24396349f8ecabc8b5c3b
Instruction ID: 85baef12e9963c4e58260822696612c7262fbf54b5bca4a1dcf84919a3246afe
Opcode Fuzzy Hash: cdf610c6932f8f4d37e9fc705267894e24a5c728c9c24396349f8ecabc8b5c3b
Instruction Fuzzy Hash: D1D1F531B042088FCB15DB68C594BAD7BB6EF89324F249166E509EB3A1DB31DD42CB91

Function 00E73F78 Relevance: 6.4, Strings: 5, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 00E73FDA
PH^q, xrefs: 00E740E1
PH^q, xrefs: 00E740F2
LjAp, xrefs: 00E74078
LjAp, xrefs: 00E74088

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 78188d8e72ea4d0863523007cce65846f8d98251a169ca2a1ab0052b85b67f00
Instruction ID: ce543e4547b621caf9cbebabf61330fe5519e3b6abf136c0019e6d6f87c69de9
Opcode Fuzzy Hash: 78188d8e72ea4d0863523007cce65846f8d98251a169ca2a1ab0052b85b67f00
Instruction Fuzzy Hash: 5351A174E01208DFCB48DFA9D99499DBBF2BF89310F249469E819BB364DB349946CF10

Function 05449E73 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05449EF6
GetCurrentThread.KERNEL32 ref: 05449F33
GetCurrentProcess.KERNEL32 ref: 05449F70
GetCurrentThreadId.KERNEL32 ref: 05449FC9

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4d6dd04cf617a6831fbf37f5001d2fa125cdf97a68a517762e185995674b5745
Instruction ID: b65fee9f6f0b34ee57ea1c4cb65c06e0499dcffce466e52a8963f671a8593ea7
Opcode Fuzzy Hash: 4d6dd04cf617a6831fbf37f5001d2fa125cdf97a68a517762e185995674b5745
Instruction Fuzzy Hash: 8C5147B0901209CFEB14DFAAD548BDEBBF1EB88314F20846AE459A7360D734A944CF65

Function 05449E78 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05449EF6
GetCurrentThread.KERNEL32 ref: 05449F33
GetCurrentProcess.KERNEL32 ref: 05449F70
GetCurrentThreadId.KERNEL32 ref: 05449FC9

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c82f250943b1dd68aaa357c053e2adde444e6bf7152c8a26fbe7db194cb970bf
Instruction ID: f94e1f52dd0f46030b3d8262de0d993bd12ed5cf64a04f3cc23555ea3c865e62
Opcode Fuzzy Hash: c82f250943b1dd68aaa357c053e2adde444e6bf7152c8a26fbe7db194cb970bf
Instruction Fuzzy Hash: BC5148B0901209CFEB14DFAAD548BDEBBF1EB88314F208469E459A7364D734A944CF65

Function 00E7AF78 Relevance: 5.2, Strings: 4, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 00E7B206
, xrefs: 00E7B065
Hbq, xrefs: 00E7B1D3
Hbq, xrefs: 00E7B239

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: $Hbq$Hbq$Hbq
API String ID: 0-580995494
Opcode ID: 7d9bab9e73028f1595fc8cb3f711e1f8e95a9d3362c73fa4e8400e04fa019661
Instruction ID: df7c777c94a9ef0ad93a55fa098490fd4e87da8f808ffdebddb2a653a43e73f4
Opcode Fuzzy Hash: 7d9bab9e73028f1595fc8cb3f711e1f8e95a9d3362c73fa4e8400e04fa019661
Instruction Fuzzy Hash: 43719330700148DBDF256F78986876E7AA3EF85365F248229E92AAB3D0DF358D02C755

Function 00E7AF77 Relevance: 5.2, Strings: 4, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 00E7B206
Hbq, xrefs: 00E7B1D3
, xrefs: 00E7B015
Hbq, xrefs: 00E7B239

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: $Hbq$Hbq$Hbq
API String ID: 0-580995494
Opcode ID: 920191617215b0bc95afbea1b8f67c0092969166ad6035b84c1bbdeb2d0f6117
Instruction ID: 590d3d5fad1a5d46adff3a2ed28c620c2358eabcfdad056ea60aa6157b72dfa4
Opcode Fuzzy Hash: 920191617215b0bc95afbea1b8f67c0092969166ad6035b84c1bbdeb2d0f6117
Instruction Fuzzy Hash: C9519330700148DFDB256F78982876E7AA2FFC5365F248529E52AAB3D0DF358D02C755

Function 00E7B869 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

8cq, xrefs: 00E7B941
TJcq, xrefs: 00E7B97A

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 20ee2935dbf4e23f96acdad764008624f356fe717cf3a416d0415a3d9026ac84
Instruction ID: 307d924c61fa2dd716cc697ab86a150712a497445514d49a13b2a860e90c1dd6
Opcode Fuzzy Hash: 20ee2935dbf4e23f96acdad764008624f356fe717cf3a416d0415a3d9026ac84
Instruction Fuzzy Hash: F2313935B001098FCB45DFA8C580E9DBBF2EF88324F155094E505AB365CB70EC85CB91

Function 00E7B89D Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

8cq, xrefs: 00E7B941
TJcq, xrefs: 00E7B97A

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 7d706892945447ae0cc763a21718b9ce50646a0a90766461df131aa8e264a3de
Instruction ID: 9f79f56017f8f9f3875d32f2dca7e40cecd05029fdec7b873951e78542550dd8
Opcode Fuzzy Hash: 7d706892945447ae0cc763a21718b9ce50646a0a90766461df131aa8e264a3de
Instruction Fuzzy Hash: 2E314835B401098FCB45DFA8C580E9DBBB2EF88324F255094E605AB3B5CB70EC85CB91

Function 0544A4C0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0544A54F

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9c5565b0542d37bf7032e674b0a3e42d6253e0e14293581d1ed7e5d63ae516f1
Instruction ID: 1bc43789e7875b7dc322cda567574519a9c8ad657bbd379a4119404d73d59bb3
Opcode Fuzzy Hash: 9c5565b0542d37bf7032e674b0a3e42d6253e0e14293581d1ed7e5d63ae516f1
Instruction Fuzzy Hash: 0521E6B5D002489FDB10CF9AD984ADEBFF5FB48320F14851AE968A7350D378A940CF61

Function 04E610BC Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 04E611FE

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e3af9b3125a0ca07bb15428bc46ef3a0b109a328b7e19328760efc52b039bff
Instruction ID: d8bf5de956074327c1ba16457f2c06d463e314f55d0bdd8aac70238993c7be87
Opcode Fuzzy Hash: 7e3af9b3125a0ca07bb15428bc46ef3a0b109a328b7e19328760efc52b039bff
Instruction Fuzzy Hash: 94116D74E411099FDB05DFA8D884AADFBF5FB88344F14E225E805E7246DB30A941CF20

Function 0544A4C8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0544A54F

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1de7844526c4d8980a0ad154eea1cc7f0775910b5c352a4170be049d909b6c37
Instruction ID: 5f487149822b0cab08a39123d2fa5b11de742c33825091abfc7cddcfc964f4a2
Opcode Fuzzy Hash: 1de7844526c4d8980a0ad154eea1cc7f0775910b5c352a4170be049d909b6c37
Instruction Fuzzy Hash: E921F5B59002489FDB10CF9AD984ADEFFF5FB48310F14801AE958A3310D378A940CFA5

Function 00E7BDE8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00E7BE36

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 8e06720d02853caa92edc1dfe7c5c2d4008677c6ecaa62dedbddf8c1909a58dd
Instruction ID: c74f93791b2f0657983772f8f5695199ce8bab65622eabc451e9e7533846f2bc
Opcode Fuzzy Hash: 8e06720d02853caa92edc1dfe7c5c2d4008677c6ecaa62dedbddf8c1909a58dd
Instruction Fuzzy Hash: 6631C5347041489FC704EF79D995AAE7BB6FF89300B248069E5099B361DF319D06C791

Function 00E7BCE8 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00E7BD2D

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 0c6abcb7923f99397edfa5144a5d01c95a365082e942785cd2c5a10802b959b6
Instruction ID: 0c8836166ea010bdfb5fa50f947c30b9e7faac783e5b6fcfbf04c7ce2508f18a
Opcode Fuzzy Hash: 0c6abcb7923f99397edfa5144a5d01c95a365082e942785cd2c5a10802b959b6
Instruction Fuzzy Hash: 39218E32A041089FCB44EFB8D955AAE7BF6EF88300B10857AE509E7355DF359E12CB91

Function 00E7BF80 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3c39f911b0c82ee46ae05f6820bdc7ab6379fb41cb41394c6120cb6b06ff1e
Instruction ID: 36b34f971d83d7c281cb80ace6e43310c51bbdec390de6a90110763cb0c78d5a
Opcode Fuzzy Hash: af3c39f911b0c82ee46ae05f6820bdc7ab6379fb41cb41394c6120cb6b06ff1e
Instruction Fuzzy Hash: E161D176A012059FCB24CB79D8509AABBFAEBC8324B24D53EE51DE7351D731DC0187A0

Function 00E73168 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07c7f8f836cd17d63e96c1b95e98439d29ea8b9106d605d5c1002d265aea6af
Instruction ID: 332935f6d09e637460542e6707ef02ca00b6f92f1574c3b24b5007da7ab225b0
Opcode Fuzzy Hash: f07c7f8f836cd17d63e96c1b95e98439d29ea8b9106d605d5c1002d265aea6af
Instruction Fuzzy Hash: D741B274E01248DFCB48DFAAD88499DBBF2BF89300F249529E405BB365DB349941CF14

Function 00E79249 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac928349a8b42eea92c95f353ac3a782766c5dc0cb9cffb6dc023f686e706e4
Instruction ID: 6d5b1e46ebed37284f980b59effae2afb9b5b254959d8d5e98e5164831b320ea
Opcode Fuzzy Hash: cac928349a8b42eea92c95f353ac3a782766c5dc0cb9cffb6dc023f686e706e4
Instruction Fuzzy Hash: 0F31D07002264A9FC2202B61F5BC17A7BB5EF8F357784AC42E04E81A169B786D449B60

Function 00E718C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d07956b848d59a37daeddb75b59fed3cfba40b28f41aa572e9d5c921f77e51a
Instruction ID: c941c8559d0fbf25e5697e12e593953bfe2335ef7fcda31e606b962f2f8d56e2
Opcode Fuzzy Hash: 6d07956b848d59a37daeddb75b59fed3cfba40b28f41aa572e9d5c921f77e51a
Instruction Fuzzy Hash: 1D219275A002059FCB14DF28C4509EE37A5EBD9754B20C45DD95EAB240EB34EE07CBD2

Function 00ABD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3018530251.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_abd000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d999bd85cdab18b2a0060bd0ffb6d826eb7f614bd622869a7071c011432cd39c
Instruction ID: 68f5829e348ef664a1424d4239b21ce9af90f68817b2b6f6f12add7ff79a1d27
Opcode Fuzzy Hash: d999bd85cdab18b2a0060bd0ffb6d826eb7f614bd622869a7071c011432cd39c
Instruction Fuzzy Hash: 4721F271504204DFCB14EF14D9C0B66BBA9FB84318F24C669D80A4B297D33BD846CA62

Function 00E70EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82807305a153cb41748a7cf149de8fdf8582d2386006a5f34699ad97969d2c5
Instruction ID: 237a81e9ac11e87226006438fccf99611429cc3d24b19db0d82cf23a9cac72ec
Opcode Fuzzy Hash: d82807305a153cb41748a7cf149de8fdf8582d2386006a5f34699ad97969d2c5
Instruction Fuzzy Hash: 94215E70E05209DFCB09EFB9C4516AEBBB2EB89304F10C5AAD409AB696CB749945CF41

Function 00E717B8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30bfbcb8571b7b29089f576b8019a30ebb52dc7c4a9cd1bf917352b8382ddbae
Instruction ID: 901148034c4a66bc7c477a84a84bd18ad8d36e37c1056f14f7191881aaef594f
Opcode Fuzzy Hash: 30bfbcb8571b7b29089f576b8019a30ebb52dc7c4a9cd1bf917352b8382ddbae
Instruction Fuzzy Hash: 6B212870D0934A8FCB05DFB9D8445EDBFF0AF4A304F1452AAD445B7262EB354A49CBA1

Function 00E7BB48 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc03e3cc55779a6077dd0ad8e5e25bd19088b20616bf5e26613a27acc49c7291
Instruction ID: a5e4c61f314cdf491f1ca931665c4232ef8fffe472745ade4ba4ed1ab1115704
Opcode Fuzzy Hash: cc03e3cc55779a6077dd0ad8e5e25bd19088b20616bf5e26613a27acc49c7291
Instruction Fuzzy Hash: 971136767002048FD714DB69E988B56B7E6EF98725B21846AE64E8B364CB71EC04CB50

Function 00E74850 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 184e0a86ac69364dfd2aa90b2e5b1fcc0432702a81ba538ca8d35b1c024e8836
Instruction ID: 881aeb34b7d33700d82e49dd17ff018ea95a3e5d656085436803495ca238b703
Opcode Fuzzy Hash: 184e0a86ac69364dfd2aa90b2e5b1fcc0432702a81ba538ca8d35b1c024e8836
Instruction Fuzzy Hash: DF012272B042041FEB189BB98808A7E6BE69F88218711857DD809D7394FF35CC028752

Function 00ABD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3018530251.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_abd000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: bcffe5f9777311d7a2709d17bba20207e554963267d49609d5b2de4cef9a51ff
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 6E11BB75504280CFCB11DF14D5C4B55BBA1FB84318F28C6AADC4A4B656C33AD85ACB62

Function 00E74860 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a61c969f77da1c19d80bec140123e7b8ff1a68073712983dc38cdfdd7019c2d
Instruction ID: f098515d8561eac55ff2b734468ca7cb13970520a9f09bed74f26175ba01e30a
Opcode Fuzzy Hash: 7a61c969f77da1c19d80bec140123e7b8ff1a68073712983dc38cdfdd7019c2d
Instruction Fuzzy Hash: 9701A272B002155FE718AB7A8848A2F76EBAFC8628710883DD909D7354FF71CC068792

Function 00E7A4F9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d81333c3c77dec89919068e294555432d8a741118dfd6a959065d8ffa67a47
Instruction ID: 07779312dcc79246b7e899590f4566cae4f918e37d6ee043b1786e658ad1708b
Opcode Fuzzy Hash: 45d81333c3c77dec89919068e294555432d8a741118dfd6a959065d8ffa67a47
Instruction Fuzzy Hash: D201717590021A9FCF24DF69E8549AF7FB5FBC8315B14803AEA59A3341D7349D10CB92

Function 00E7A508 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5025e120b130ff4906fe6dfdd08ef56bf25ad375ce3f8a5c0345f95ec6021ee
Instruction ID: 628d72cc32215f932d3e57945b87d391cc2db2176da178aab171ba8435e3c402
Opcode Fuzzy Hash: e5025e120b130ff4906fe6dfdd08ef56bf25ad375ce3f8a5c0345f95ec6021ee
Instruction Fuzzy Hash: 8B015E75E002199FCF24DFA9E8585AE7FB5FB88750B10843AE91A97341DB349D10CBA1

Function 00E7BB47 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52d043d6cef486ec096b6c32dedb004bbb636e304cee335e5af0a599f46f104
Instruction ID: 7d7926596277accc6ddc8b8238eaa45e5cae6de02af748aba378ec6d64b629a7
Opcode Fuzzy Hash: d52d043d6cef486ec096b6c32dedb004bbb636e304cee335e5af0a599f46f104
Instruction Fuzzy Hash: DE0156317002008FDB24DB2ADA88B66B7E6EF89725F118469E54E8F364CB71EC05CB50

Function 00E7BEF8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7151d4462db02d21cdc019e212989187db2fc58a13ed30ffbbe41c817301d4
Instruction ID: 5cb00d12d09313c16e26b5f6fe07006ae457a8b36e35bb3452392e4425110bcd
Opcode Fuzzy Hash: 0b7151d4462db02d21cdc019e212989187db2fc58a13ed30ffbbe41c817301d4
Instruction Fuzzy Hash: 1D01F9357082485BCB2527756C1C45D7FAAEBC67157144067E50ACB382DA398C029791

Function 00E7B9E9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a008f9ca235975dbe9be3e0bfb125a931034ebc6130202a4b907e2bc51bce45
Instruction ID: 0412f5982e9dc0d3d3e74a07f7b2d905a405d1fb430deaf70d8dd8ce12305138
Opcode Fuzzy Hash: 4a008f9ca235975dbe9be3e0bfb125a931034ebc6130202a4b907e2bc51bce45
Instruction Fuzzy Hash: A6F0F672E011089FCB50DF6DD9855DFBFF5EB98250B004536D509D3205EB30EA068BD1

Function 00E7C1B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf796cde741a67337211ef0e0b317f0e17df5000bf07b4703fe0eaf0fdc2522
Instruction ID: 823ecb5bec96e57856a7e2661a41feb7f95437151102c648dee596fb18a6c7e1
Opcode Fuzzy Hash: abf796cde741a67337211ef0e0b317f0e17df5000bf07b4703fe0eaf0fdc2522
Instruction Fuzzy Hash: F9F0A7327005255BC7259669E41495EB7EDDFC5731714807AF50DEB351DF31DC028790

Function 00E746C9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea796e67e16c18a21c2aa0d00017c9418895402f16451e1e2dc6d9815f2aa831
Instruction ID: 353fbe11ad571f43597ba1a22d46ad4766ec7811b0c336ab826738944c739e22
Opcode Fuzzy Hash: ea796e67e16c18a21c2aa0d00017c9418895402f16451e1e2dc6d9815f2aa831
Instruction Fuzzy Hash: 0FF0DA30819B928FD322ABB4A8AD66A7F71EB0B307B486E45E44A91073CB710406CB11

Function 00E7B9F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f84938a71c21647d96cd83d6ff147585bfc568169ce5c7ee876de35b52a4b90
Instruction ID: d8c85e46779f75dc550394fc70d27d45eeb0c450fa6e0b76d792c85f6023ca3f
Opcode Fuzzy Hash: 2f84938a71c21647d96cd83d6ff147585bfc568169ce5c7ee876de35b52a4b90
Instruction Fuzzy Hash: 4EF08271A00208AF8B50DFAED84099FFBF5FB88350B10453AE509E3211E770AA159BE1

Function 00E746D8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f255f84cee90f8c58f7aca42ce1a6160cdd744d6f0875e0ac85f5468ea9c9e
Instruction ID: e73b08e8eaeeb2baea04c4f8dc4a33c1ec44d3395dac1cbdb870a73a86881c82
Opcode Fuzzy Hash: b8f255f84cee90f8c58f7aca42ce1a6160cdd744d6f0875e0ac85f5468ea9c9e
Instruction Fuzzy Hash: 1AE07630822B028BD261ABB0A8AC76ABB65EB0B313B846F00A00E910729F7104468A14

Function 00E71877 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed392aff1b17778a8e45f6887c89448912effd99e8df5520d6aa5239ec722e4b
Instruction ID: 66b87dbfb931f4121b3c109bd9d516c5ec4c6cfcdc2dc74b5db13c457e0bee74
Opcode Fuzzy Hash: ed392aff1b17778a8e45f6887c89448912effd99e8df5520d6aa5239ec722e4b
Instruction Fuzzy Hash: 28E02031D50327CBCB02EFB19C504DD77745D912207444367C0A877861DB38550FCB62

Function 00E71888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4798250efd236f63c6dc6f0681edc19909ff42fcd22662f801f524b14f2d9e3
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: d4798250efd236f63c6dc6f0681edc19909ff42fcd22662f801f524b14f2d9e3
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 00E7BCD8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e8619ccb173da7d15868eb14e54c3d62d8dd0fe97fbd8302d4bbd01212e8fc
Instruction ID: 668c87fb76e1c89d287060781d5777e20921f415100171d018dd0571d98a33be
Opcode Fuzzy Hash: f2e8619ccb173da7d15868eb14e54c3d62d8dd0fe97fbd8302d4bbd01212e8fc
Instruction Fuzzy Hash: 09D02B2610938DC78A1A7A902806215B7346903606740D2DF984CEE013FA005C1D83D1

Function 00E74831 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b86e02aef638409910a47848e529824e9c8195350e2669a36bc9cfbb7132c18
Instruction ID: 4fbcc66a17f2d1f53b944227f3dd9f01a17b8214680924092e981d015b23e8c2
Opcode Fuzzy Hash: 3b86e02aef638409910a47848e529824e9c8195350e2669a36bc9cfbb7132c18
Instruction Fuzzy Hash: 96C0482440E2C00FCF0787A9486A9A67FB09D1B20AB681ADFC0C29A8A7D509650BE716

Non-executed Functions

Function 054451E8 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5vq, xrefs: 05445303

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: .5vq
API String ID: 0-493797296
Opcode ID: 341675a4fa7339b83214ae2ce8daf07add2e93702d5ca9d2231edd05cc5cfd24
Instruction ID: 3334565a8a28314b5b5ca2196c4b6a28594bb2a38a74ae09e69fce42ae865c14
Opcode Fuzzy Hash: 341675a4fa7339b83214ae2ce8daf07add2e93702d5ca9d2231edd05cc5cfd24
Instruction Fuzzy Hash: 39526C74E01228CFDB64DF69C984BDDBBB2BB89300F1085EAD409AB255DB359E85CF50

Function 04E67CD8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a992a10fde6053f624f75d0adb65bd3fcd5f1bd1ef072276247d061457d01bb3
Instruction ID: 2297ca4bcdb0175c8ec668ab0cf4bdd478fe9624a01cdfff8d1b2cfde76bbc37
Opcode Fuzzy Hash: a992a10fde6053f624f75d0adb65bd3fcd5f1bd1ef072276247d061457d01bb3
Instruction Fuzzy Hash: 77C1E374E01218CFDB14DFA5C994B9DBBB2BF89304F1094AAD409AB364DB35AE85CF50

Function 04E6F8B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c857005dddaa6e01f24971a230a2f24627695292d950e67b484dc583922ba96d
Instruction ID: ae29818250f7ee37b490c17be9ebe21e82ca9d96fde4f5cf9b8221814fbc2f51
Opcode Fuzzy Hash: c857005dddaa6e01f24971a230a2f24627695292d950e67b484dc583922ba96d
Instruction Fuzzy Hash: 61C1D474E01218CFDB14DFA5C994B9DBBB2BF88304F1090AAD409AB365DB356E85CF50

Function 04E67880 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c1c82988a6f0a93bf1d2336610ce2e6e2f83ed83028af81fdc46a0782ba674
Instruction ID: 92b84229001795118a099ce44e02ccd4c634aa198fd06f5a2c311235844f6198
Opcode Fuzzy Hash: 16c1c82988a6f0a93bf1d2336610ce2e6e2f83ed83028af81fdc46a0782ba674
Instruction Fuzzy Hash: AAC1D374E01218CFDB14DFA5C994B9DBBB2BF88304F2090A9D409AB365DB35AE85CF50

Function 04E6F458 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64584aeccf8730ffa96fc4306665a332eeeb311a410b3204c0afd6aa79d018f2
Instruction ID: 795fe625b5c6d599aa82042b59e59e3ea6678652bde2df066b7899fa1fdbfe84
Opcode Fuzzy Hash: 64584aeccf8730ffa96fc4306665a332eeeb311a410b3204c0afd6aa79d018f2
Instruction Fuzzy Hash: C4C1D374E01218CFDB14DFA5D994B9DBBB2BF88304F1090AAD409AB365DB35AE85CF50

Function 04E67428 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e456c605a703c733db03f025d2300c3e812ed8097f2e2ab5ab5c73210eb6d8db
Instruction ID: f2a22e29642cc701f2a30d71ab6ea3cf245a2f5eed600cbbb367a60183853348
Opcode Fuzzy Hash: e456c605a703c733db03f025d2300c3e812ed8097f2e2ab5ab5c73210eb6d8db
Instruction Fuzzy Hash: E3C1C374E01218CFDB14DFA5C994B9DBBB2BF88304F1094AAD409AB365DB35AE85CF50

Function 04E6F000 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fccf277ee3c0cea9b8e54f7794033bbfe81d73cf1c4e5f8424c8d705cf2948c1
Instruction ID: 2855fb2734840b2f0bfb4959703c87bfca2fb0190259e78d439d62aa9cd726e6
Opcode Fuzzy Hash: fccf277ee3c0cea9b8e54f7794033bbfe81d73cf1c4e5f8424c8d705cf2948c1
Instruction Fuzzy Hash: 80C1E474E01218CFDB14DFA5D994B9DBBB2BF88304F1090AAD409AB364DB35AE85CF50

Function 04E64DD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c1ab1c2fa5ff901a43ba6546fe562302a988d5a8db538d8a59b082d47f30d7
Instruction ID: abf8409694e9f7a8464ca5838d06ad0b3f169630f5c37a497c84a5462c5239ff
Opcode Fuzzy Hash: 85c1ab1c2fa5ff901a43ba6546fe562302a988d5a8db538d8a59b082d47f30d7
Instruction Fuzzy Hash: 9BC1D474E01218CFDB14DFA5D994B9DBBB2BF88304F1094A9D809AB364DB35AE85CF50

Function 04E68588 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79400ec74156f7d146b5165af8e220cd5e3f0d4da3d847c032a95ad874e28ea
Instruction ID: c78c4716928d48a3df59736a91331150bf561825e3d95e9d0f12f2eda80dbfa1
Opcode Fuzzy Hash: d79400ec74156f7d146b5165af8e220cd5e3f0d4da3d847c032a95ad874e28ea
Instruction Fuzzy Hash: F6C1C274E01218CFDB14DFA5C994B9DBBB2BF88304F1094AAD409AB364DB35AE85CF50

Function 04E64978 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421d6beb633e6908beedf535328e7d852887ba22c6dff02005e64a2d67cb35af
Instruction ID: bf8c0c5228095ecdf23b632a73d0caef12b18914a3cdfa66734ba3b8edbb6ef2
Opcode Fuzzy Hash: 421d6beb633e6908beedf535328e7d852887ba22c6dff02005e64a2d67cb35af
Instruction Fuzzy Hash: 4EC1C474E01218CFDB14DFA5C994B9DBBB2BF88304F1094A9D409AB3A5DB35AE85CF50

Function 04E64520 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d5a37321919e0bd2b953167d611b0964f8783b34a0e6b81ea621cf382b0a82
Instruction ID: 15adecc139851ff0e9b5151efd4099e85bde380651638e77c205a2e753de77cf
Opcode Fuzzy Hash: 76d5a37321919e0bd2b953167d611b0964f8783b34a0e6b81ea621cf382b0a82
Instruction Fuzzy Hash: 1BC1C474E01218CFDB14DFA5C994B9DBBB2BF89304F1094A9D809AB3A5DB356E85CF10

Function 04E68130 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcfadc3709de06850a03a76a7630d72247353ff3db1ca9adb9c48cc54376aaf
Instruction ID: 5ff72f7decc89337915d0f0bbb06621728d5bdcbfd6800ea3c252679f3373c25
Opcode Fuzzy Hash: afcfadc3709de06850a03a76a7630d72247353ff3db1ca9adb9c48cc54376aaf
Instruction Fuzzy Hash: 0FC1E374E01218CFDB14DFA5C994B9DBBB2BF89304F1090AAD409AB364DB35AE85CF10

Function 04E6E2F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed4c06e6f4e4a0c459c4ed557ca33047e2edbb1989fcf84ee3443b2e596cb7a
Instruction ID: 413d707090419288195d81f9883772bef6ff0296846aa1723b4f476eafba8167
Opcode Fuzzy Hash: 5ed4c06e6f4e4a0c459c4ed557ca33047e2edbb1989fcf84ee3443b2e596cb7a
Instruction Fuzzy Hash: 57C1C574E01218CFDB14DFA9C954B9DBBB2BF88304F1094AAD409AB395DB356D85CF50

Function 04E65680 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c9e12cf32ec93a66b0ddc25342f432ccac380623ec4590153642b125e2f481
Instruction ID: dbd64839dbe5d8681d4742ea815dbadbb7c1359cef47a4e916253b11842c1464
Opcode Fuzzy Hash: 43c9e12cf32ec93a66b0ddc25342f432ccac380623ec4590153642b125e2f481
Instruction Fuzzy Hash: 49C1C474E01218CFDB14DFA5D994B9DBBB2BF88304F1094A9D809AB355DB35AE85CF10

Function 04E65228 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c963b3c24f44926e524486e388f1797fc6966d2e367e5849d6dbfc9b0d2112
Instruction ID: 96d227bb067de6662708714d71fd05e93997226b39d8595cde38a9b5f7aeb6f0
Opcode Fuzzy Hash: 93c963b3c24f44926e524486e388f1797fc6966d2e367e5849d6dbfc9b0d2112
Instruction Fuzzy Hash: 92C1D374E01218CFDB14DFA5D994B9DBBB2BF88304F1094A9D809AB365DB35AE85CF10

Function 04E66FD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c559c5e9b264601712766da25948e45458e3893d3f498abab91daf055f8f9b34
Instruction ID: 4f1a2f23cbbde4e422ce1f6bea7de3a05e69299ed659e70123c4049f9b50d1e3
Opcode Fuzzy Hash: c559c5e9b264601712766da25948e45458e3893d3f498abab91daf055f8f9b34
Instruction Fuzzy Hash: 01C1D374E01218CFDB14DFA5C994B9DBBB2BF88304F1090A9D809AB365DB35AE85CF50

Function 04E6EBA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e324f3409bcc42ecb206e7f57a71022f398668c1d421fe5f1e88505cb2dfc029
Instruction ID: 7f36297c5274c4478b7f1aca0d413d7d5d49ab8087a2b01ff3bb9404a1bf25ae
Opcode Fuzzy Hash: e324f3409bcc42ecb206e7f57a71022f398668c1d421fe5f1e88505cb2dfc029
Instruction Fuzzy Hash: 3BC1D574E01218CFDB14DFA9C954B9DBBB2BF88304F1090AAD409AB395DB356E85CF50

Function 04E6E750 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022280678.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e60000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa4d139347724ae6d336d2e8b824c62f7951b992c32fdeec4f2d3b5f302cf54
Instruction ID: 90316577cc65a37c7361677710dfc7e90b682ea1848ff8dafa9e92060b52567f
Opcode Fuzzy Hash: 1aa4d139347724ae6d336d2e8b824c62f7951b992c32fdeec4f2d3b5f302cf54
Instruction Fuzzy Hash: 54C1D574E01218CFDB54DFA9C994B9DBBB2BF88304F1090A9D409AB395DB356D85CF50

Function 054415F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f9d98ab7fb3c7946094f37f8826ab85776607bb5edd217e3c0094934737bb77
Instruction ID: cafd1f34d2033195b6696de05cfd30eef731ed20c495afc2ef0c1729b822b4e8
Opcode Fuzzy Hash: 3f9d98ab7fb3c7946094f37f8826ab85776607bb5edd217e3c0094934737bb77
Instruction Fuzzy Hash: 8BC1B174E01218CFEB14DFA5C994B9DBBB2BF89304F1090AAD409AB365DB359E85CF50

Function 05443598 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52b0096ce981a6057ef839d4be1ab293b46c130a79ebb30b8788594cbccf639
Instruction ID: 3e50d6b61a2c5fe5593d75463484c61f2ac078fe39c4138569eb2232bcfd71e0
Opcode Fuzzy Hash: d52b0096ce981a6057ef839d4be1ab293b46c130a79ebb30b8788594cbccf639
Instruction Fuzzy Hash: F2C1C474E01218CFEB14DFA5C994B9DBBB2BF89304F1084AAD409AB365DB359E85CF50

Function 05442438 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7fd51034346a3bf9f88cac8c21d7d1f2dde79027253a9ba361519e2a925cb5
Instruction ID: 145402476a9dc2271ba986a6093c2c08fce2ed061c2d8c2ccf6c3ce186b1c525
Opcode Fuzzy Hash: dd7fd51034346a3bf9f88cac8c21d7d1f2dde79027253a9ba361519e2a925cb5
Instruction Fuzzy Hash: 66C1D274E05218CFEB14DFA5C994B9DBBB2BF88304F1084AAD409AB364DB359E85CF50

Function 05440498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca5c7df4c5d72d24a69f24c22b69a67f6ae4bc16865e09460faa764c387573d2
Instruction ID: 597be397c99ef05ca0f11879054d08740a597d008881867ff7247d45d57a7390
Opcode Fuzzy Hash: ca5c7df4c5d72d24a69f24c22b69a67f6ae4bc16865e09460faa764c387573d2
Instruction Fuzzy Hash: 9CC1C374E01218CFEB14DFA5C994B9DBBB2BF89304F1084AAD409AB365DB359E85CF50

Function 054446F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738bed54faa7610ade13d73411f40b3f13d4cdac5f4ea0da63c34513621164d7
Instruction ID: 17a75393b075fea91f1f8da573a17e81b5833c00c141f25519a04d24aab43375
Opcode Fuzzy Hash: 738bed54faa7610ade13d73411f40b3f13d4cdac5f4ea0da63c34513621164d7
Instruction Fuzzy Hash: 11C1B174E01218CFEB54DFA5C994B9DBBB2BF89304F1080AAD409AB365DB359E85CF50

Function 05443140 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d8ec9dd14ae8f16f47092ad45d366cc865fe79ca542bb0a27f44fca6f860a4
Instruction ID: 102fea4193ded83014dc738b2e17beebf549588af76447b5fc8eca227fbc5e51
Opcode Fuzzy Hash: 97d8ec9dd14ae8f16f47092ad45d366cc865fe79ca542bb0a27f44fca6f860a4
Instruction Fuzzy Hash: 1FC1B374E01218CFEB14DFA5C994B9DBBB2BF89304F1084AAD409AB365DB359E85CF50

Function 054411A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c88121cd6265e3bb56dc7671604e35fa4120995af21dc63ae13dd05c40edde
Instruction ID: 094be596989b01e2845bc7aff1ad99c1e3cf4f399eb71d26056056181839dfc1
Opcode Fuzzy Hash: b7c88121cd6265e3bb56dc7671604e35fa4120995af21dc63ae13dd05c40edde
Instruction Fuzzy Hash: C7C1B374E01218CFEB14DFA5C994B9DBBB2BF89304F1090AAD409AB365DB359E85CF50

Function 05440040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f81ad817626926d8e0eafdf134fb2c858ef1be647493b25cc25d8cf04a215c
Instruction ID: ec5ff73ed7d9b3f4e747e0602fd29ce8fab2558d867230e4d99503ceaf5e2307
Opcode Fuzzy Hash: 65f81ad817626926d8e0eafdf134fb2c858ef1be647493b25cc25d8cf04a215c
Instruction Fuzzy Hash: FAC1C374E01218CFEB54DFA5C994B9DBBB2BF89304F1080AAD409AB365DB359E85CF50

Function 054442A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27bbadf455f14bf4ccac902c8f0f90fccadf2be9ffa698fef5eeabb6975557fc
Instruction ID: ab06d0eb2a8221261f20f5ebe1202a95cd2d198cc36b9ce49f08942ac32441dc
Opcode Fuzzy Hash: 27bbadf455f14bf4ccac902c8f0f90fccadf2be9ffa698fef5eeabb6975557fc
Instruction Fuzzy Hash: A8C1B374E01218CFEB14DFA5C994B9DBBB2BF89304F2080AAD409AB365DB355E85CF50

Function 05440D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f57f57535dbb7bc9dc9f3ce2fd6b7c2cf88429f4fe20e389f7bafd612da9421f
Instruction ID: 98cb9badeaee98409d619ed5c17971047a3dc5998ce13701139163c3572945cc
Opcode Fuzzy Hash: f57f57535dbb7bc9dc9f3ce2fd6b7c2cf88429f4fe20e389f7bafd612da9421f
Instruction Fuzzy Hash: 6FC1D374E01218CFEB14DFA5C994B9DBBB2BF88304F1094AAD409AB365DB359E85CF50

Function 05442CE8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6712503b789eb631af0e8340865b36919b92da7e00c9105c1a5cd6c7cec61056
Instruction ID: d7b01bff80aa33971a654c2d51a7743f5615c633366112236456afd703baed7f
Opcode Fuzzy Hash: 6712503b789eb631af0e8340865b36919b92da7e00c9105c1a5cd6c7cec61056
Instruction Fuzzy Hash: ECC1C474E01218CFDB14DFA5C954B9DBBB2BF89304F1084AAD409AB365DB355E85CF50

Function 05443E48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40171d4300680275c57afff55133f49dadf84f11c507bf4c818c7aa8e1f50212
Instruction ID: 30d8ebf4f6dec949ca6e0e52bd550eda08684e1a2febae70a57af0d16971eb72
Opcode Fuzzy Hash: 40171d4300680275c57afff55133f49dadf84f11c507bf4c818c7aa8e1f50212
Instruction Fuzzy Hash: 14C1C374E01218CFEB14DFA5C994B9DBBB2BF89304F1084AAD409AB365DB359E85CF50

Function 05441EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1393aac3762f7254d515c20e279a52f78fa7d466183a058abaeb8cbe03ca8c56
Instruction ID: d8f5e57fd25255cee918edbe8caa83accf3f976ef1548930df510950e06e60f0
Opcode Fuzzy Hash: 1393aac3762f7254d515c20e279a52f78fa7d466183a058abaeb8cbe03ca8c56
Instruction Fuzzy Hash: 14C1C374E05218CFDB14DFA5C994B9DBBB2BF89304F1080AAD409AB364DB359E85CF50

Function 054439F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c6576887f35971453d44352f41a5b6bc6c95d4edfba15befdcdcc96b660b6d
Instruction ID: 49d607f552e768d81db4fda5a21f337f55cad2e27fcb8a83e26e15019a7db969
Opcode Fuzzy Hash: 39c6576887f35971453d44352f41a5b6bc6c95d4edfba15befdcdcc96b660b6d
Instruction Fuzzy Hash: F5C1B374E01218CFDB14DFA5C994B9DBBB2BF89304F2084AAD409AB355DB359E85CF50

Function 054408F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbab612c936c01d2e238d3dc5b76362b5e7031b918d65f70202b2e8065e7b9dc
Instruction ID: 2b42ca8866095ad3a18a33a56068560997675d09af7093935baf891dcadfb67d
Opcode Fuzzy Hash: dbab612c936c01d2e238d3dc5b76362b5e7031b918d65f70202b2e8065e7b9dc
Instruction Fuzzy Hash: E8C1B474E01218CFEB14DFA5C994B9DBBB2BF89304F1080AAD809AB355DB355E85CF50

Function 05442890 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07862400cd3dfbb9f2f3a30946bf21c5d0aa4c8e8b58413bc9036f0f3cb6e40
Instruction ID: 7cfefaa6b1066e7a82aa615beee2ba722283751c2dcce5dd639918d2d12e968b
Opcode Fuzzy Hash: f07862400cd3dfbb9f2f3a30946bf21c5d0aa4c8e8b58413bc9036f0f3cb6e40
Instruction Fuzzy Hash: 54C1C374E05218CFEB14DFA5C994B9DBBB2BF88304F1080AAD409AB365DB355E85CF50

Function 05444B50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c2d8b140607624607f371f75046735162817a4951104389d964dc543da5a56
Instruction ID: 9a8aa1d343d78a4e80701587671d3064f6d9927441866f8620b916853932ab8a
Opcode Fuzzy Hash: 04c2d8b140607624607f371f75046735162817a4951104389d964dc543da5a56
Instruction Fuzzy Hash: 1FC1B274E01218CFEB14DFA5C994B9DBBB2BF89304F1080AAD409AB365DB359E85CF50

Function 05441A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3ae0dc9bfee96acbe7183872fabd9b9a7fa0dcf8afe6e940aca16432b2f7d3
Instruction ID: 2a337d5b285a1be7dcd0d86721c9b7d847246dee58b79ae82fedc399f420dbc0
Opcode Fuzzy Hash: cf3ae0dc9bfee96acbe7183872fabd9b9a7fa0dcf8afe6e940aca16432b2f7d3
Instruction Fuzzy Hash: F6C1B474E01218CFDB14DFA5C994B9DBBB2BF89304F2090AAD409AB365DB359E85CF50

Function 05449120 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3022690771.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5440000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aae39d9c5a75e8f3971df778f56d1ca60becf3b6c63a65f9571e231ed328fce
Instruction ID: 3621a191333bb8f56e6a7a8ed39ce46c07618ed3e76b3e30bbd7b1a4f88ae104
Opcode Fuzzy Hash: 5aae39d9c5a75e8f3971df778f56d1ca60becf3b6c63a65f9571e231ed328fce
Instruction Fuzzy Hash: CA017C70C1A2009FDB00EFB0E89C7DE7F70EB0A312F445A9AE405971B2D7740645DB40

Function 00E71A40 Relevance: 5.1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

Strings

Xbq, xrefs: 00E71B2F
Xbq, xrefs: 00E71AB0
Xbq, xrefs: 00E71B7C
Xbq, xrefs: 00E71A76

Memory Dump Source

Source File: 00000004.00000002.3019384819.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e70000_3qr7JBuNuX.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: ca8b7bd5f0e6008775495d6273ee96ff3b85f847e3f66ae6b364b6d17e7b5d97
Instruction ID: 4196be57673498605b0554c624daaa8e8923582e3daf334cb3e28d24f57e11e7
Opcode Fuzzy Hash: ca8b7bd5f0e6008775495d6273ee96ff3b85f847e3f66ae6b364b6d17e7b5d97
Instruction Fuzzy Hash: BC318530E043198BDF64CB6D85403AEB7B6AB94310F1491B9C44DB7255DB30CD81CB92

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3qr7JBuNuX.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3qr7JBuNuX.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_clusd3tj.va0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ij1gnqe4.eor.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kucgoymk.3xr.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s0l1tyyn.d2e.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
3qr7JBuNuX.exe

Function 0A06A53C Relevance: 6.9, Strings: 5, Instructions: 623
COMMON

Function 0A052BE0 Relevance: 4.1, Strings: 3, Instructions: 330
COMMON

Function 0A052C10 Relevance: 4.1, Strings: 3, Instructions: 329
COMMON

Function 0A052CF8 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Function 0A050AF2 Relevance: 4.0, Strings: 3, Instructions: 254
COMMON

Function 0A050B90 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Function 0A059588 Relevance: 2.7, Strings: 2, Instructions: 232
COMMON

Function 018C08B3 Relevance: 2.7, Strings: 2, Instructions: 204
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre