Edit tour

Windows Analysis Report
CrPH91TEUL.exe

Overview

General Information

Sample name:	CrPH91TEUL.exe renamed because original name is a hash value
Original sample name:	45e062359599639b25a55a72b065eb1d.exe
Analysis ID:	1520413
MD5:	45e062359599639b25a55a72b065eb1d
SHA1:	b6abe73afd5c112110101507621c70168a3c592d
SHA256:	5f9ddfde6dd2fa75189fa015b5c91017ff21951a833140e07907eddafacf757f
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Yara detected DCRat

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Creates processes via WMI

Drops PE files with benign system names

Drops executable to a common third party application directory

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: New Custom Shim Database Created

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

CrPH91TEUL.exe (PID: 1796 cmdline: "C:\Users\user\Desktop\CrPH91TEUL.exe" MD5: 45E062359599639B25A55A72B065EB1D)

schtasks.exe (PID: 2344 cmdline: schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3276 cmdline: schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2464 cmdline: schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4152 cmdline: schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\java\XnhYPNWiKV.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3700 cmdline: schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Program Files (x86)\java\XnhYPNWiKV.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3984 cmdline: schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\java\XnhYPNWiKV.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3324 cmdline: schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\windows nt\TableTextService\en-US\XnhYPNWiKV.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3712 cmdline: schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Program Files (x86)\windows nt\TableTextService\en-US\XnhYPNWiKV.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4132 cmdline: schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\windows nt\TableTextService\en-US\XnhYPNWiKV.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7104 cmdline: schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 14 /tr "'C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3776 cmdline: schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 828 cmdline: schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 11 /tr "'C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6712 cmdline: schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\SendTo\XnhYPNWiKV.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6832 cmdline: schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Users\Default User\SendTo\XnhYPNWiKV.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5080 cmdline: schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\SendTo\XnhYPNWiKV.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6080 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4468 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5512 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4136 cmdline: schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 14 /tr "'C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2848 cmdline: schtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3648 cmdline: schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 8 /tr "'C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3900 cmdline: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\ELAMBKUP\csrss.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6368 cmdline: schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ELAMBKUP\csrss.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 752 cmdline: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\ELAMBKUP\csrss.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4452 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4648 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4568 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4124 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2288 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2512 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2828 cmdline: schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3340 cmdline: schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5528 cmdline: schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3796 cmdline: schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 10 /tr "'C:\Recovery\XnhYPNWiKV.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

WmiPrvSE.exe (PID: 4832 cmdline: C:\Users\Default\SendTo\WmiPrvSE.exe MD5: 45E062359599639B25A55A72B065EB1D)

WmiPrvSE.exe (PID: 5828 cmdline: C:\Users\Default\SendTo\WmiPrvSE.exe MD5: 45E062359599639B25A55A72B065EB1D)

XnhYPNWiKV.exe (PID: 4032 cmdline: "C:\Users\Default User\SendTo\XnhYPNWiKV.exe" MD5: 45E062359599639B25A55A72B065EB1D)

XnhYPNWiKV.exe (PID: 3580 cmdline: "C:\Users\Default User\SendTo\XnhYPNWiKV.exe" MD5: 45E062359599639B25A55A72B065EB1D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"4\":\"#\",\"C\":\"~\",\"2\":\"$\",\"k\":\"%\",\"d\":\";\",\"W\":\"@\",\"L\":\",\",\"9\":\"&\",\"h\":\">\",\"z\":\"-\",\"J\":\" \",\"c\":\"^\",\"y\":\".\",\"M\":\")\",\"5\":\"|\",\"I\":\"`\",\"A\":\"<\",\"3\":\"!\",\"N\":\"_\",\"o\":\"*\",\"i\":\"(\"}", "PCRT": "{\"S\":\">\",\"=\":\" \",\"w\":\";\",\"0\":\"!\",\"p\":\")\",\"x\":\"$\",\"I\":\"`\",\"6\":\"&\",\"c\":\"*\",\"f\":\"<\",\"M\":\"@\",\"i\":\"^\",\"Q\":\"_\",\"b\":\",\",\"D\":\"%\",\"X\":\"|\",\"l\":\".\",\"y\":\"(\",\"j\":\"~\",\"e\":\"#\"}", "TAG": "", "MUTEX": "DCR_MUTEX-jQCghvWiTi3SGbAR22Pl", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000018.00000002.1545389131.00000000027E2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000013.00000002.1550031376.0000000002318000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000011.00000002.1545333587.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000016.00000002.1555847675.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1476064693.0000000003012000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000016.00000002.1555847675.00000000028A5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000018.00000002.1545389131.0000000002791000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1476064693.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000011.00000002.1545333587.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000013.00000002.1550031376.00000000022D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: CrPH91TEUL.exe PID: 1796	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: WmiPrvSE.exe PID: 4832	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: WmiPrvSE.exe PID: 5828	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: XnhYPNWiKV.exe PID: 4032	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: XnhYPNWiKV.exe PID: 3580	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Default\SendTo\WmiPrvSE.exe, CommandLine: C:\Users\Default\SendTo\WmiPrvSE.exe, CommandLine|base64offset|contains: , Image: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe, NewProcessName: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe, OriginalFileName: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Users\Default\SendTo\WmiPrvSE.exe, ProcessId: 4832, ProcessName: WmiPrvSE.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\CrPH91TEUL.exe, ProcessId: 1796, TargetFilename: C:\Users\Default\SendTo\WmiPrvSE.exe

Sigma detected: New Custom Shim Database Created

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\CrPH91TEUL.exe, ProcessId: 1796, TargetFilename: C:\Windows\apppatch\CustomSDB\XnhYPNWiKV.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f, CommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\CrPH91TEUL.exe", ParentImage: C:\Users\user\Desktop\CrPH91TEUL.exe, ParentProcessId: 1796, ParentProcessName: CrPH91TEUL.exe, ProcessCommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f, ProcessId: 6080, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: CrPH91TEUL.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\zJkDGXNxvq.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Windows\AppReadiness\fontdrvhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Windows\ELAMBKUP\csrss.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\MSBuild\Microsoft\System.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984

Found malware configuration

Source: 00000018.00000002.1545389131.0000000002791000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"4\":\"#\",\"C\":\"~\",\"2\":\"$\",\"k\":\"%\",\"d\":\";\",\"W\":\"@\",\"L\":\",\",\"9\":\"&\",\"h\":\">\",\"z\":\"-\",\"J\":\" \",\"c\":\"^\",\"y\":\".\",\"M\":\")\",\"5\":\"|\",\"I\":\"`\",\"A\":\"<\",\"3\":\"!\",\"N\":\"_\",\"o\":\"*\",\"i\":\"(\"}", "PCRT": "{\"S\":\">\",\"=\":\" \",\"w\":\";\",\"0\":\"!\",\"p\":\")\",\"x\":\"$\",\"I\":\"`\",\"6\":\"&\",\"c\":\"*\",\"f\":\"<\",\"M\":\"@\",\"i\":\"^\",\"Q\":\"_\",\"b\":\",\",\"D\":\"%\",\"X\":\"|\",\"l\":\".\",\"y\":\"(\",\"j\":\"~\",\"e\":\"#\"}", "TAG": "", "MUTEX": "DCR_MUTEX-jQCghvWiTi3SGbAR22Pl", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files (x86)\Windows Defender\en-GB\XnhYPNWiKV.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\XnhYPNWiKV.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files\MSBuild\Microsoft\System.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe	ReversingLabs: Detection: 84%
Source: C:\Recovery\RuntimeBroker.exe	ReversingLabs: Detection: 84%
Source: C:\Recovery\XnhYPNWiKV.exe	ReversingLabs: Detection: 84%
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	ReversingLabs: Detection: 84%
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	ReversingLabs: Detection: 84%
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\AppReadiness\fontdrvhost.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\ELAMBKUP\csrss.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\IME\XnhYPNWiKV.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\ModemLogs\dasHost.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\apppatch\CustomSDB\XnhYPNWiKV.exe	ReversingLabs: Detection: 84%

Multi AV Scanner detection for submitted file

Source: CrPH91TEUL.exe

ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Joe Sandbox ML: detected
Source: C:\Windows\AppReadiness\fontdrvhost.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Windows\ELAMBKUP\csrss.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Joe Sandbox ML: detected
Source: C:\Program Files\MSBuild\Microsoft\System.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: CrPH91TEUL.exe

Joe Sandbox ML: detected

Source: CrPH91TEUL.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\9e8d7a4ca61bd9	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\d792c5fedef0ed	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\MSBuild\Microsoft\System.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\MSBuild\Microsoft\27d1bcfc3c54e0	Jump to behavior

Source: CrPH91TEUL.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: CrPH91TEUL.exe, 00000000.00000002.1476064693.0000000003036000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\GameBarPresenceWriter\d792c5fedef0ed	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ImmersiveControlPanel\6dd19aba3e2428	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ELAMBKUP\csrss.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ELAMBKUP\csrss.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ELAMBKUP\886983d96e3d3e	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\IME\XnhYPNWiKV.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\IME\XnhYPNWiKV.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\IME\d792c5fedef0ed	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\AppReadiness\fontdrvhost.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\AppReadiness\fontdrvhost.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\AppReadiness\5b884080fd4f94	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\apppatch\CustomSDB\XnhYPNWiKV.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\apppatch\CustomSDB\XnhYPNWiKV.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\apppatch\CustomSDB\d792c5fedef0ed	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ModemLogs\dasHost.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ModemLogs\dasHost.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ModemLogs\21b1a557fd31cc	Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Code function: 0_2_00007FFB4B39CBE8	0_2_00007FFB4B39CBE8
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Code function: 0_2_00007FFB4B39C3E0	0_2_00007FFB4B39C3E0
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Code function: 0_2_00007FFB4B39CB28	0_2_00007FFB4B39CB28
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Code function: 0_2_00007FFB4B3AA5D0	0_2_00007FFB4B3AA5D0
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Code function: 0_2_00007FFB4B39A63D	0_2_00007FFB4B39A63D
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Code function: 0_2_00007FFB4B392CF8	0_2_00007FFB4B392CF8
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Code function: 0_2_00007FFB4B392C10	0_2_00007FFB4B392C10
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Code function: 0_2_00007FFB4B39AB2D	0_2_00007FFB4B39AB2D
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Code function: 0_2_00007FFB4B3A21A0	0_2_00007FFB4B3A21A0
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Code function: 0_2_00007FFB4B392C10	0_2_00007FFB4B392C10
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 22_2_00007FFB4B36CBE8	22_2_00007FFB4B36CBE8
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 22_2_00007FFB4B36A63D	22_2_00007FFB4B36A63D
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 22_2_00007FFB4B3634A0	22_2_00007FFB4B3634A0
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 22_2_00007FFB4B362CF8	22_2_00007FFB4B362CF8
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 22_2_00007FFB4B362C10	22_2_00007FFB4B362C10
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 22_2_00007FFB4B36AB2D	22_2_00007FFB4B36AB2D
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 22_2_00007FFB4B3721A0	22_2_00007FFB4B3721A0
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 22_2_00007FFB4B36E120	22_2_00007FFB4B36E120
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 22_2_00007FFB4B362C10	22_2_00007FFB4B362C10
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 24_2_00007FFB4B37A63D	24_2_00007FFB4B37A63D
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 24_2_00007FFB4B3734A0	24_2_00007FFB4B3734A0
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 24_2_00007FFB4B372CF8	24_2_00007FFB4B372CF8
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 24_2_00007FFB4B372C10	24_2_00007FFB4B372C10
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 24_2_00007FFB4B37AB2D	24_2_00007FFB4B37AB2D
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 24_2_00007FFB4B37E120	24_2_00007FFB4B37E120
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Code function: 24_2_00007FFB4B372C10	24_2_00007FFB4B372C10

Source: CrPH91TEUL.exe	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: XnhYPNWiKV.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: fontdrvhost.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: XnhYPNWiKV.exe0.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: System.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: CrPH91TEUL.exe, 00000000.00000002.1479770076.000000001C085000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs CrPH91TEUL.exe
Source: CrPH91TEUL.exe, 00000000.00000000.1421537402.0000000000692000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs CrPH91TEUL.exe
Source: CrPH91TEUL.exe	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs CrPH91TEUL.exe

Source: CrPH91TEUL.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: CrPH91TEUL.exe, ocxQTwsRFiPFttlQHZb.cs	Cryptographic APIs: 'TransformBlock'
Source: CrPH91TEUL.exe, ocxQTwsRFiPFttlQHZb.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: CrPH91TEUL.exe, GdYMTMSyrIkZ7hKZmrR.cs	Cryptographic APIs: 'CreateDecryptor'
Source: CrPH91TEUL.exe, GdYMTMSyrIkZ7hKZmrR.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@40/62@0/0

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

File created: C:\Program Files (x86)\java\XnhYPNWiKV.exe

Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

File created: C:\Users\Default\SendTo\WmiPrvSE.exe

Jump to behavior

Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\35dc8ddfb2f8a727972e920ec0971d70f6a5edef

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

File created: C:\Users\user\AppData\Local\Temp\0Wk4yLAJYy

Jump to behavior

Source: CrPH91TEUL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: CrPH91TEUL.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: CrPH91TEUL.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

File read: C:\Users\user\Desktop\CrPH91TEUL.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CrPH91TEUL.exe "C:\Users\user\Desktop\CrPH91TEUL.exe"
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\java\XnhYPNWiKV.exe'" /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Program Files (x86)\java\XnhYPNWiKV.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\java\XnhYPNWiKV.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\windows nt\TableTextService\en-US\XnhYPNWiKV.exe'" /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Program Files (x86)\windows nt\TableTextService\en-US\XnhYPNWiKV.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\windows nt\TableTextService\en-US\XnhYPNWiKV.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 14 /tr "'C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe'" /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 11 /tr "'C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\SendTo\XnhYPNWiKV.exe'" /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Users\Default User\SendTo\XnhYPNWiKV.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\SendTo\XnhYPNWiKV.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe C:\Users\Default\SendTo\WmiPrvSE.exe
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f
Source: unknown	Process created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe C:\Users\Default\SendTo\WmiPrvSE.exe
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe "C:\Users\Default User\SendTo\XnhYPNWiKV.exe"
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 14 /tr "'C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe'" /f
Source: unknown	Process created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe "C:\Users\Default User\SendTo\XnhYPNWiKV.exe"
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 8 /tr "'C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\ELAMBKUP\csrss.exe'" /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ELAMBKUP\csrss.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\ELAMBKUP\csrss.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe'" /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'" /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe'" /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 10 /tr "'C:\Recovery\XnhYPNWiKV.exe'" /f
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\9e8d7a4ca61bd9	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\d792c5fedef0ed	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\MSBuild\Microsoft\System.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Directory created: C:\Program Files\MSBuild\Microsoft\27d1bcfc3c54e0	Jump to behavior

Source: CrPH91TEUL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: CrPH91TEUL.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: CrPH91TEUL.exe, GdYMTMSyrIkZ7hKZmrR.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: CrPH91TEUL.exe, pFn89UBnvfIdIG7hRIx.cs	.Net Code: Rb39cWcIc8 System.AppDomain.Load(byte[])
Source: CrPH91TEUL.exe, pFn89UBnvfIdIG7hRIx.cs	.Net Code: Rb39cWcIc8 System.Reflection.Assembly.Load(byte[])
Source: CrPH91TEUL.exe, pFn89UBnvfIdIG7hRIx.cs	.Net Code: Rb39cWcIc8

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

Code function: 0_2_00007FFB4B3900BD pushad ; iretd

0_2_00007FFB4B3900C1

Source: CrPH91TEUL.exe, hm0lJKNnhKyR07f7oG.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'yMsbfeCibpK3NMNRIFi', 'x2fqU2CJpR1888uBStn', 'z4IgiVC4gUNjHOgoY4U', 'JLFrrXCOclFPjjbR1Pv', 'zITVTYCybctOqE5xTGe', 'X0mT0XCMWkXbwGNE6iP'
Source: CrPH91TEUL.exe, hEGtVUW1smhWdrMCeP.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'QhQqlBwpMArBfuPOmEG', 'V26PZOwI6HnL5rDeo7P', 'uGHQtBwW637jEAuP8qO', 'wZL5fRwidVGNZ15awFc', 'TD0Yh3wJqMrgnVw0giy', 'HGVAJlw4ocxDvoUoSEg'
Source: CrPH91TEUL.exe, gnyZYF0TXdx2I3Dy3J4.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'isYc862l5x', 'SBrcapl6bY', 'r8j', 'LS1', '_55S'
Source: CrPH91TEUL.exe, aA2l1P2kV92k6LLTDn.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'H3Sht7mdp', 'GP66TZH4E60bkQe7YiS', 'dYqEP8HOKyEG4FFRJv3', 'nWdFh5HySlScu0C2lCY', 'vhsxvuHMMngmuWfsWn1', 'Wenx6cHjIqHj5A6F6lv'
Source: CrPH91TEUL.exe, JdRwGC9rUPrkpBnSte0.cs	High entropy of concatenated method names: 'sg9', 'neNMagnjsJ', 'hsdneBLEXG', 'FKZMlW1gHl', 'WruqDKju0dMBB2XlFE7', 'KMhwMtjAWqDoTvBf1l9', 'VG6Inmj89RMJJ5R84HB', 'KO9ehwjZEmIn91Psq9Q', 'o2JXx6jPMwnBv6BS0Bl', 'YKNjEyj50P3XENdGGCl'
Source: CrPH91TEUL.exe, HOwLSqEc4V6qtUtY09.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'nZWOVfaL7ukUWjcEw1D', 'QL0AfoaeLM8BDgKS4b1', 'VB3qFCaRqTaQKa0e3Un', 'QXLSJgaFlig3mMHRo9g', 'VVWZhIavSv1JV3AbHms', 'yuHkTDaq51GAeECkGS3'
Source: CrPH91TEUL.exe, w8OYmJvHjwXUYx49d3b.cs	High entropy of concatenated method names: 'RgsF0bGbTn', 'ewiFvvwejr', 'a2oFsNR8ZZ', 'aqaFSaByaE', 'JyEFDM4nEw', 'QjnFnOutmJ', 'ecpFub2FOu', 'WE1Ff1gt5s', 'dGMF1J7Q3t', 'o3wFX6Cctk'
Source: CrPH91TEUL.exe, p23OlVVqdWTXkCZgZSs.cs	High entropy of concatenated method names: 'xXwB7bwUGc', 'uK4BMr8sHM', 'OxZBAYSs2j', 'dPKjWecg2HTQnOYh5JO', 'TFVoNJclCE1Y6JexKGw', 'EEJOqwcbFNH8sT4YcgV', 'IJjDu2cc5eWml8fK1w5', 'o2gOU6cQlIHWVCKUWXh', 'GtyPoucdtYTAHEf4uX9', 'T0Q2SCc3dxO5F4l54Zw'
Source: CrPH91TEUL.exe, WcPK4rVn8sHMYxZYSs2.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'Il9q4PVVf00OOJyfShO', 'weNgKOVfmtNlQk1tqCx', 'gqpoeqVlEirDJSIFs1f', 'KscnIhVbci8TT6pRldS', 'Dv7qMLVgtBGuKMCBqKh', 'kVpUpyVcOaalWR0dE0O'
Source: CrPH91TEUL.exe, VQitaevIOIBRpC9mkMW.cs	High entropy of concatenated method names: 'D13FRvXT90', 'UVvQq0eXOkcFlTNYPNW', 'U6DtIAetV3bIrZmGts5', 'Jay4KheoyAcV3Yt0pbt', 'YaPxCYe1R8Qk3i2CeuL', 'p2r4B7enkuWLenkrc1L', 'XP3ycyezyfb39CxyGMm'
Source: CrPH91TEUL.exe, UAwgbN5AbHdqqYLvvn.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'XRfFwrCYTdPd1FITsAG', 'G62HEyCGb8bePkYBls6', 'xqOPyjCZFwQgYfdHbVm', 'sncFj8CPpe7d3XvTCC0', 'R3qdmjCusOvFf9Lo1dD', 'Cp2xl1CA4y6VnDjXXka'
Source: CrPH91TEUL.exe, OrU5PbBhpn2oK8iPmWb.cs	High entropy of concatenated method names: 'ljPsDYtGgK', 'O8NsnqCnAX', 'D8KbGqitRxyhGMAdF6A', 's9YXuwioXvR9CyYiZ37', 'XdGQJqispmyWqjlxY4B', 'LT5U4di0P3nudd3hJV5', 'xvdsjFygKt', 'WpE2LnJTd5kI5jvR75x', 'uovVWLJSfU3ruhsJ70X', 'm2ZOrGinJG4drwBulH8'
Source: CrPH91TEUL.exe, lFvdFyBqgKtACod9vGN.cs	High entropy of concatenated method names: 'PudSFNIhMF', 'hnQYKgJ8eSsKCf7TDV8', 'JuKfCUJusmmEn2ITKHG', 'd91ZJHJA8Im37bEMXEK', 'yq9ktwJ51GcJx5Vk43s', 'SKlFJCJsKNQhY6oFHg9', 'AxYSUEyxk1', 'uSuSOnm9ds', 'zNvSdX0xTo', 'u52SpUIm6v'
Source: CrPH91TEUL.exe, xmGcLHVZltB2Ht9F71h.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'GWEdVmgyR0xEYsC4YKV', 'teySasgMVljZr5VENed', 'nSIk3Dgjw0MBZMBWgng', 'eKGfpPg9qDrqX9ofLU8', 'aECqlbgNKHlU7YBORrR', 'z3IeKcgK1fMVBAbv95E'
Source: CrPH91TEUL.exe, jCfWKsvqZXF0msqEUTW.cs	High entropy of concatenated method names: 'ywQFb5QlFg', 'bIPFiGMNeh', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'JdlFQDR7aD', '_5f9', 'A6Y'
Source: CrPH91TEUL.exe, m3uLEWBj9qhcYqmsW7e.cs	High entropy of concatenated method names: 'SrT9ektZrP', 'Aap9q7OLtY', 'SSMoTs34TGFI9rUnQ4n', 'V8p9fS3OS0v6M1lBAYX', 'hxF7xj3y6BKwd3CGyte', 'jnoJxw3MOC3qZE5RS7G', 'lrIllW3joIBiUG44Ha8', 'qydWPJ39rR8YnHP2gy5', 'bVvIJx3N7dak3AyRSav', 'rIvTQ83KTVU7lLFUZ3E'
Source: CrPH91TEUL.exe, tyBprVVPjkbT5X3gcSw.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'UhsKfbfNA11Naa2VdGT', 'Emg9C9fKf4uJxAsHd2D', 'lFFr93fhBadnlufCZsf', 'TeNuqBfUJS4iGPvKrrU', 'OiYl9lf7btxFnh2i2qJ', 'wgwvq7f2mQXHGo8KeSH'
Source: CrPH91TEUL.exe, UiMXwWbVXXa1N9aPfD.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'sMNeMYHgrSXGVadY4ry', 'XbTltNHcvpycMhVl7Tg', 'UVqBs4HQhjnsfIIhwAH', 'i6rlVgHdh8V4AARvTWt', 'yPD3cLH37Z0BOI8HxCb', 'Wetr86HpAinEn7GRttf'
Source: CrPH91TEUL.exe, UpbyHCSF8IueZHtukCK.cs	High entropy of concatenated method names: 'DJl2ApEW2U', 'c0i2F5iSWD', 'YGX2gNWwlr', 'TXR2xKNACV', 'BO12buFXlV', 'aFS2iGwuMh', 'NRX2QFlSl3', 'VXy23OFAXn', 'H3b22nAs70', 'n8F24XrfhG'
Source: CrPH91TEUL.exe, gDAnk0Vl4vTq3ynED2g.cs	High entropy of concatenated method names: 'Vf4BOd5H9D', 'bQBNSdc6y5hLoYh5bMK', 'sXG4MUcVgyHEGqr6Q7P', 'wM99EVcCs1IZTLMQBh1', 'vKXsbLcw8ILhB0LhxHW', 'uCu93dcfaeUZC4Uw4Am', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: CrPH91TEUL.exe, BZuZjTskSRuxaspKKBB.cs	High entropy of concatenated method names: 'zA3cM6YCTb5Rpmkvtb5', 'WDkpbUYwt4yTtVERiPY', 'TP9e5rYHRB7rc5JpNAx', 'bxRkdCYaT6tiKRuJmhC', 'WK2xIQRcRj', 'WM4', '_499', 'coZxJ2rO6l', 'RvGxmmmxrB', 'c7wxEnpFXj'
Source: CrPH91TEUL.exe, lLJcvxBRiyULdGT8Qy7.cs	High entropy of concatenated method names: 'JulBFmiG56', 'ftaBgPvUgA', 'lLNBxW9HTe', 'Xim4pAcBAhUDyZSkkQn', 'oXNwurcrwXrVUAqs0xl', 'ofr1QYcDxoEEiN6ITcC', 'vfaEt9cL1SFVPIT0WgE', 'poOCZQceYxFRVaxMQWn', 'pBt5oZcRnR9rfHd1wXC', 'gliF5EcxF2FgjmH0GZN'
Source: CrPH91TEUL.exe, CkqAq2SGCxocjbsbX4.cs	High entropy of concatenated method names: 'YAqy2GCxo', 'WIt0E0BaqddjJjhvgo', 'AwF7GGxZjREF82i70I', 'Ku6AUumvZtapQ5IVvV', 'IwYeaar1GTh6QoRg7a', 'AZ605iDdYiVGv0Mx9O', 'hkUBNWTCC', 'zdq9O1s3w', 'jmP0Bpyj0', 'rKEvmwlQA'
Source: CrPH91TEUL.exe, p0mpGEsNlsJR7tG8wo1.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'cFdQnZyx7u', 'IubQu37fGQ', 'br0Qfb1NAZ', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: CrPH91TEUL.exe, t9AvAsJbnX0kJRjlIX.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'znh7q5H1BtplO4dXbwd', 'lKW8MfHnGCgMY4oKfSo', 'KrpWDpHzNCDsemeM31F', 'nSgH4laTNYKJYwDN0IL', 'a2xHsVaSCgIAd3BjMPj', 'M3o3FSaHVHGlXw7m4Hh'
Source: CrPH91TEUL.exe, uCVfoHBdd5ReNyyZbaN.cs	High entropy of concatenated method names: 'qOK0yXLJcv', 'ziy0cULdGT', 'ICXiDcpNMk8dUiXs8l8', 'bO2ZkvpKdhdiTNdXiOp', 'qhc4WSpjKnCDQlbeSFi', 'qngZlQp9K5dqaH97SWU', 'JEIParphLOivW2h1iSv', 't4QXF1pUa1S5aPfbjLY', 'RPsnrlp7X6FAsQnmwKe', 'IlUQIIp2SLRDwnkte5s'
Source: CrPH91TEUL.exe, BOglEr9Oj2kb81T8teY.cs	High entropy of concatenated method names: 'qm4n8xEF1r', 'ANdnaheq6I', 'LkjnjVTYkJ', 'xxy9BSMYTHlnybk1D6c', 'GHQI3JMq4e4VRgBn8aF', 'Bg7vIwMENemaRIITKDP', 'HKQAhsMGe9KUCPutZxN', 'X93nsiRfLK', 'mCinSprKi3', 'QkWnD2IAV3'
Source: CrPH91TEUL.exe, gKWn4hsT8d66nbJ6Rd5.cs	High entropy of concatenated method names: 'FwIQ7Kop7I', '_1kO', '_9v4', '_294', 'VoHQMEIOOr', 'euj', 'yHyQAu6vbK', 'oeIQFPi2Bm', 'o87', 'zF1Qgd5fuR'
Source: CrPH91TEUL.exe, lLNW9HVfTe0nPT8qfZd.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'GLhti6V4yEGDEPpuM72', 'sBaYhEVOWa5GmUVoE89', 'mpWAKGVyUgIp4QKxwWH', 'M5bSiMVMsTFjsins8RA', 'rBjZAeVjdw26oOZNvJT', 'OLbMc3V9rSgJcK7Xkkv'
Source: CrPH91TEUL.exe, qS1A8Q9zH4fIXkSbUHF.cs	High entropy of concatenated method names: 'g7muboSkKq', 'HY5uiLpOvF', 'vPmuQdd9x7', 'KG3CQINqrOlwEUDI8ls', 'Bi4iFhNEF0uXsaJ6ek3', 'uKbOcdNF17mtATILqjs', 'KBbJvXNvhpD8gCCh2vX', 'IkQA0pNYx9p3HyLEl0y', 'ktvIbING4P8B1upPYRY', 'pXVto3NZqptSNarxcdW'
Source: CrPH91TEUL.exe, Tyuwdc0xxGdkSpw1yvD.cs	High entropy of concatenated method names: 'grlykPWXRr', 'mjMyI8vwbZ', 'gysyJlU738', 'sDjymaBKAb', 'wSmyE7Tn49', 'i0GhE7U4F5YHN67IVF3', 'Qh7uW5UiimynEsLMhNg', 'sUBlNLUJum39WLroUWH', 'pocLf7UOorNJeYbul6L', 'MGEGrUUyEZy4mwcWH9w'
Source: CrPH91TEUL.exe, PH9DI6VSk7dStblxdgX.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'BvKa4o6taB9wlcX731h', 'tt69Zd6oG4rIgtZpcnf', 'phCyow6X56EI37jGRSg', 'zTQ6oC61xaRhOXlTlqb', 'Ad2gQR6nefEMvJEgr2U', 'vtJwJw6zPK8cQIK0brA'
Source: CrPH91TEUL.exe, cDLS67VOJ1M39CeXPvl.cs	High entropy of concatenated method names: 'jWYVQPWxNc', 'GDInuifi02vkLU1G1ve', 'FutU2YfJG33vnW51LmQ', 'zIfkJtfInj802GRWXxi', 'GhSjyVfWZiE2q9lfUSE', 'XB2biof4sEUbYrsHjD1', 'iyFOUKfOfYtJbVWj0Ru', 'Ei3pTtfyolpygRZxAyy', 'T30yskfMggQUE8f16k5', 'f28'
Source: CrPH91TEUL.exe, aP93AHvnVAw2UTQQ4B5.cs	High entropy of concatenated method names: 'iNNAdBn7dN', 'WwTApYKVkU', 'Ndac7GL09Yr4AMcmWHP', 'R82ovpLt81wytJCTV8r', 'QutQvTLoAcIiZyMMltI', 'B519YFLXPmB4aSmbhHo', 'wxSEAcL1xe0I050sYkl', 'sXZwwpLnmYNC6OsOu1K', 'a3mMMfLztaux4GLm9oP', 'eKyEcheTP26LyBrGUBi'
Source: CrPH91TEUL.exe, VKLp4jVwUibukIj0AGJ.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'KXukqvgA2GXTBGmwXxw', 'KglRFcg8EeolNtctgEQ', 'zoWGBVg54pWrPyS1DlU', 'SBIkXngsxTwMwHNZoce', 'F5bGR2g0bhRZiCEavN2', 'CdXcpagt4nlx3uT9vAx'
Source: CrPH91TEUL.exe, m3RiOOVMswlwcpLcEuT.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'E1WpXdfDt8caqmXL88q', 'PmCqDAfLpk20oioiKw3', 'sy9trmfeBurQtleGVvb', 'gbVR9jfRenGQixO3pDK', 'eEvOuBfFIxUcQCZHgS2', 'OIH6r1fvr3NqEEe7ofK'
Source: CrPH91TEUL.exe, LHaubE90UZ7je9Yk0iL.cs	High entropy of concatenated method names: 'FJZSr3RE10', 'UkFSt96Xna', 'oc9SNI1CeM', 'Wn2SY5E1Rt', 'KGdS5DZ0kq', 'sxYS678qJp', 'bdHpJd42K2laEm06K2n', 'ulLnc14UceDR13I00bB', 'nEruSB477f04G6fxScG', 'ayeGaO4k4IDPNC2DRTP'
Source: CrPH91TEUL.exe, TyJV2qgiAXArZbW9op.cs	High entropy of concatenated method names: 'n2CI8csl8', 'utSJuQKX4', 'XP0mBQJ1w', 'dWRNewSRo0h0g4YOqwm', 'Ud4gI1SLPGnb29mT5NX', 'KiULG0SeSEtiYdTow2N', 'oEjYG4SFY1HyrqE1eNp', 'ig4yqOSvbKXxlTHlHlE', 'WiykAeSqiJ2OY8sBuum', 'QJxT5PSELw8NrouWaLg'
Source: CrPH91TEUL.exe, ia5sFh9ZtUfI90Y6EEQ.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'J4tMOJpybL', '_168', 'WdNSMa9KFxDDiJtiyNR', 'sk6QSW9hAskGs0nGDVm', 'JMcGd09Ufdd84NCI4Ji', 'u5690T97LcUDW0wPs9j', 'gd13Hb92tNovRSlTgZg'
Source: CrPH91TEUL.exe, yTDUeeBEsMHhW63Ojqa.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'hluvIpOMTd', 'dnwvJMgTDU', 'XesvmMHhW6', 'DOjvEqanci', 'TKtvorQ768', 'LOympNilwUtPjp8SFyQ', 'ARevsQibT2gZSYLZHu1', 'HQfuiQiVXvsBHB6oDuD'
Source: CrPH91TEUL.exe, ocxQTwsRFiPFttlQHZb.cs	High entropy of concatenated method names: 'J2eFYEWqBF', 'rxPF5SfAaK', 'vfLF6tqWu2', 'wdaFZ70JQW', 'Gd1FTVkIu5', 'hrGFWwiUX5', '_838', 'vVb', 'g24', '_9oL'
Source: CrPH91TEUL.exe, CZchxdV52ORtUW8LXZr.cs	High entropy of concatenated method names: 'QvcBfYgfog', 'BbkB1qSCW0', 'Te0sBWgcVLDfddqJu0E', 'rWjfmRgbLinu8H6et3w', 'bpqWNfggaaFugTaZkH8', 'UnV2fugQWXnNgkpNs8S', 'XQllQfgdWm24PiprvN8', 'rrX3fLg34no79ELdxb0', 'TKgwi1gpswaxfxBd2yK', 'EpclnYgI4tCisX2OOHS'
Source: CrPH91TEUL.exe, c3iRfL0jKcCiprKi36k.cs	High entropy of concatenated method names: 'nyvX0wegMT', 'S7EXvXraX2', 'nauXsCsSZ2', 'cZUtB9hW3v4SuSZ741W', 'oCn5wFhiYIS0SVcExtw', 'L0InMOhpJGPG1JIP3Kl', 'fYMKhJhI14E8EBVXm6l', 'Cn2FTChJyGO8o3VmUPe', 'wbRA5Kh45CSF5jEMqcj', 'loq8w6hOsh25eruAH0K'
Source: CrPH91TEUL.exe, FrDs6MsPF5nymTojFWo.cs	High entropy of concatenated method names: 'xoRgdaBPZH', 'WD9gp7oGVC', 'nJ6gPQqVaX', 'GxFg7pRwhK', 'zcsgM2GuQH', 'SEh6pGvXhg0wV9YS5BP', 'BteRbYv1wT4hdKgHIKE', 'CL0g8xvnoJNunWxG5iF', 'H0XwOivzOgWnHdONAn4', 'bZB7evqTux3ORdPtOqI'
Source: CrPH91TEUL.exe, YT3mGe9uEeepW6bxaPT.cs	High entropy of concatenated method names: 'qkDDkb3A6C', 'uXkDIEH1JP', 'cKxDJ82oje', 'TxsGhEy3c0V4lCdokSY', 'z7kbQGyQxig7k9Ddkro', 'vKeLSSydL6S3qtS6g3O', 'wfx5wKypt7XeyHD7Tt7', 'vmPD8HC3lk', 'L2NDaGuF29', 'NbuDj33FE3'
Source: CrPH91TEUL.exe, KjQXw69VG57VRR06WNI.cs	High entropy of concatenated method names: 'pGPSQ27A9Y', 'jqJS3Qqr0J', 'MGNS2hP91i', 'Ks9S4nxSpl', 'nBog1eJzJ5R1fvT8krZ', 'PahEeoJ1H28iG3ZKjZo', 'wgQI5EJnBlrbfPnDBaw', 'Mv2q7J4Tf5Rua9rHqdT', 'RjgEKK4SRkWK2P56uo1', 's91ihT4HoyFC87YVEdM'
Source: CrPH91TEUL.exe, krbNdh0peq6IKkjVTYk.cs	High entropy of concatenated method names: 'a09Xk6CHfZ', 'Y3YXI6ry6w', 'qNMXJvv8Z7', 'RRYXmJPE4J', 'FDcXELxYPI', 'z5igHHhDbW1UcnSuqGX', 'AXvWjuhLQf9KsALJpSo', 'PxUdIvhBWvOAA8EOjmJ', 'EgR4QOhrEM0RimtsksD', 'UGlB18he101fvsogtwf'
Source: CrPH91TEUL.exe, TX08PazhSNE7lmlA0J.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'ik7gi46aJ1JiCMm9Lcv', 'xUEH5h6Cc2Le1N4P3LG', 'HrsJNk6w8SYVyDZe0kc', 'zXIPic668mKwebEOfPI', 'eh3q0w6VYd0XXxVLpVf', 'zMsrRy6f1pDP09Ipqrm'
Source: CrPH91TEUL.exe, NnnKLxVc1y3iSh0ivV8.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'X6IMHeVFuGsUadToPVb', 'LE0ePVVvsiDyIejfRAP', 'DCva3RVqI15DhwcY0TH', 'LFBB4aVELqWe0HbuxaO', 'YDCxwNVYJ2bBYcBB7oZ', 'yLTljKVG1a3DywgHfTI'
Source: CrPH91TEUL.exe, A6nO4N9cUVGSkpV07M1.cs	High entropy of concatenated method names: 'dWxDtYMD9a', 'c5CDNfN85O', 'Mp9DYSX2ls', 'oQhD5kCwTK', 'OQsmdkyrqOq8d4GYo6r', 'I0bvKryDG0wOEkeV9fl', 'zYEdhqyL9oN9JAO88KM', 'cZLdfDymF1NWNJxwNWB', 'XFR4X8yBlitnfj31Lgy', 'B0deqayefvb7qGLASms'
Source: CrPH91TEUL.exe, Gi07hs9C9yh7R5khjXC.cs	High entropy of concatenated method names: 'rb2DLKEaEV', 'jNmDwsq1yY', 'B7TDHgV7XS', 'GOuDlWGG5r', 'FarDGHVAfb', 'B6vmCXM6FFaMe2LPT8J', 'XkDPMuMVwX9Su5grHYi', 'NgmSinMCl4Q9QbC6YFp', 'wPS6cSMwIZ6lYT6njC6', 'cj9HdVMf6TItB2f3qZh'
Source: CrPH91TEUL.exe, oQhkCw0nTKq2jhOVnAd.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: CrPH91TEUL.exe, bLkWZdsiidVjUjnUEOu.cs	High entropy of concatenated method names: 'f4WxncZIpO', 'b2dxuhrQAg', 'h8Pxfkypoh', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'VHlx1GnCIr'
Source: CrPH91TEUL.exe, gc8L9Msx26KM1BK4ZQL.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: CrPH91TEUL.exe, XG5rIa0XrHVAfbImFtC.cs	High entropy of concatenated method names: 'Op51JEnPHW', 'C141mYsTcy', 'mfC1EfWKsZ', 'lF01omsqEU', 'RWr1hrf0Il', 'T7ia0KKnmO6pyDWYcNu', 'RqjSyNKzAwVi917BPvS', 'BSZS27KX9GgqUJd6GSD', 'k3oSXMK1ufv8hLowsgJ', 'TrsPv2hTuAALwgicdAU'
Source: CrPH91TEUL.exe, ykUWT9VFwiIjG07fD0Z.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'tNsehEfPTelOWmZ3Zpw', 'kQcj4EfuBCcOR5d1iTO', 'o2t7WWfAE8CSU1xmdwr', 'sAR5gMf89DFvIa6MIV7', 'cLCS1uf5KBSykRUUKEv', 'VZ5bP3fsctbKeMFqy99'
Source: CrPH91TEUL.exe, BgB4oSvoUICjofp50BM.cs	High entropy of concatenated method names: 'xcntX9RwHR4ixSxDuhh', 'XAFLDvR6UKnQoBUvq73', 'EhdGQpRaqW77T5840UW', 'X15sBCRCaSvENmVBDAq', 'qscmsNRV2MtUrMcQMAJ', 'T2h51mRf15wScjK45Ff', 'xZ0VQaRll279sYnQFv7'
Source: CrPH91TEUL.exe, lRkmoaVxr05bDDhL9CR.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'Y20CZifn7EP3tqaXEbE', 'FbXXYGfzvhblyOiWgDe', 'ACOddPlTpFBdsHp9uIU', 'IL6kNLlS5ApPlmoYvcb', 'JOMNtZlHJVOQTgrl3Kv', 'yAjaqnlaimwOOTlKxE9'
Source: CrPH91TEUL.exe, mLXiev95GFbRQZlmaHe.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'XJFM8gwKJZ', 'AUZu0BAAdb', 'HleMjKPKFD', 'WKUdZ59drr1VmN1UaY2', 'IYpMZk93ZJvbNL9BOU1', 'OC5unL9pcepN2hHSpRI', 'TAtJDH9IGkK88wAad03', 'k11bV79WKyEnZBO8cb2'
Source: CrPH91TEUL.exe, o4V1E9kL0u3mBE6XbM.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'I1qtwJiYZ', 'vdRLQyHDTyCnpaPrUcC', 'FsKtZfHLM4ImbbaoQkK', 'sVjTTGHeCmE5swwBEE7', 'YBeCjWHRiEDEdBY8yGk', 'p8ciT9HFwAcmN1Glgc5'
Source: CrPH91TEUL.exe, DiLUwoeroXFj6LNPGv.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'VmtuCYw08qCFPomIWQL', 'uLhXHowt7ZI7OAi8Rbg', 'fuaGZcwoLk6YnOITJA4', 'R93XvrwXqNuktbvi2Xb', 'DpTHmYw1PHu5wGFOUEP', 'lZuRY2wniprafxK6Njg'
Source: CrPH91TEUL.exe, YDSr2O0vRAyEDw0IhW7.cs	High entropy of concatenated method names: 'IE21j4oWxq', 'd5e5oLKJnfT47HtgcFP', 'hNPvRgK4tYssMy2O3Hb', 'x5GHJ4KWxEOlTgrsZog', 'L1P1iFKiwaRAmaMqLI2', 'Ho0u3rG6rp', 'ImMu27PsYZ', 'rdmu4DKcm9', 'st3ukhGx50', 'cNauIRLjSR'
Source: CrPH91TEUL.exe, IoSkKq0eJY5LpOvFMPm.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: CrPH91TEUL.exe, q5Z6Grwopox9v6F6b7.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'DqCJ50w7UsansBeBB1d', 'PtqCbCw2ib792Jmhj6E', 'XKdI6WwkcENfcYiAyZA', 'cIIVHawxBFmjIi1VqdP', 'ncDt1IwmrFJ0qQv5gL5', 'DUUohvwBW56GfcaRaLT'
Source: CrPH91TEUL.exe, dXgaQavL6I8cJyuoNDo.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: CrPH91TEUL.exe, bmfLQ6ViqPaXBh9316O.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'P6CpHGlLjCFZ80AnJpY', 'YqS9s4leyqIQJq5yT1J', 'GB9wUMlRJfjvqYET26l', 'an8N1RlFiZp0mep4FyW', 'wrWgN0lvCwxNV7lTAnL', 'zQRL8dlq2ZWiH9XBf3X'
Source: CrPH91TEUL.exe, yTPOvLvifSJFDQ6miG5.cs	High entropy of concatenated method names: 'usmAN2ZDgF', 'qt1AY3v38Y', 'nwNA5xu0GF', 'jcv5woeD3VUSA0xnGdj', 'HykYspeBm7vV2BfP0Fe', 'uCixLherXUgTmJBZ9bc', 'FYBeRHeLH7Cd7lwNEQB', 'As1WefeelCaRareBarR'
Source: CrPH91TEUL.exe, sGvkdn0wtVViMARroQS.cs	High entropy of concatenated method names: 'u7iceFQV3g', 'tUhcID6BBW', 'xPFcJbtInm', 'rrXcmXV47H', 'OQncEa5Ih0', 'XSxcoetdfD', 'lDTchLoQBU', 'B29cK6m0pm', 'KJ9criWRGJ', 'A6lctr6lxl'
Source: CrPH91TEUL.exe, lPGdNohYmD1YG0JYj1.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'ErwC1JaoiuA36axtPZK', 'N4HqGcaXvMQmaxyr4tP', 'EKVVgMa1NK6fNP537lX', 'QuK8VwanQbpWYytMmXc', 'EujqfnazEh86AMlBB5i', 'DdGSeCCTZi1UKykHhDM'
Source: CrPH91TEUL.exe, uEJY0ZV9bYIgWFPawuC.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'g6uWTV6kuGIyRJlUgCf', 'jds5bj6xD0dbvJdFaoP', 'VpuFm76mkgREm7tWh9t', 'hbXCRB6BoWXpBojeQLX', 'TcuCA06rbuJrpk8nlWl', 'cUkQrK6DXvCI3jGMDLB'
Source: CrPH91TEUL.exe, PT3d5kVCfqSOoTF6ob5.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'awyACKfTkWEBqd8H6J9', 'BmOTLKfS98QhYkq4pPS', 'll7LMFfHUwfIa66lVYG', 'gB0rbRfaIQXGcml4yvM', 'KW8CAIfCI9Q6YCsE0J8', 'FlpWm2fwWMH7GoVGQD9'
Source: CrPH91TEUL.exe, qLrwXU0fOb2KEaEVfNm.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: CrPH91TEUL.exe, jXUhW2lWlq0Zp2rUb4.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'S6UeCSwGBFAOKWK5UC0', 'kVyA4WwZx1w2Q6nddRl', 'UHFZ4jwPlIPUfNava91', 'sNaWdywuk1CGeRkxtDQ', 'kGISFdwAK4FZytKT9RM', 'LBNP1ww8mVo7xAiQi51'
Source: CrPH91TEUL.exe, fCKyn49PdefWeZI6UF7.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'aaXm3ujdRfeCo2CRrbH', 'RANmREj3V79oJtDh3xW', 'c6KirGjpA2QNvv7tgZi', 'aRgS3ujIGaRkxoriQTG'
Source: CrPH91TEUL.exe, y2PNJ7SfsOBsK2nsY62.cs	High entropy of concatenated method names: 'KtoobQNNxprX0', 'XFkkI5ZpLJ39xu99u4w', 'VAgC8WZIvLKfmyrWMWm', 'dgRcs2ZWRKnNgfWYooB', 'XS6nv2ZihdytjrfII3u', 'mIIGpoZJCZtLFBDgneN', 'cHkxoxZdaLt4CnUsYTg', 'sBqpHuZ3u0jw5PDSSeL', 'UNu9uEZ4XbsdxCx6rTI', 'SdBQj7ZO7IOvLMrOYDw'
Source: CrPH91TEUL.exe, spFiw69NAAd9mBmkAAv.cs	High entropy of concatenated method names: '_5u9', 'DwFMqpyglE', 'seguRcvCKG', 'JkSMJSHQmt', 'mNsd4VjXefWKNOWf4ia', 'aWZTWtj1hgF7GWWJLuv', 'SW0kEljnsHkScg5pk01', 'zLJ8NrjtBtpYbVO7pHP', 'BOxOYHjoMgQBu0XXEY5', 'o1AZ90jztD8QoBlgA5F'
Source: CrPH91TEUL.exe, aIBqYovGSEZF3XJo6SK.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'lAHFMB19ZY', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: CrPH91TEUL.exe, m6wCNMsMvv8Z7TRYJPE.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'MXpgA3eXMo', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: CrPH91TEUL.exe, RvPZ4fBUBddYEWoa4Rr.cs	High entropy of concatenated method names: 'G5L9zaHKLp', 'EjU0RibukI', 'p0A0VGJNNU', 'flH0BYxdFs', 'gSt09PGrSD', 'wnk0004vTq', 'Cyn0vED2gB', 'sBO0sM8F4b', 'zcr0S2nSHO', 'LaF0DtbJXI'
Source: CrPH91TEUL.exe, CIGuTtsmJM1JNOyW6ra.cs	High entropy of concatenated method names: 'SQjiEnuopK', 'aheSy4YkUrkmTO7tEQy', 'fBkA0ZYxtuwYEG7NAr7', 'HPRLpxY7SamvpFD8MVq', 'qiiLusY2o5vHgCHt4Hi', '_1fi', 'KlLbWeiY3D', '_676', 'IG9', 'mdP'
Source: CrPH91TEUL.exe, LgoZOJ0lw2K3M1NqCxd.cs	High entropy of concatenated method names: 'Hol8FM519Z', 'FJd8xopjrI', 'DNC8yDurKo', 'o2i8ch7c8h', 'LKI884mUEH', 'Tuc8aIm57R', 'MBT8jjWnwQ', 'jPe8CgcHyT', 'jd78UM6vxl', 'NwP8OQYLyk'
Source: CrPH91TEUL.exe, veLrZfBi956eZBvSECT.cs	High entropy of concatenated method names: 'ybW0eL6uat', 'FRE0qUj4p2', 'CPC0zVfoHd', 'PRevRNyyZb', 'oNvvVUyPh3', 'l9HvBqYcPK', 'gYrv9fAw9v', 'NAEv0Unjej', 'FxavvYhJgo', 't77jSLItQSd6iymlZjg'
Source: CrPH91TEUL.exe, OnimeHBIce8xZowf9F9.cs	High entropy of concatenated method names: 'yYnvQimeHc', 'LKtmG7W1vFYw6PHQm1D', 'xOniZSWnjay8QFpTFkN', 'f1GqjBWo73NkBNqZvnt', 'o1EG3fWXIp52vMgFBL6', 'rysHY8WzcN5Pleoko1P', 'lTeJvwiTE6arHVRoDmF', 'LTu1ZkiSfIdcDLpKsSU', 'xoaNYniH0U4MPEQEA0x', 'rMnWQFiavG65eS4aj0A'
Source: CrPH91TEUL.exe, CZXBK2VVckYFA3ssZpO.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'OlKD5N64wL5ubv0eD7D', 'rS0Mb26OFeA4ZHeQq8M', 'P0RdUi6yvv1KkBsJbFi', 'OXWPEU6MnFvg1BSSFqT', 'ari9Hi6j0lYFHUmLw3R', 'QTAYLK69x7YsFs1a2ts'
Source: CrPH91TEUL.exe, B6rvxB9WgAPHFvGOqLo.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'mPeufap5EE', 'pmxMD71uD3', 'uAiu1KD8vX', 'NpDMxZH6Ew', 'KYrGgA9RMyHmWckehVP', 'zB69889FHjp9ghIeuKW', 'YwVNVG9LZ8s88hv3Xuh'
Source: CrPH91TEUL.exe, ndMjSlVXTqajWL3eGFm.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'rJgQTPVUDy7m4XMc6OQ', 'Gc6UZ1V7B7bLAnGS4qj', 'I2OqhZV2q5h90BXxowN', 'niqOOUVkYBxBWLrlwXb', 'swiVTqVx0QCVhuCk3od', 'nXLEEFVme9L6pUsl4yj'
Source: CrPH91TEUL.exe, tBElgsVKgfuYFwX9hwq.cs	High entropy of concatenated method names: 'LoXBVFj6LN', 'uGvBBekY66', 'dAsB90tsDf', 'cRJOIhb5bTRY9wBjuw6', 'ox2HEybsvdX07mT6iEl', 'wFFbu9bAfRld6v0i2Zh', 'TwTa3Gb8LWcZCZoVdpr', 'zWSmtTb0nOpLG3GIOoU', 'kFGdT7btUWgWbKLBMHH', 's8JwElbomiX8aAYR1Vh'
Source: CrPH91TEUL.exe, kArd0ivxAN3t0OiR287.cs	High entropy of concatenated method names: 'vCdAoiv8hR', 'QqsAhA74RF', 'Af0AKtwP7y', 'l8pArSK6GJ', 'IxLAtin8C4', 'xbxHCfe7gaFb6bTVlo2', 'nwrNTBehn28mOpwgWfe', 'ILMCYreUxcd7JuDEXya', 'vheKZpe2FhFQXVrvV9d', 'KpyhO2ekgts8d8wA6xu'
Source: CrPH91TEUL.exe, kAiNu9sFGXJqFvXK4jT.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: CrPH91TEUL.exe, mtxw1KVvFlYMEPSHOSw.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'ECYb6y6ZrPdVSqLI55c', 'K7CGpX6PId0as2mitN4', 'TdmOgc6uaiVDBQpivpZ', 'kL2AwG6Ag00iZF5cd6D', 'VnvDo368H6iG2l0wv9T', 'dcvihK6527tsZxHNZfO'
Source: CrPH91TEUL.exe, tKkJY8V3xuCLkbMT3Tv.cs	High entropy of concatenated method names: 'AJeVYmZg4R', 'iJ6AuebHWaoNrn8aVJ2', 'i2SMs7baDbPQCtQRoAl', 'XiJbJtbTRKNecoKc3mw', 'IMIFT1bSPHkpmyhl9Wv', 'T6PjBFbCqY1m3jHIr53', 'ApSY8vbw4vFhKdE9N8Z', 'ODcW62b6eblYx9vPS5a', 'bU1V6smhWd', 'PUHj4FblvGeX4Et5Zrf'
Source: CrPH91TEUL.exe, dC8QMEv4gcGuXHPpcOT.cs	High entropy of concatenated method names: 'VwcALc535U', 'HHtAw02aEu', 'fpeAH8Zya5', 'dNhAlSWOBq', 'Uc3AGi3u0e', 'yaoAefo6SE', 'luhCGEeuHoDbvKyugnJ', 'BQIWMbeZSwohVibRNwO', 'ru5WrGeP31BBACtoYEx', 'uqQLS4eAhYXXp3mvpS7'
Source: CrPH91TEUL.exe, T14yxSv9n02POxFNMGe.cs	High entropy of concatenated method names: 'OpQB0mBjk70Fc83U6pe', 'SVwLQfB9TphdvdW6q3Q', 'iRoui2ByeuWN5ZV82OC', 'zhkMNHBMdl3EQUOT8BH', 'R75dAG2MGH', 'USjtgEBhbl9pkNvCJQJ', 'TLggBYBUOQuxJrHQG3G', 'bybYp3BNdCfPxao9mWb', 'rVDbI6BKNZarqtLlGfR', 'udMIpRB7vf0YFg5LcHt'
Source: CrPH91TEUL.exe, dBOslgVEapqbMYn7tkL.cs	High entropy of concatenated method names: 'Y0ZVep2rUb', 'ALRxA4becibFIUI2TXt', 'wLHTfibR8Ne2DsKQWkM', 'VsaZuybDD4CvtBSx6J8', 'GiZUsqbLBFkd6pBTQJB', 'jTUdPPbFe9xeRF9Ei79', '_3Xh', 'YZ8', '_123', 'G9C'
Source: CrPH91TEUL.exe, LSU1pA9l9pZ1Cni3Zel.cs	High entropy of concatenated method names: 'ClVR2ENeTdIrywF315p', 'tTxMnoNRWBqlOTyCxkR', 'VQ5fbMNDgDtnuyHLjos', 'Gh0AqINLscOmwd2qR1B', 'IWF', 'j72', 'l3Juj4ZAt7', 't6XuCHIGId', 'j4z', 'b4YuUgPpkc'
Source: CrPH91TEUL.exe, VV37Pp9X2VlD6TPtEV1.cs	High entropy of concatenated method names: '_223', 'N58kBTyiLOO4MXuAC4q', 'oYnP3yyJv2Xw7ysyYsN', 'KRLQxky4ckJVkhQjBYG', 'Fsxga2yOkPhL3sdU2uM', 'nEo6WKyy1ydTZm4icD2', 'IrYk5cyMqaftqspkOsk', 'VURPMByjQiKk1INvA4s', 'UEAXYky9PW9ltWGrxCD', 'dfYw7qyNbZGUBsTgPFZ'
Source: CrPH91TEUL.exe, UvyVTe0UpZd8MhKkojZ.cs	High entropy of concatenated method names: '_7zt', 'kgoXOAJ0m1', 'YApXdNFxAH', 'mGLXpgGCjP', 'xNwXP4KoZK', 'PEwX7FJdoH', 'I5IXMeDyR9', 'TVxk7hhjROQNNttg2Kg', 'pc5Cj7h9ooXsNRgQDRW', 'lY5GBFhyVbn62CuRLC6'
Source: CrPH91TEUL.exe, KJgohWB7rttRow3xiwd.cs	High entropy of concatenated method names: 'JKY0pqGetI', 'pu20PWLyCS', 'mK8077HvEJ', 'uvx0MwUydW', 'cWh0ASjOQE', 'cY4uFXIT3npHtcABwr7', 'hlTd43ISo8CIoZc2e2C', 'LuiGsepnfSjFuRigfMW', 'IivIpspz529Cv21PjJk', 'v5kQTfIHnyepuuRrti4'
Source: CrPH91TEUL.exe, BNeQNcs2XWyDLM9cM9U.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'O0VxFnZTjV', 'PgNxgPrD6K', 'GvfxxwNjrv', 'zIoxbnlMno', 'DMlxicUwSK', 'lfOxQ9vgWG', 'DMmPP0EeZO5NCSAAWwO'
Source: CrPH91TEUL.exe, GdYMTMSyrIkZ7hKZmrR.cs	High entropy of concatenated method names: 'F0D1lEZhSn9MTAp1com', 'j7Hwh8ZUEl1SVrVZNTf', 'vj2rfrZNq5JJyMfo9Jh', 'IgeuoSZKgMfbKQIYDf1', 'BD42c3waxO', 'zUEqLMZkue539YDeEUv', 'Id3keZZxrKPcKIt4CLA', 'LMvrgJZmYAC6DwSZvq9', 'D6XAiBZBCsYJw6Pmfle', 'hICvrxZrpHrZZJrgdUQ'
Source: CrPH91TEUL.exe, I6QDRgZUiwM1caEeJn.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'Nnh1HCw6PE0WFIUJMvH', 'oA3hx5wV45xNqa2O02M', 'BEvNN0wf6Wn43QrLqim', 'trjBQKwlMFMsm6MiNCb', 'ecnkY9wbdLJXRNAZ2Ex', 'Qn3Z84wgX07mupXUKWv'
Source: CrPH91TEUL.exe, lMmAurBBXucVgw5IZ8e.cs	High entropy of concatenated method names: 'LYqB6JCqFB', 'lNBBZDLS67', 'G1MBT39CeX', 'uvlBWWDoq6', 'Lh0BLKOhyV', 'oJEBwGmBhr', 'ev2fQgQikHNX3nlqQZJ', 'XSMde2QJtL5cW4l1drI', 'MLEU8CQIVTJZw1P1ixb', 'Q53oWQQW2aC50Gk6uyd'
Source: CrPH91TEUL.exe, NlbgyUBcAK3LxxfyGg3.cs	High entropy of concatenated method names: 'qEJ9lkTgkb', 'dAVu033aiMjd6ASGtsa', 'hECQiq3C3ZJJDdwIaob', 'p5flIW3ShihvAyb4RwC', 'fuCFPH3H4xfmZe7Likb', 'T78nOP3w2pEKWxie7Wn', 'cSs6JF36tKKw7LxpoyK', 'he4jtL3VNWLjBJ4wMxx', 'RbcS7J3fewkOHXYEuV1', 'kUQZKP3lOgDdORLDRft'
Source: CrPH91TEUL.exe, X2VNOJ7lW9K1ZLu2HP.cs	High entropy of concatenated method names: 'GlLAEwKab', 'Rb6FQqs6M', 'dqBg28m3G', 'pZSxCI4KQ', 'GFob85gjZ', 'uRuiIvvFr', 'FjxQvgyfQ', 'S9eUp3SfNODD2CpmRe4', 'w7GXWaSlIgrwTOA5bIs', 'DhuM0rSbNgVbtUeduh4'
Source: CrPH91TEUL.exe, pFn89UBnvfIdIG7hRIx.cs	High entropy of concatenated method names: 'mNl942NEsh', 'rQX9klGevq', 'bpB9IElgsg', 'juY9JFwX9h', 'Uqk9mNeAnD', 'jpF9E8H6I0', 'DdE9oICLnr', 'j6rZ4mdN1gSQKsNeZYY', 'lCAKWOdj5Lmd1HukQoC', 'epjOnid94F5ByCovwyA'
Source: CrPH91TEUL.exe, CQwwZf0AAUHSj4wLovL.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'BZuyRZjTSR', '_3il', 'ixayVspKKB', 'c4qyBuVOMV', '_78N', 'z3K'
Source: CrPH91TEUL.exe, Y0IIqnssGVmlSfZgeF6.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: CrPH91TEUL.exe, IK4049VIasLBINF451B.cs	High entropy of concatenated method names: 'cv6VwF6b7x', 'xEtJYNbN3by5RNOYbpE', 'u5vGslbK7htca3ZbgmN', 'Bm5wfobj8TRdfsbGhjJ', 'WQ4RAHb9QEE6Hr7RpHQ', 'ydw6ynbhCEIDUvECEuS', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: CrPH91TEUL.exe, l10rPXsBl4Eo3jHYTsv.cs	High entropy of concatenated method names: 'JOqgDJNG5H', 'SZIgnMVuMa', '_8r1', 'oqPgucQA96', 'C0egfJh9Bh', 'IFng1KpNAT', 'Cc9gX0F00Z', 'cBD9opvIRq3C55Zthrw', 'vqeSaEvWU8Ay7jrWD2l', 'amICiaviSB0ZgZGb6GO'
Source: CrPH91TEUL.exe, GkTgkbVWufTXixhcWrT.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'usefgpgm6Ib7gLxIwhu', 'jndUIvgBWN4fFJ0OWQ6', 'MJWn24grfH029hSpqty', 'EqKm3vgDQhBFPO5QEdP', 'uCKTQ3gLBnUlUgCm4K1', 'T9LIwQgeuckBjMbT4cY'
Source: CrPH91TEUL.exe, ftTht79aLp2GjVFbB0T.cs	High entropy of concatenated method names: 'tmADZh3FDl', 'uAnDTZT2nV', 'thCDWLrwXU', 'aRPZ88yZCAgVe5mQfdR', 'd4uyDAyP62cNSKjW3bt', 'jU6W44yuO2YNuCBTIJ3', 'KriEQkyA0Lxmgqlpp96', 'PUPeo3y8XMLNLpJURJG', 'cEvqHSy5MplwQiC4OWN', 'eTmPJGysK8oonnH6M6w'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files with benign system names

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

File created: C:\Windows\ELAMBKUP\csrss.exe

Jump to dropped file

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

File written: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe

Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ELAMBKUP\csrss.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Recovery\XnhYPNWiKV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Program Files\MSBuild\Microsoft\System.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\AppReadiness\fontdrvhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Program Files (x86)\Windows NT\TableTextService\en-US\XnhYPNWiKV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\apppatch\CustomSDB\XnhYPNWiKV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Program Files (x86)\Java\XnhYPNWiKV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ModemLogs\dasHost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Recovery\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\IME\XnhYPNWiKV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Program Files (x86)\Windows Defender\en-GB\XnhYPNWiKV.exe	Jump to dropped file

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ELAMBKUP\csrss.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\AppReadiness\fontdrvhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\apppatch\CustomSDB\XnhYPNWiKV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\ModemLogs\dasHost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Windows\IME\XnhYPNWiKV.exe	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /f

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Users\Default\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File created: C:\Users\Default\Start Menu\Programs\Windows PowerShell\9e8d7a4ca61bd9	Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Memory allocated: CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Memory allocated: 1AA10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Memory allocated: F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Memory allocated: 1A9E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Memory allocated: 610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Memory allocated: 1A2D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Memory allocated: BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Memory allocated: 1A890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Memory allocated: CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Memory allocated: 1A790000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Window / User API: threadDelayed 906	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Window / User API: threadDelayed 1082	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Window / User API: threadDelayed 364	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Window / User API: threadDelayed 364	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Window / User API: threadDelayed 363	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Window / User API: threadDelayed 361	Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe TID: 2332	Thread sleep count: 906 > 30	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe TID: 2332	Thread sleep count: 1082 > 30	Jump to behavior
Source: C:\Users\user\Desktop\CrPH91TEUL.exe TID: 1840	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe TID: 2344	Thread sleep count: 364 > 30	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe TID: 5180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe TID: 3120	Thread sleep count: 364 > 30	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe TID: 4280	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe TID: 6720	Thread sleep count: 363 > 30	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe TID: 4920	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe TID: 7104	Thread sleep count: 361 > 30	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe TID: 2080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: CrPH91TEUL.exe, 00000000.00000002.1479658020.000000001C065000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Prod_VMware_SATA

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

Process created: unknown unknown

Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe	Queries volume information: C:\Users\user\Desktop\CrPH91TEUL.exe VolumeInformation	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe VolumeInformation	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe VolumeInformation	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe VolumeInformation	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\CrPH91TEUL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000018.00000002.1545389131.00000000027E2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1550031376.0000000002318000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1545333587.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1555847675.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1476064693.0000000003012000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1555847675.00000000028A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1545389131.0000000002791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1476064693.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1545333587.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1550031376.00000000022D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CrPH91TEUL.exe PID: 1796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 4832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 5828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XnhYPNWiKV.exe PID: 4032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XnhYPNWiKV.exe PID: 3580, type: MEMORYSTR

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000018.00000002.1545389131.00000000027E2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1550031376.0000000002318000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1545333587.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1555847675.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1476064693.0000000003012000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1555847675.00000000028A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1545389131.0000000002791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1476064693.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1545333587.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1550031376.00000000022D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CrPH91TEUL.exe PID: 1796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 4832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 5828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XnhYPNWiKV.exe PID: 4032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XnhYPNWiKV.exe PID: 3580, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	223 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
CrPH91TEUL.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
CrPH91TEUL.exe	100%	Avira	HEUR/AGEN.1323984
CrPH91TEUL.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\zJkDGXNxvq.bat	100%	Avira	BAT/Delbat.C
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	100%	Avira	HEUR/AGEN.1323984
C:\Windows\AppReadiness\fontdrvhost.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323984
C:\Windows\ELAMBKUP\csrss.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\MSBuild\Microsoft\System.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	100%	Joe Sandbox ML
C:\Windows\AppReadiness\fontdrvhost.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Windows\ELAMBKUP\csrss.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	100%	Joe Sandbox ML
C:\Program Files\MSBuild\Microsoft\System.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\XnhYPNWiKV.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\Windows Defender\en-GB\XnhYPNWiKV.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\Windows NT\TableTextService\en-US\XnhYPNWiKV.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\MSBuild\Microsoft\System.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\RuntimeBroker.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\XnhYPNWiKV.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\AppReadiness\fontdrvhost.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\ELAMBKUP\csrss.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\IME\XnhYPNWiKV.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\ModemLogs\dasHost.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\apppatch\CustomSDB\XnhYPNWiKV.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	CrPH91TEUL.exe, 00000000.00000002.1476064693.0000000003036000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520413
Start date and time:	2024-09-27 10:44:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CrPH91TEUL.exe renamed because original name is a hash value
Original Sample Name:	45e062359599639b25a55a72b065eb1d.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@40/62@0/0
EGA Information:	Successful, ratio: 20%
HCA Information:	Successful, ratio: 58% Number of executed functions: 227 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target WmiPrvSE.exe, PID 4832 because it is empty
Execution Graph export aborted for target WmiPrvSE.exe, PID 5828 because it is empty
Execution Graph export aborted for target XnhYPNWiKV.exe, PID 3580 because it is empty
Execution Graph export aborted for target XnhYPNWiKV.exe, PID 4032 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: CrPH91TEUL.exe

Simulations

Behavior and APIs

Time	Type	Description
10:45:35	Task Scheduler	Run new task: WmiPrvSE path: "C:\Users\Default\SendTo\WmiPrvSE.exe"
10:45:35	Task Scheduler	Run new task: WmiPrvSEW path: "C:\Users\Default\SendTo\WmiPrvSE.exe"
10:45:35	Task Scheduler	Run new task: XnhYPNWiKV path: "C:\Users\Default User\SendTo\XnhYPNWiKV.exe"
10:45:35	Task Scheduler	Run new task: XnhYPNWiKVX path: "C:\Users\Default User\SendTo\XnhYPNWiKV.exe"
10:45:37	Task Scheduler	Run new task: ApplicationFrameHost path: "C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe"
10:45:37	Task Scheduler	Run new task: ApplicationFrameHostA path: "C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe"
10:45:37	Task Scheduler	Run new task: csrss path: "C:\Windows\ELAMBKUP\csrss.exe"
10:45:37	Task Scheduler	Run new task: csrssc path: "C:\Windows\ELAMBKUP\csrss.exe"
10:45:37	Task Scheduler	Run new task: fontdrvhost path: "C:\Windows\AppReadiness\fontdrvhost.exe"
10:45:37	Task Scheduler	Run new task: fontdrvhostf path: "C:\Windows\AppReadiness\fontdrvhost.exe"
10:45:37	Task Scheduler	Run new task: RuntimeBroker path: "C:\Recovery\RuntimeBroker.exe"
10:45:37	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Recovery\RuntimeBroker.exe"
10:45:37	Task Scheduler	Run new task: SystemS path: "C:\Program Files\MSBuild\Microsoft\System.exe"
10:45:40	Task Scheduler	Run new task: dasHost path: "C:\Windows\ModemLogs\dasHost.exe"
10:45:40	Task Scheduler	Run new task: dasHostd path: "C:\Windows\ModemLogs\dasHost.exe"
10:45:40	Task Scheduler	Run new task: System path: "C:\Program Files\MSBuild\Microsoft\System.exe"

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\XnhYPNWiKV.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files (x86)\Java\d792c5fedef0ed

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (956), with no line terminators
Category:	dropped
Size (bytes):	956
Entropy (8bit):	5.905675757690036
Encrypted:	false
SSDEEP:	24:TUQwAbMibXY0hjIQ38CRm6otY5fwvnLkhvkefAo:TUyMik0hjIQMCFotAfwvLkhv39
MD5:	3984D98A1ACE72D485480FFFD5D799FD
SHA1:	1511BEC26359D2DAF8D6102287792E5DD32F9F2D
SHA-256:	0C2546309EE433EB7E67F457FF628067DD49B3521B937650DB05A3A5111AF3AC
SHA-512:	F1E81AFE088B24F4358C70D221A0509B6B6F169CA75A7E249DCD8CC245C7ED8AF22C2F581BB5ACE9CB16A1E0C5A2E43845253D047D7BE1CE878630BED647E5DE
Malicious:	false
Preview:	XSgawKfibEUNySulErD9AOChqWTlMuSeDbeorK3qvOoi24zp1tyn9L6IQ9tZ14WrwzKWyG43xWOwjeowhntd5of1fVXsbez126wDuc1uz5zm7JjvU72OK2wHTS1csLcThW4mslBEv9oAy34VwmYdlkr9KotclZCncgEkP6Ds6ycLOwSaXfqGx9s6o4cD2jcW6AhSyTG0jpgwHgvYWSEFs50dxI5Ud9zXVGONP9mEZ0hHc5yIJErkeXnAKDepXvWjzJbBShJWpAp2YsB2TxLZSP28cNCLf6qod7SSdx0l4U4ervlcCmWkj6QkRciEf81tTBYbasYg6jf7UXQrljI2kGEhqrBAOvG6dLLqWKCUNznAbTP3M1d508JN60usrXSKdieJMkVahxpucEGXcHyXSLGeC7ufZTmzhdg2yGqmfCXCSYv1uXQkj42SbAHP0zANLzM8hOjVaM1PxELnM2vCDCQmlOax9bvqBK0dMwUgx4JWDmfXydD8E8KIjjXTxvW8aLNmNsbZhOOI24j8tD8fYxlDAr3mYAsChK52Y2JGBnaztBQpAZjuw0knjKmfyyBggMkr8qk132duXvT8bOm9a8PqkSTOPoRMm3ThaiqTzs14XzQx0nDkMBFh63HqXWlPkRIdcwi3hSJsHVTuCfXlkrAkxwkgaA5dHlTGqwVDFKC42XalkXo28Ao3RipqMBchWqkfBNDPKTfZoFsaV86DVDeH7ZyIHp1ErfhLw4kWTZspeOPLzPUNEZLTLdilY4IebbsIignbYku6VzmsKnS1Uo9STO9TW87YQNNCgGnSm2zepO7W10bvmQKxcZyThUFanVqImkLDA9PbzemFQnbghMw9DZkGRTvRxY1TizuQoXumBs87wtC42i2ajqFM9EvqO7oanTgb2K1JbK8UbmThR0ZOgau2uiRklEXDDiUdNlBrrt9ZruuXuOZXiZ4M

C:\Program Files (x86)\Windows Defender\en-GB\XnhYPNWiKV.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Defender\en-GB\XnhYPNWiKV.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files (x86)\Windows Defender\en-GB\d792c5fedef0ed

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (654), with no line terminators
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.89944186285238
Encrypted:	false
SSDEEP:	12:bdeJzL/oFbw1HlqHoE4ise9eX1UEB0gDbHD9/nuN0ZY:klL/oF6qI5e9eX1UEHD7JnrZY
MD5:	DD5E8F743803895A722A4BDADAB904BE
SHA1:	DDE360864AE84AF037F789DF2085E9470F80C475
SHA-256:	720671673A83AA071F3D0794ADEF69809E8D0723A3F5BE802DA36E59643B397B
SHA-512:	8DBFC65979B97481CEDCD7EF64B0B84CEF987B37F792A9487331705A28F7950025855FD26CBE15CBC9362029B2DEC96C085FB00FED6E22FA782A786AEAFC9A19
Malicious:	false
Preview:	b7wdwE4Zf89l4fVHBSB1qmcKykJVJcUjUwhNPNIjxbexUymQwKOGlJ7zeloL5iPCnZQI7I1yKcDOIozA82j9NO8Kyssnj6nPMbK5hdSoSa5JGtqzvoNC8QyZbGUPZOPOyyCqe4cfj4qxTzEEB314skQ5nudbJDPELrURrAV0LscEkBGmCPNgWUfNiGDtbBWgplllewXBhAsAILVlo1Y30tr1LHtk7lZKW6Z8aeHQ1L8WleFWvbEjmcp54taXCxE6khoLwXLKtIBpuVPqBXzfgzi3RdDqDuNEGCvD04jYP40daAKjetVo8iZv9v4TTfG947iskM0HybQm9EcQSeMTYjGimAEE9QFtx0jdcc9R3O0gSxv4SnAyTwlV1AFjIvHhWhyIf9x0f4aJsjQzOJwWPQZAPNmcWZJHHSKu8mZTzKSZWbnRuPV89vRFHx3RWVdGuTCZYf1ltcgF8AoxkUsHDKHWAFnKtI6erMoCZN2OYtPhOMHHIFrCnWCkLqYT1q2lfCXvVmYWbdsU5kHy8gCna40VJE1tyjXr1nCMyVvgrUkJnsplikVVoOKkLCmRuph2GBcRi49muf6GUqrbZQKOOBDmdbBvtevBwsDlPXDnkskISDPeVK2efTnE80yG3N3Qu4UmnFLBMgnga4

C:\Program Files (x86)\Windows NT\TableTextService\en-US\XnhYPNWiKV.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows NT\TableTextService\en-US\XnhYPNWiKV.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files (x86)\Windows NT\TableTextService\en-US\d792c5fedef0ed

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (787), with no line terminators
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.898674168598616
Encrypted:	false
SSDEEP:	12:yMmngXjaypR520xW49QQKaf7+gLPkvQ2lOP0fBN85qZgVLiTGV+:y/nkaypL20XuGCN4+o5qjGV+
MD5:	EA92D82106A660E43F2BC3DDE8B1FFB9
SHA1:	EBCE175F481DAF9C6FC6B78BD71B019B5CA2609B
SHA-256:	AE022F6ACE32CA33DC2CC5030BC68CF3AC7D003D7F963BDC6A89C60A154B5415
SHA-512:	06A12B208E6F9797FED52CB0DA8F4567FB91A1C4252E8CF5936BE2531495F1FA0992839C9C4655BC1A9CB0207C012336F9954B3FD3F0BAA97137034260F8E68F
Malicious:	false
Preview:	aUKAx3zXoAfooI4j4qxaLmnxd1G43ti02HvOdrhAbKswYmOI5vvI4GlyrWg5w5e5bpwgXqFMJx8A40Y1n78I7a5vg7gHKmNgqwUs0rvPqj8HIk307pSy6W7BtAAaK8CgjcUIgqA5MtbYbyn5DpJeUYjUyT9zrVErgbhpPvURoWmN4jj5XFWfyhMK3ATNqLO1ou19Q7qRU107wWaPtDcl8j39PXwPcHkdIviKrjoZZEK7rPYhkEdntm2F02u3LazNQWyAxQhKYCM3Y5S98PoXo7ug2cTyyvO8O7qUaXtUgTOqZ8r5kv46wciTmSIU6sVmyOpaP7jlfU1UsDG3vYOD1SLwYXrHPYXy7l2KTQpmLTaclOkjMOjieRvgD2B2QbVG6DWHK6kfsl1i1tLKwH5BzyTq0WHbOxWu7Tfi1dYPnE03ZMoTr1FIfUQItqQyyJQ5OHliOnTTspXv8aQnsyuXrNOmCXyKMkbex5oSlFFDhva06fKTamFAZ3NB28f0yJHHO28Cv7Cmtqz6xYphNfujebF4snZnkOOYoSmEhHhckdRsDQNeS8nTYhnwxDUIhZCebaSfwl9F7S9BKW0bZ5Vlk5AGozQdwY4LbwRm8ssq8hVGimmaM3tmEa3gaL06VgTjXyjYFOcqMonDj3iCNzR3pRHB2uLw2vVcOwtuCOV8aCaZw07hnxtfOZ3FqifUCqyaTLzxKyA8eTdn1rOCxoJEC0Ny2nDesA5tN9GlBJWzxuB55QO8TdhYguYc7A4hufQdXtZ2lmAnRURRzR3mZEK

C:\Program Files\MSBuild\Microsoft\27d1bcfc3c54e0

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (344), with no line terminators
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.862906775084405
Encrypted:	false
SSDEEP:	6:EFcvU+OwBe1SiqTE2qlGSg3SeJAeTFw0CLSuKLofdRyUbqe+91TyprwQ/HpK:EFfwBe1u1/3jJAeZVCLSlgRyUbM9RyGP
MD5:	07898C447F4B9BBBC64CB0A08B8A51AC
SHA1:	CA48F032D9950C150FB077A8054D7FB62845179A
SHA-256:	2F91A1063A418888BBD74A6BF80B83B150D03EC2682B02B21196F166363D6965
SHA-512:	386D3F69C75460AF7EE983B261F07D4F8FACD0CC6C362F682DA8BF1DAB29C81E828A82A2FAD4F44AE6A8F8223457890BFE381923CF375C6A63606F4A3C94AC8C
Malicious:	false
Preview:	icUAg446qJJMdQKpS9yhX0PYIc93mfZqvOeSrxlqVVYrvs0HPTxSka7rN61D5BULtdaOv17eXIMBcinal2oTrHGUQwEv6hvUBN7RRlVXVS4bO6PpSacCWAdmXG88xMi0X29PkVJAgQ7ZNoGUhZcgFs7AtV3KnXkJuDEV69E7QbfFDDZt9naXtCvo49fPc8WJqxpJjuYhVfPnM17p6KLA6MarSZb7eyeRFWZPYQJPO3CNwHcCBzTRxWNdX70KTbDgA8izcrRqA5vDJM5L6Y5ofNdtJ51bZ96xzgNyimjTinQ2kKULBoN4gYAxezqh0zQB98Nn9HmUylG26lI8lpZvvBRa

C:\Program Files\MSBuild\Microsoft\System.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\MSBuild\Microsoft\System.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\d792c5fedef0ed

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.797147754035961
Encrypted:	false
SSDEEP:	6:Kiyn7WhWcgASlFjHVcrhaCZDTlEBbIcmBxSCin:Kidh3yFDqrwCZDTlEtIRBkCi
MD5:	6C1FFA7C9D505722BF676D14C5CC84D0
SHA1:	621C8749A9CB02E23C2E441EC9D634DA578C1A8D
SHA-256:	FA9991A034F48FC29EE8B3919100671AB78E460E510799B31D0B828CA0AAC02A
SHA-512:	55240BEACDB6657551FFF1B0731A8C12F788470117A4645C7024D109279FCE8E84130FD9F6E64945E72169CA598783B8964D859AC65311CFE9E3A560BC8AD148
Malicious:	false
Preview:	t5H1XXCvpQsXd13yl0VjPVra4BeXtSFBh9vRSs1Emv041pWJ4MDfRg9YNr7W3oBWLqzeFlg38Q6efxiPoUcgPkuB9XElvfL8tdtKz1ETqJgAke3aJrriLfGk6yerh4IdF8vBDXZwQJ0FDuafencDxnxOWJOBWWvvBD5ms1XvS4SBoBgMX9N3cEpbLho4IYa3XFDAzywmQqu3VvjVmCnXI2S6YdbLNdm3eYoi7gWjMlnwUwGZ7TRGvCufwG

C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (892), with no line terminators
Category:	dropped
Size (bytes):	892
Entropy (8bit):	5.895692113576668
Encrypted:	false
SSDEEP:	24:lrL4ry+Pv8tQsJ4XsXaIQSTQl0tfYSDComST/RNd3/:lrGykv8tRdFDRoSbfB/
MD5:	387E41CE0851DB0AC31AE4E956A968AF
SHA1:	1D9FB208B52AB1F9A39A7F2021644E5DFCC8BBCB
SHA-256:	CCDF8737E627BE5EF5EFD4E4C557C0F696A4E76A747B2061F27AE71F251B2F91
SHA-512:	D023408BA79672E11B9CBFB91F902388334AA155C60DDA55367A62208F6D6160A1311DB35D3B61920F335792D85C3AA8453753117A9F36AB93B6E36F2A1F7875
Malicious:	false
Preview:	Q4L6nW8GGFR1eEUMroU7xkBF7yw88yj4gkXghWQDjs7jO4QvsEebwzGq2G8yk9ISgXV4qyoUYRXEmc0DhAP3TIIqerobXbckkoC1jWE4aJCecBDZP4RjtO8YPoZ9JN66yxe8Z9eL5VdKFnOcoPMcK30Vpom46FuMNGqogF9PaGoYvyTlZ7V4Bew57JSvWkO0kQ787j5iP6CEObj1VAf9u0LsUurXxO201yyf1UozBwoEbsqfjaZVFPFtEOoM2hvBDMManE9AWp77MHRlDMyWyhvmsEanqb7dBmAOfQ2ebY9ZRIh76CIptYNgbjsinWU5re5kGCGxTT5ZhVVjhdqnSRunYex6iU1FDDrwN7146VVZdx8GNIAKprmauRLlOJP9czVeniWklwr65UJlfrsZTqZWaRC5wPpwGW7ncecpwZi2ApeaIjFhbzqva9DVgayWH40jWgIBODn4IgWvxmxMJHVQpMNdbHIVkMvGz4DlbESYMvn3nSh4nmM9ik3KTpkH4RT5uQ53iLuFy7E4jT0JjOs7AwhPA3SveLd4crIWWoVb2HKlf9l9zbipjV58sq2p39kndJb1Kdw43QF2l5tBSS6DmxVGvKopwpi2ggHWhtyWonwSPCWx70XkChBqxUGAzHHNsMWFyWdidjY8BD1sx0s5S708fbiNmyhhgijCpR9kXyHcJCoudXN8YL5vWYjWyQ5pC1cddyDf1Hid0XzdxytPliIUnypRrmwG2baRjLQoUrGQnb59jGj9gqDdsI0pIvyOVblY7h3mhE54c2qL2qslDwkMX6ibUkgi214L0gCBN7bbvJB0bowcDMLj1YAB8bR6iWBk7fUVoqYGUIbO4rApyDeqqVUcgACvpe3YIb36UaxXyFOs7wGRblIe

C:\Program Files\Windows Portable Devices\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Windows Portable Devices\RuntimeBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Windows Security\BrowserCore\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (925), with no line terminators
Category:	dropped
Size (bytes):	925
Entropy (8bit):	5.915316239676338
Encrypted:	false
SSDEEP:	24:MZuS9klNeR9R1+95/6/Jh4ryKmHiG9zu4B615L5r6j:2uOeoR31I/CAryBI4015L5q
MD5:	5223153A7FBE3B27B22F03E7287E1041
SHA1:	D62F65A92593AC8AFF195FEAE19E0CAEA1EEA63E
SHA-256:	C120A17AB842343F5C67508E02B900E78479E8A0D439E2D53687BE94720E6F32
SHA-512:	ED05C4E6B9674E22C8124CD320147D47A94A7E66A8CC0C0D3791667FA59BEEA362286741A47F65281A895C24EEBEFF4A17927D1A65D78C47CC5672E339116E7F
Malicious:	false
Preview:	q0nHseEnC5e7QbnzK1RmUB6gXTCkFFKhFCtzWpWWOUncI8jC0q0ekGko3HuYbeh7u71Osxdef4XAXdXZu9uYPq68bE6P584uxqrLGUUCNV8qskRZtUocuIrEA3xo1Nig9nMrwMTZprL3rQQ1xgfkUcAo8nKMhqKAxcqFXjnhBOxC7yWum60Vr7LgmisICG19gLGPjLdN28jFp7qJRZjlzzSzQKcy0fe5XygwsHLbcndsYG1p2j1ngQJq2R8YsoWWdos1b3bJNIILWjaKTw6Ro1YGoz4bJwtyQGPuX9N8HrZYH7UT0xF5sFsmPlNm9AAaYU5PUpwTj7K6cA9qekkVrxGLXmfvwl9Gq99xCE9KAwWu4vJOmgHYaotlOt2rKAh78DQcALnZlZU5aWQmdQJPdkqCQXjSMRA9OYv0fqNa3sxAUxL2cPO31RdYXOMnmUMTZVqBkaHwCsWvwprcMrz7DGI65WdRekyifdl9HJRCIc1J5smrgua5ePQSMtGO6zSc3xQTDsVDZxylP9AMuvvtK3DPNTwXCDGSKYPIbSoxZXfrbpDNt3dKEiSAuBGu68AWqfb0t2vbH8UwXVyhQinIj5OlGOXaM30bWJA5NMe0ICCGOfmYMieYU1wvRztefUONH2aOU2TDExAh2IXlm8NoZcHfWPoYc9Vxxz8VFXEUOaUg1P2JcI2gHkypv42EO5lEcMuDJBgO43Z8IknGXf5UHypMATkKe9FSzPEoey9bmnmOKzhKQvrt9R7ngiCzaVu4xHI3g9miferdMbBKwZ3tSVSiRaH6vKAQ3saDqnnRJIOfjebFg2DBcAlbyklG1pwVebkdA7dIvljKHx9x8Ca3G9y2G8PGChZeV3BI37EiY4P0bbUBkyHzO3OfmsXBsXGOLFyOw03A71fMt7booOfNZkPcogfLk

C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	5.73406514391602
Encrypted:	false
SSDEEP:	6:XIrGsRpWdBV4mITYcFcVlJF0sy2NQYd1y67YHamyjQ59LY:Y9WvqmIccFcVlJmsy2D0amyjQ5a
MD5:	E275446B0C3E8311C27312DDAB40F15E
SHA1:	3DA16A4D5DF87A79F14E2D012D48ED6854E162D5
SHA-256:	E652F337EF6BF0CB78DA957C4A64E97681F5A690E653E85CEB0F8ADE4B183216
SHA-512:	00C3AC20C4E8CF4A43C830DCBF2ACD5A281D0DD5EEA0DD3B34A9279099F295DE866BB19E2FA1A21A53BDD65AF2D2C8465A566CE08CBFC00C78DBF0374EF00128
Malicious:	false
Preview:	gcE9nYj6uXyUYXtn1P90S8pHnDgY4XwVodY1hncwbPwQsGg7pipLiv8hx7Vk2KCWkcq581GNxMZCMYZhhisWslw3e1EkS13RNZqPZk8ybcYWW6UYiyDUbpo8pxbHxf45SHywsJH6j44PMaghgpBeyjzivrkmJ1B5hcEOIhqZqGuhuYvPQ3lHeaHsSQBAjexs38stVSZ89mxszSxW6UWQQ4bGVV62fqzLTCnvpC38emH1nY39cpDOIgb9hmXAWgcSwlZwoBq3aXwnwjc7b6Z0mlD

C:\Recovery\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\RuntimeBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\XnhYPNWiKV.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\XnhYPNWiKV.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\d792c5fedef0ed

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (859), with no line terminators
Category:	dropped
Size (bytes):	859
Entropy (8bit):	5.913131978143718
Encrypted:	false
SSDEEP:	12:RX/LgRpKPDCIk98RuzQIsxS8E4uhbg52umbU2XfXD+Q9OFolxyyrCSTBk2i5H2n:x/LZ7e98GUDChbwzmYC9iux19TAH2
MD5:	69FD2DCB5E5F4D359B3F7F3640A412F3
SHA1:	893049A671B3A1D93A59E4CC47BC34C0E2D38A66
SHA-256:	B8FEFC632DECA3E31272F140E9ECFF31ED4D67E68AC9F35EEC66300136D1B2DD
SHA-512:	543B70B29DCCC0FEE72BA734C3DC51FAE7C429279B2E832CC3803C0203BDDFEB0A210601CE822C96385F1DE1E163E83F14C2914D41A6CEF36ED96A661F8836BD
Malicious:	false
Preview:	Y7HBYGpDKhPgmmXBN4LfIcnIw04BMlMzscXJS64Kbr1NQQeA8WXflis6T8PiMo1jVZyJOOsR9AEakZ2fW4CzOqOKtbzTrW8w0S21bUvunFfkdSW3GtLSlBUoLoaxYZjmCRkRhBEBISMILnqbF5N8KqKy7Npx48VOg2iLsEVFoJJTzMdh78sdLlcWGvTUVRHK68mSEfsAjHTAg19vuHz5P1C4aME7uBuXC9W0kLdcQr3ERbzPvikNcM4F5r12avQiX68geILioWpi88m9WzLLbg50FR52UlCebVqVcSvmXBiFgVH7F1fljEH0BIbMNTODUKHmRRgDDjyZ8zTtK7xcFa5WOzTU1iYDxfvVOeqxUbh9Pr2MyrBQgw73PuXb7MMeKvmdD7fqR9Ho35Hh7HfJhIhAh2GeHO0IPCzeFZI1MV9hoTATn0ezrC7CNl5L1BjCI9Z0Gnbi9o7LJAWN2w0QuBbMFwQdd7ALw6Yp4JNAY60CFw3NPsTEKSSHiMvTW8ECnvYMlqTsj01yKYHT3DOvn5BdoRHrY4na1xYTXqliYkfTbd6KFbZTtTYsu5hUjlToNa7X9x5MbpWCarCKU6m6eTrhZqjcIR8xR0GAgjKRgM2E7VRC2X9m8WJ3tZ7SOdEKqivklCovwVaSbmkDZhjvRVz4qMQHl2CCIsXYkqa0sO0m51bGy42r3S2Ut03ZvhJ3SYJtPLdsGtDCfM8yuKSr9VI0zCptwBELE7Thss1mbJkJOzzg1FokPc37PT3Ngt5Fp27i2bGCTpQzu8l9MI2rWd5mDWSYyoGsNfeW2Roa8mRkMDMQr4AY0OsL6VffIsNpjhmPeOH5ebtuMVa9KBq4nr19wTZ

C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\24dbde2999530e

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	92
Entropy (8bit):	5.506726357995767
Encrypted:	false
SSDEEP:	3:iGCXWrGYXs8tPR9cH5CHtRyUworn:vCGrNcZTUwM
MD5:	9301C28E9ADD5B71AB8E8BCEBFF54A05
SHA1:	2E6C6820A00BB4F8FB94ED0CD1FCB528AC8E8345
SHA-256:	2B01B03D96319609514B798CE7F61995A4D02A6BDD5B33464BBB05A71C0A4D2B
SHA-512:	D82B7140E87372A7A19ECD9728889C785C0F3A8222ECCCDBB3DA75835A183E0DD8689CE46CC1C404CE45376D5D5A2482681561D81C1CCB8C0DAD235A303AABF8
Malicious:	false
Preview:	XIXtnWh2OQqgAzZ3ZhtMXfqKj5g1eT93LUFj2HTLjt8cvs8RPybsGFs2bNJr0qY5QxUpuzBRNhnnhOZ17Olq1RwGmMIo

C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\d792c5fedef0ed

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (672), with no line terminators
Category:	dropped
Size (bytes):	672
Entropy (8bit):	5.861663892783717
Encrypted:	false
SSDEEP:	12:IZp0TVAZVr68kemJI9S4eBnzbSeyBq1utyTFyRM/IcjU6GDBR9:kZZVubLKc4epSe75THIl9Dx
MD5:	3A7FF136652F614F891FD0226CE1E7D3
SHA1:	5FD80FF891AD1DFDC54B81520D9C7CFF5FD235C8
SHA-256:	81E2F0C136EA6ADE9B135092365F04CF04451CCDD9AD3D095F7798718E32ADB1
SHA-512:	341589E0284407BD92E9DAF58972A0B18CB0C48867A9F7B1B7E559A7F000602F30582EC70E00712BDDA4A7D692E376AC43416B9A17A8F021CFCDBA676F4D5039
Malicious:	false
Preview:	ux4EtTGlLarHybszIMqmtKyQRw9fHT5t4Q1tjvKym4hk6SUvV7iNI36k8ox7Ule1e7Mik9PWB29ymOT8bNJJvrlAUQu58NeAapG8FvKVsLMQ3H7uVyfGbVGwVLOTPUYyX9Y6HU3pCybjfVHMT9kJrYjFjTn4h0GXxX24tBnA5zDn4gQAEBAPuOG9ZTWxr8ILrDwIcMdRWjO2U5LDCmzf01niR3eaozS6r250tIi2it2KAOpeHTvFJmV0ZO0irDmhRSKbAUT3E77G8diCOASVENxEgEbfR9KeGV2sDNdx91BLpO25qyUqvQdEeG562ymEwcAmkz9AheWMMlYSLfzdoetz1yN6Sh5KO6YMOPV0zUJQ3Q22rmuW9IaStKvvlCr9iM7PNME5K8oTUc5l6UOpwiKGgFdDejOwmKrrSmpfiyMBeG8QOJzRxCMAB1tIsAblt1rKvOSUptG8WJmZGNyVu79k7rpb3hwiXlRmYyfA0elE5On2PTBfLG0w2HNDi1bI6ikv2ABSryePV5osDxLjfRWRuftRlbb8DdHWn29PSsxWlla7ceAuq1mpLTAXQtrQXfL1xREKx6RxdApJEvzGbqSM1bLT2m8iBh9GZiKKZz7tjzMLo1Se4kyqM9AVGuSL8sv5AiufloqmtjmCP9pBTdoatT3ZiyEo

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	5.039148671903071
Encrypted:	false
SSDEEP:	3:WG3kl9KfG2uqpjUzvhdn:Wjf2uOWdn
MD5:	A2D612C8BBE1635BD8D07D27D38FD642
SHA1:	496C650E96CB303101BACD6DAE3EEF5E48AA4698
SHA-256:	FF641239F0AD586976289584392750C3F973D05FDE670D182DB3C65DF38C4408
SHA-512:	4F3BCCAADE9CDB25882BFD3E1A8ECBFD9878ACB13FD3A6999280D661E140CA0CA00ECA8AC6359DE2DA2F8BAE1A496BC9CD168C78DEA898AA6BF265D693FC7032
Malicious:	false
Preview:	zZcLw2wN71cNx0hpEVyW7S9oOWLwZ2BJPHc4uO0Uz76I5SqVJSKgEmFg

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CrPH91TEUL.exe.log

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	5.36827240602657
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpaHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpaqZ4x
MD5:	B28E0CCD25623D173B2EB29F3A99B9DD
SHA1:	070E4C4A7F903505259E41AFDF7873C31F90D591
SHA-256:	3A108902F93EF9E952D9E748207778718A2CBAEB0AB39C41BD37E9BB0B85BF3A
SHA-512:	17F5FBF18EE0058F928A4D7C53AA4B1191BA3110EDF8E853F145D720381FCEA650A3C997E3D56597150149771E14C529F1BDFDC4A2BBD3719336259C4DD8B342
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WmiPrvSE.exe.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XnhYPNWiKV.exe.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Temp\0Wk4yLAJYy

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.243856189774724
Encrypted:	false
SSDEEP:	3:rSDLSIGAQcpK:GDm71GK
MD5:	0AC1BBEA6FA4B9FE12F87BC91AB71A7C
SHA1:	36BE5571263D998C345D8DFB1F4D3EBC22F4E3BE
SHA-256:	5F7F0DCEB983B20DF993ABE01FCAA5B7E0D168091124CB2860E3D9B85766EBBF
SHA-512:	E93483BC1A19D41EFB782517ED5C4ED78620EB12642C8F5DF69A5F30CAC286B557CB47A03A819611813402D335657EF08269F18CC46D1048577701A0F4338F3F
Malicious:	false
Preview:	QNmJ7fnwmc9Tu9aY1pRMapqwr

C:\Users\user\AppData\Local\Temp\zJkDGXNxvq.bat

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.314919630047175
Encrypted:	false
SSDEEP:	6:hITg3Nou11r+DER5SMLeAQfoBvKOZG1CHhJ23fFOU:OTg9YDEfSMEfoB4MU
MD5:	2E403EB2E0D4B0138DE716F566E6AB38
SHA1:	C77A30EC0828AC7574E742A59E26274BB8620932
SHA-256:	FD40A2C50614E46B8EB1CCCCA2336A1DBA6254C9E2F8690AC7EC3E23D4F5EF9E
SHA-512:	E14379E9489B9E48239A8F4929493A006E878D325D8A483E9BE84D0C62714052F4108FE2DEAA866E66D16949FBF2B674301EC57752DF3507CF97F0C534418A31
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul..start "" "C:\Program Files (x86)\windows defender\en-GB\XnhYPNWiKV.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\zJkDGXNxvq.bat"

C:\Windows\AppReadiness\5b884080fd4f94

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (919), with no line terminators
Category:	dropped
Size (bytes):	919
Entropy (8bit):	5.90098767903366
Encrypted:	false
SSDEEP:	24:XtO+R4+DnhPLG0QO+P4BRz1+ZDonqvjNGncGx3:XtOgnhPDcCRzwZ/23
MD5:	005A7B5FCDB4B363975A444A43A16A3D
SHA1:	401357ED19458B340C1193E1C38103CC9E8E1528
SHA-256:	DA85D812B248E25795DCE0DF03406854F6D287F283879F52BF10B15E1B88288D
SHA-512:	302123B992BBB8E0F0E9B624323D76EEC11BDBC72628C889C0FF432C2697C4D392E98917E2EFB9B30DF920164B78AF2D0B93C3F7F99C76AEED710C75916AF3D8
Malicious:	false
Preview:	zQsbO2IE8FkpqzkSk8ZfFFpmqAjD9yPhmF8h4H5lR90rzJyEo5V9nlztlGvNSEFJzCCk0DXdCyNGO8xhMeYDcP4AQP5yWsSM4q1wGOOkh26yXsfmSOBxqBrjIBUlHjHUgBMiGBa7QxfjSFnhuSfIreg28RnE4nd8vmSWg6gRxDh2fHRCYw1yD9nBeTjzXWDmUgyqxQBxwOUn6oW1AlqHwo5w9R2MXr4a94h9SkPIuDCzo9E07rywq60qlCrfYzZFT4oCGXiZVhWsmGH9MCOp2IuDE0XQ3tu5n6fuVCtjJYaIjHEf4rTWkuMLJk7Q9SglxbEpkXoJSofdrme6w2VLZYU3tTkuFcj11yUHDY4hDKD5OsehGBdH6VMZHK6Qw4E0Eom2RW3X7xHPVYpAzDnD8c4gm592cnvJGM0jGlPuIGJIN6Etf5bsQA1mtFPWWA4TC8JIhF3Ox252SvTq0QWhMC2FVO0BV3XHL0GOx6LaBM5XE8U7wjfGoXGAFDwTO224fyqcpE34F6f9HeBW42PwXRcytFItK2LIUA2PR2SrqlAs1G3lCZZWnFgNW2sj5JuMuWpGmvFCkhGwQu6mMhrudzfPeo3ZJswg1y7ebx8QUXvG9u7l6FXXc9t51Zl72p22uj4cxcLZibaGEZPurSdDUZE2ECnBLBXoe2VZzeyd48yAin1bJ1QkMyiVeCYuzJNhDwlLDz5Md9JVkDTaLL1TuxbqUA5wGDouuR7wCpXU6EGNoMvbt7jnR4xPU50D4IFZUYlTGgYfxhXpqNBIPdCJeAd0drbGzUZx9r3QkbVMiD0tgHjH4ryaF64T5uzYESqdIkq9UuhxI0kbKtUWIUMHf8rDwjUzm6HQXXl5bjwJKBSPVdIMadPuFi7K3nNuarLLsTDxIY4jiC7eqbrSaIYIrXK

C:\Windows\AppReadiness\fontdrvhost.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\AppReadiness\fontdrvhost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ELAMBKUP\886983d96e3d3e

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (307), with no line terminators
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.7781125450277875
Encrypted:	false
SSDEEP:	6:qNl/b6kP02VaFAWdPWweJXLhq8rMhcCMfKk8PQWH0/W2gnl2Tyy1fNKA0pIQk5WI:Kl/Wk1l/XLhIqKk8PDhPQuyQpIQk5WI
MD5:	1D86C3BD65E80197FA88429497036A6B
SHA1:	86AE401C680F45DD279C13986DC5B4D0133331B3
SHA-256:	11002B47E6E3E86F0870F0D81EC446D64BC7E25E6BB0316A2F6E3F6489590EF3
SHA-512:	3226A52536611CBB7C073DB1906ACC6EC509433AE9AE69DA732018D3212CF53215D2E28821A7729678FB3255EA16E14218B95C4BDC36D6D4CF701E7DA96F2202
Malicious:	false
Preview:	vpo6tiEwOpEil2nLtsHEtyfTs2G9i3ATUQIvZAUm1kkKfEDTg3NlHRj6JUN0bEOVovOVu1wsXeMJOUyozxcppZLCqLlEweKwWPgu0sjpGeNnFarzfjAomipPjLoiPr63UZw9yDyHNxiKMi7QewjNdfKxjQKoEAZZiTSpnsAcu3bz9fDANXEdIsZyP9Zh2JDMXJl2PSnvwGcjEUxENKaq66R04eZoTcjl0Ob03Lv5uTqBP0t4LVUssWQb2v8v29cTh1t027KCZf6nPQlEvec7I03e8A8HM9Cu1XdYG3BOKRTNZmMmK49

C:\Windows\ELAMBKUP\csrss.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ELAMBKUP\csrss.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\GameBarPresenceWriter\d792c5fedef0ed

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (492), with no line terminators
Category:	dropped
Size (bytes):	492
Entropy (8bit):	5.875047378840113
Encrypted:	false
SSDEEP:	12:9IhEOyTGVKYEM5G9+P5H8PP3yq/3MizFA9:RTGVKYi+58HvMuFy
MD5:	0104077B63140CA99BBA4990F9032212
SHA1:	0023F4260CD52AE235B7D1696C320FF8286F2BE0
SHA-256:	B0EF4B304FB6781DA9B41BD95607A7BBABAE9C2C72ACA0B97885A82AEE3C5619
SHA-512:	397E1E2009E81486EE71075738756441C5A33F801BBBEC3B751BC5AF3377AA26EB86878A36A503F38E9FC48E76000CE83A0146F3A17AE22333436FCFC8430E06
Malicious:	false
Preview:	hhL0WXrd3GMdGnpGSHqVBA0g6Q889YbQ9xRtrvDrdvjaA9f9847rX6chqp3FYsdfp6eSW5ZgE81Paaf6v9AEbu2CUtDC27SvREvEfMmCfanZFMHPJ7UZrZD5Db7m2XoGqG7VpbaiW8jAGd7Hmx24n3D2AzBEPAJHwgt8PvjsgvDtzDykdz9FetdwDFUzaWTVybNku820NKY2zTC7BakZADmDD65JauRKcr5Y0N0f6I2TUl7tCXy9v3UuyKgyDsad2OZHYoGxkFd1LTsc8LHD5SYiWKjprCbNsYbGLzVXQAZqadjfbEz1lWhk00uOFbGinPIw1lQJ0tw53rI3kDOmMkmV10QUEHSz30DLUwnzxqB1kmqIs1nCMdVCmw5BV5Esb6BCo7jxZYzgjuvPJHmNdQmZeAih1me1lSankoduRzmyozd2Bp1NT1PKTlioZC5w474QTHpfo25nnyvogpfMvQiuDPU8FzVP3z3q5Mi4AVjb

C:\Windows\IME\XnhYPNWiKV.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\IME\XnhYPNWiKV.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\IME\d792c5fedef0ed

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (442), with no line terminators
Category:	dropped
Size (bytes):	442
Entropy (8bit):	5.855915556756533
Encrypted:	false
SSDEEP:	6:SfSDsBRQXzqtqATs/WxzwpDLd8Gsn2GLC7PAxJVhS9PlxbtLchoEsDoypipDR/C:7gIzpWOth812p7PA76trLcKEsnItJC
MD5:	9CDD92DA2617F66D8AC080A56AB5FC89
SHA1:	4840149939D2F9719EFFF1BE1C04E068D4CC6BB3
SHA-256:	D1E16A27F9C6312FA9BC3AD2576EB8E5213310F81A9B5C4B1CAA374F6B6BE09E
SHA-512:	03F3DAE8B33BD5D9BD031BA65A36C897E2166E9B09024FDB14F15F0481170353776B62E335A8AF82D27FEEF98788D7A8047132358D6DBAAD54C23CE7DF84ACA4
Malicious:	false
Preview:	8JxuuyM7KaiaHmqLinMAwnPhwyd7eZ7Vl81cxSBwbR3NULziI3eW4UoV4Q86UPcudNyIuNXPlaifuCMk85yk5kaQUfihTFbLyItHWrx5gOuevIl1DY7Yb2y2wiyOp06g8XrlTFNRH3Erz6eL4rd5IDu6U0Uy2jQpSOfYb9i8KpRhxHD0DmT7XAY5muRcuZYinZYlaGu5IevcvMIMxeuQPSRRzkvqsGNvQs4YsbZ72Yy2P5JZlEoQoITVHHv0UENCR9MDSueWFxY1dZB4bWEnb7GHZjQkpjnxKvlQtFH1kSL0uc1sF1Y89jlU2Eote3qgKkqrxvKVONDJvQX7rieyKoylKRXobYWqlpqKvK4UqDtwgbimrrB6Y2VfvFggYg400WhGkMLhnKHH5CEssu6uWaStTKYqnY6KI35J3cCefeSNvOktAxxnjKdZEy

C:\Windows\ImmersiveControlPanel\6dd19aba3e2428

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (381), with no line terminators
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.861401320311636
Encrypted:	false
SSDEEP:	6:XnK2M8jrtz5UuNPG349MzYdpd6Tm2FX86Gaa5Fivx7VS6GW48thXPXFs:3K2ptz5UkeI9MgAFslivhVS6GW48th6
MD5:	06AC307E1B040B3849E9995B519C5016
SHA1:	3D38C237843673EBF8D061874D2DADE22A471155
SHA-256:	E3F088755BE531A187E89677DBD6310BDCD8E0D24B23D8FFC01AA42460F5E927
SHA-512:	87EB2E79DD86AAFD47659F6D8447B2CB3615F0F6AA9943C9E7A119AACA0204A3206299D86018BE7CE0C488F19C75315F048A2CA65907AB664AC8797890C859C7
Malicious:	false
Preview:	QH1lHleu4vTDWYgxhSvblKtLoYd4qncXQvOudTejXEt2TXd0fS5fT3vGXq6sHjEQS6xkJwTOyLDga11R5mYXr7EW9IWwWwbyAdjXj3qt8rrHzOpgypweLqiV1bkBah1CuPg7SerB5pZAP7gvcz8q96mT4NfISpTbzpWjsrOU7vjfRiF44zikjLDxmMDE9jsQW7Kkk6CulnsOXHBVHkOdGs2omi7foJVYCSJUYfU7wx85czafKr6YVPJnFg7B9hGcSULE8r7mQQrTu7LxIbU7N6DwJfP2hS7OrgmInVhdtUIEh03HUK3iNIOVRZ5ccFE7SclNUCKw41O3y8PSmHhXZZBiRQ1OZEAnPKvEOpxSAGoW4VhSJm0Viri3bD6EL

C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ModemLogs\21b1a557fd31cc

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (723), with no line terminators
Category:	dropped
Size (bytes):	723
Entropy (8bit):	5.881794658575051
Encrypted:	false
SSDEEP:	12:mzCV8hNsDormpvZo6//mU+lbiJfK7iOW57jUAEP7FIlGLSPmuD8t7GqJ:mpNjIvq6gSfK7YZjUASiGmuuynJ
MD5:	EB3D1279AFA21D56E17D3E7BD45892B1
SHA1:	2060B41685A630D21EA55B3F6D187E4FD3988437
SHA-256:	2E871A9865F92E631DC739218187031A00D5B205852C8146D1903C05F8189EAE
SHA-512:	DB350D257592C0340D7501D22F84B12856F5C0948D52CDC18E412B795F3678B5A0126369761FC9DB681BAE1096F38D5B8B11A6ABC6C3E86F655CF0F1FBB8AC1B
Malicious:	false
Preview:	WP2m7qM4B3F4SH03qr6KZeP7rwGjx2XwHXfrtgB4dft26WIYjaCOGTS1945KjmHJfSw4lIKKpBq4vWBUnsAW0JpyEnsyk1U0XkXnjNxaQ1iEmXGm2kg1muSWm807aVkyr0hL9Xua5jG8klLrhF59UcNmRBAlXz95RuXw05ne0G6CoUvBwIaVZkdOm438XJDFkKq0NZ0lcaJOfL87P8yOYofrQIK6BoHqC0cdn5xXSy28aPtb66sYUyr5o8kFP4kxTdLoseTUKb6jvhRAZtAF5sVNJhzoUsIXOEo7DEsbnYN32IJHrjpf4e2kH8fKpo9cSiUr2U7VAichebVBXr7vDmctMEzFiiw8YvkTxcOXlUfWCUFpmew7rNYqFleye1wbwdJt1BO5cjKtGGr18KcEvyQKX4OM7a3thDkiLWylQ1eIDpk93m0TZsq7M8V6wB7CqaLCgIqlW0y3TIHrUPSUjjUzXmVNA1yO3bcndhcv6O7i4wnE1omhtmdGGWp4wckfBj92qeOwwhXUmv5k8RWWORfQ8VgH2i8eochUwvXWa0vMPIeUaE5eGOQuEs3V7G4Oi3qJOkxN496XfSB01LqxmeXaLwPD2CZT6gnVbUGzRsjHR2OvqCevaHlEfQ7bUtV2knb9pqZgE0f44QITheXzhn3z4jzKXpfhWrhoaPGAn7qjlrJPHo40WfU6tmEF1OJZV8hMte2RYWMk6TNNZkC

C:\Windows\ModemLogs\dasHost.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ModemLogs\dasHost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\apppatch\CustomSDB\XnhYPNWiKV.exe

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	6.080443996174537
Encrypted:	false
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
MD5:	45E062359599639B25A55A72B065EB1D
SHA1:	B6ABE73AFD5C112110101507621C70168A3C592D
SHA-256:	5F9DDFDE6DD2FA75189FA015B5C91017FF21951A833140E07907EDDAFACF757F
SHA-512:	2BC37C33D292C38D74D81EC2283E0E716596AF7CD0EEDE08A4F5C97219D99835952E85B26055CDF741530376405003D7A3BFAB9F3492AE2B77A31C8B83CB3DFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\apppatch\CustomSDB\XnhYPNWiKV.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\apppatch\CustomSDB\d792c5fedef0ed

Download File

Process:	C:\Users\user\Desktop\CrPH91TEUL.exe
File Type:	ASCII text, with very long lines (460), with no line terminators
Category:	dropped
Size (bytes):	460
Entropy (8bit):	5.79884649023715
Encrypted:	false
SSDEEP:	12:6vopofy84prb2g4hQnEezIyDzTNZB5MR4FGaorlbi:Umoopf4CEez1Oxbi
MD5:	5172C5CD06657798FF6A750005465B52
SHA1:	8923903B33089EF5248FA0DEFEFDFF1466CF718B
SHA-256:	43D9642947BBBC43054FDA3AD9A0034B106016E9EB91C6935B0CEE9015FBBA89
SHA-512:	41E23A7902EBCE974A44530643C8BB2A75B674AEAF173416645EB9780BA598B0F0639B3745F0309B762D1BC4BA4613281064C107280B1FABB32791A2233C7E84
Malicious:	false
Preview:	zGhBZVDCiqLClddb54URTCeUIPXrVGMgTeok4q2EEWjBMIM66l3brbJwlM2K8WrcdotGy3hOBPM6ddIACautNvz1V18rxsGroHhhZGIDEoZcOMTIE1Hhm7Psz1u65zaSIeRV5kl6SrpiVXnJh0m6liFr2zrhVLHONGTt47MdPLP4SqWcOlYEMerkZkdG3ElGjaVOD3OkoIqZSKYLcPTtwDCsZsUTeGkLkIV2UIYVWyaEySROMRnnu1UgYmzUi4FiiezKzg1U08W7m84GbGHMc6bsyzesSDwcs2fUcHZqaSxweW3ars3cw3FlCGV9BIBxM4OuckoUqbvJJpOb5EAkJTpzw3RWvZoSR9kkHJ7HEjvVI5cX23D7Ibn2PZ7iTRiRwd2JFoUwG3fkiTr1b3e2VrJzWrUrLZywBeioDTSNjR0O5CU5sGHZxq5FTDwXTmkrEtjDvCxIlQSE

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.080443996174537
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	CrPH91TEUL.exe
File size:	847'872 bytes
MD5:	45e062359599639b25a55a72b065eb1d
SHA1:	b6abe73afd5c112110101507621c70168a3c592d
SHA256:	5f9ddfde6dd2fa75189fa015b5c91017ff21951a833140e07907eddafacf757f
SHA512:	2bc37c33d292c38d74d81ec2283e0e716596af7cd0eede08a4f5c97219d99835952e85b26055cdf741530376405003d7a3bfab9f3492ae2b77a31c8b83cb3dfc
SSDEEP:	12288:UOdgmsO9ikAILpL2XfOIAnpmRo1pHmmN68Uc3Zy0:UOdhDw3ILp2OIAn9pHjrUc3Z3
TLSH:	8905F6427E44CE12F0591233C2EF454847B0AD916AA6E32B7EBE776E15123A73C0D9DB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rb.....................6........... ........@.. .......................`............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4cd4be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6272A3D7 [Wed May 4 16:03:35 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcd470	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd2000	0x218	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xcb4c4	0xcb600	320a9a668a064ba9bcc6227c5a0b8e93	False	0.506082657882606	data	6.120334626739147	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0xce000	0x2fdf	0x3000	35728281cbee65424710fb95ed758157	False	0.3101399739583333	data	3.242490208772607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd2000	0x218	0x400	a0eb98cfbb72fea7cf0984384d7b3371	False	0.263671875	data	1.8371269699553323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd4000	0xc	0x200	e5ed709ffbc3754a8f120fac39c26590	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xd2058	0x1c0	ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970	English	United States	0.5223214285714286

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	04:45:32
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\CrPH91TEUL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\CrPH91TEUL.exe"
Imagebase:	0x5c0000
File size:	847'872 bytes
MD5 hash:	45E062359599639B25A55A72B065EB1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1476064693.0000000003012000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1476064693.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:45:33
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:45:33
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:45:33
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:45:33
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\java\XnhYPNWiKV.exe'" /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:45:33
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Program Files (x86)\java\XnhYPNWiKV.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:45:34
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\java\XnhYPNWiKV.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:45:34
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\windows nt\TableTextService\en-US\XnhYPNWiKV.exe'" /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:45:34
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Program Files (x86)\windows nt\TableTextService\en-US\XnhYPNWiKV.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:45:34
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\windows nt\TableTextService\en-US\XnhYPNWiKV.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:45:34
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 14 /tr "'C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe'" /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:45:34
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:45:34
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 11 /tr "'C:\Windows\GameBarPresenceWriter\XnhYPNWiKV.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\SendTo\XnhYPNWiKV.exe'" /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Users\Default User\SendTo\XnhYPNWiKV.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\SendTo\XnhYPNWiKV.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Default\SendTo\WmiPrvSE.exe
Imagebase:	0x670000
File size:	847'872 bytes
MD5 hash:	45E062359599639B25A55A72B065EB1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000011.00000002.1545333587.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000011.00000002.1545333587.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Default\SendTo\WmiPrvSE.exe
Imagebase:	0x20000
File size:	847'872 bytes
MD5 hash:	45E062359599639B25A55A72B065EB1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000013.00000002.1550031376.0000000002318000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000013.00000002.1550031376.00000000022D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Default User\SendTo\XnhYPNWiKV.exe"
Imagebase:	0x4c0000
File size:	847'872 bytes
MD5 hash:	45E062359599639B25A55A72B065EB1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000016.00000002.1555847675.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000016.00000002.1555847675.00000000028A5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 84%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 14 /tr "'C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe'" /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\XnhYPNWiKV.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Default User\SendTo\XnhYPNWiKV.exe"
Imagebase:	0x4c0000
File size:	847'872 bytes
MD5 hash:	45E062359599639B25A55A72B065EB1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000018.00000002.1545389131.00000000027E2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000018.00000002.1545389131.0000000002791000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 8 /tr "'C:\Windows\ImmersiveControlPanel\ApplicationFrameHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\ELAMBKUP\csrss.exe'" /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ELAMBKUP\csrss.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\ELAMBKUP\csrss.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe'" /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Start Menu\Programs\Windows PowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'" /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:45:35
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\BrowserCore\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:45:36
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe'" /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:45:36
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKV" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:45:36
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:45:36
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "XnhYPNWiKVX" /sc MINUTE /mo 10 /tr "'C:\Recovery\XnhYPNWiKV.exe'" /f
Imagebase:	0x7ff7c1cd0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	18.2%
Total number of Nodes:	22
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFB4B39CB28 Relevance: 3.1, Strings: 2, Instructions: 600
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`GCK, xrefs: 00007FFB4B3A5010
8m'K, xrefs: 00007FFB4B3A52BA

Memory Dump Source

Source File: 00000000.00000002.1480360823.00007FFB4B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b390000_CrPH91TEUL.jbxd

Similarity

API ID:
String ID: 8m'K$`GCK
API String ID: 0-392388591
Opcode ID: b3c748cafb45fe6cc25c603eebc8c0cc05a67cad484f3f8a9bd8b8d8ea9e37dd
Instruction ID: 1c40dd25ff7b40cc092bf4594dea8428855ad466d98d0902ace6d1d59d14ce41
Opcode Fuzzy Hash: b3c748cafb45fe6cc25c603eebc8c0cc05a67cad484f3f8a9bd8b8d8ea9e37dd
Instruction Fuzzy Hash: 05229AB090DA4E8FEB95EF78C8596BDBBE0FF19300F1045BAD549D71A2DE34A8448B41

Function 00007FFB4B3AA5D0 Relevance: 1.9, APIs: 1, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryFullProcessImageNameA.KERNELBASE ref: 00007FFB4B3B46A1

Memory Dump Source

Source File: 00000000.00000002.1480360823.00007FFB4B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b390000_CrPH91TEUL.jbxd

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: dc5652e42f0abce50f69811d90391c9561590607d3924f84870854bdce62dc01
Instruction ID: a3b7adc3bf2bd2c23c668faaf1d8a2580548659a5105764c07be5bb0d3899c05
Opcode Fuzzy Hash: dc5652e42f0abce50f69811d90391c9561590607d3924f84870854bdce62dc01
Instruction Fuzzy Hash: B2E19C7090CA4D8FEB59EF28C8597B97BE0FF59301F0441BAD94EC71A2DA34A945CB41

Function 00007FFB4B39C3E0 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1480360823.00007FFB4B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b390000_CrPH91TEUL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777e64c4ba80eb141035e8240d8111fa76a5ce4a79c46bf40b0e057c2d4a844b
Instruction ID: f912d5a03ec62e4f98d1912b318430b5e6940870b0b31b5c6a36ae734db4be12
Opcode Fuzzy Hash: 777e64c4ba80eb141035e8240d8111fa76a5ce4a79c46bf40b0e057c2d4a844b
Instruction Fuzzy Hash: EAD188B0A0C64E8FEB46EF38C8596FA7BB0FF19310F4045BAD549C71A2DA34A545CB91

Function 00007FFB4B39CBE8 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1480360823.00007FFB4B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b390000_CrPH91TEUL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ccb5bbd2b6826c37a1afda8a777bbf737f76644964375e250da5dd5c5e4027
Instruction ID: e34a5907d42bbd8f9fa332414e339a16b36e695dea8cf6ecda5d520f01bf10a3
Opcode Fuzzy Hash: 30ccb5bbd2b6826c37a1afda8a777bbf737f76644964375e250da5dd5c5e4027
Instruction Fuzzy Hash: E7D18FB090CA8E8FEB95EF38C8596B97BF0FF19300F6585BED509C61A2DA346584C741

Function 00007FFB4B39A63D Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1480360823.00007FFB4B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b390000_CrPH91TEUL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1906b9172786c16cb65ec3d523709ec04cd558e3bff2afa5ee75bbbe1a98a1ac
Instruction ID: e7e03ee71142c1928c8982a70a51d1b68452b908cfe5407a903a310c5a6c601e
Opcode Fuzzy Hash: 1906b9172786c16cb65ec3d523709ec04cd558e3bff2afa5ee75bbbe1a98a1ac
Instruction Fuzzy Hash: 17B19C7090D68A8FD746EF38C8592B97BF0FF19300F0586BBD559C70A2EA38A546C751

Function 00007FFB4B3AA5D8 Relevance: 1.9, APIs: 1, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1480360823.00007FFB4B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b390000_CrPH91TEUL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 361b1ee72d22f105e7982649dbd45b992586b65cb4db169f9db5e163c44687f2
Instruction ID: 3b2ab3f2cf33e5c24bea2aa543929c54ca72fed67e7167399f000c7784675d88
Opcode Fuzzy Hash: 361b1ee72d22f105e7982649dbd45b992586b65cb4db169f9db5e163c44687f2
Instruction Fuzzy Hash: 54B18E7090DA8D8FDB59EF28C8557F93BE0FF59301F04827EE94DC6292DA34A9458B81

Function 00007FFB4B3AA5E0 Relevance: 1.8, APIs: 1, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1480360823.00007FFB4B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b390000_CrPH91TEUL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8489da2a5c3e1f05bb3058e0fabd4ce0cee4094b7cb5fdf5d7d0170d771f6fe9
Instruction ID: 5fae79d781142b9b27255fd47b5f9ec3cd76847980b029c9e9f955fffd37aa20
Opcode Fuzzy Hash: 8489da2a5c3e1f05bb3058e0fabd4ce0cee4094b7cb5fdf5d7d0170d771f6fe9
Instruction Fuzzy Hash: 3EA17D7090CA8D8FDB59EF28C8557F937A1FF59305F00827EE94EC7292DA34A9458B81

Function 00007FFB4B3AA600 Relevance: 1.8, APIs: 1, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1480360823.00007FFB4B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b390000_CrPH91TEUL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16e2ea43ccc808c2f2f5a5c8411ad7201c73cf4ef443ba1dabee6d28c45de4b1
Instruction ID: 9bdef619abec8906f5f68b4d644922d714e110756795a37993950609e97f4b20
Opcode Fuzzy Hash: 16e2ea43ccc808c2f2f5a5c8411ad7201c73cf4ef443ba1dabee6d28c45de4b1
Instruction Fuzzy Hash: 7F918E7050CA8D8FDB69EF28C8557F937E1FB59305F00827EE94EC7292DA34A8458B81

Non-executed Functions

Function 00007FFB4B392C10 Relevance: .9, Instructions: 910COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1480360823.00007FFB4B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b390000_CrPH91TEUL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e60d151d9ab433cc5334776f3c6283031fabfa29f16a08bc304ba247ecb17bd
Instruction ID: dbd1e0493408349f980962c51ecb7ee9341a82b0aafa4dab59c89ef458a40266
Opcode Fuzzy Hash: 0e60d151d9ab433cc5334776f3c6283031fabfa29f16a08bc304ba247ecb17bd
Instruction Fuzzy Hash: 75629DB090D64E8FEB85EF38C8596B97BF0FF19301F0146BAD85AC71A2DA34A545CB40

Function 00007FFB4B39AB2D Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1480360823.00007FFB4B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b390000_CrPH91TEUL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 573b27a43f781ca8b3c626b75128e700e268fed98ad4538aa8b679937362c2e0
Instruction ID: 895c019cf4d6cbaa3b65d59219e93a540d4c2dad0790e23e852a133d9b857e31
Opcode Fuzzy Hash: 573b27a43f781ca8b3c626b75128e700e268fed98ad4538aa8b679937362c2e0
Instruction Fuzzy Hash: B3C1E27090DA8E8FDB59EF34C9552FA7BE0FF1A300F1445BBD949C61A2DA38A954C780

Function 00007FFB4B3A21A0 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1480360823.00007FFB4B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b390000_CrPH91TEUL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b57707cd9e2e265639a4f89fa306f5f1a9b9edffdddf43c29c4bcdac1ca8d498
Instruction ID: 9080aa9cb96bdcbd3dba39007202b738b9154b6f62284ab85d3a6b6225c97f67
Opcode Fuzzy Hash: b57707cd9e2e265639a4f89fa306f5f1a9b9edffdddf43c29c4bcdac1ca8d498
Instruction Fuzzy Hash: 68B1AEB0A0C64A8FEB45EF38C8596FA7BE0FF5D300F1185BAD949C31A1DA34A545CB40

Function 00007FFB4B392CF8 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1480360823.00007FFB4B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b390000_CrPH91TEUL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94435f23e8a64d6bf7e729c66d8804ccb6cea6be1e589c9ccf853ba464c565e7
Instruction ID: ec5c15b721b02de2d72dacf31e1f5ca038de9b55ef884b7da7d92c6fae890e49
Opcode Fuzzy Hash: 94435f23e8a64d6bf7e729c66d8804ccb6cea6be1e589c9ccf853ba464c565e7
Instruction Fuzzy Hash: A681DFB090CA4E8FDB55EF35C9442FA7BB1FF4A300F1084BAD959C71A2DA38A955C780

Analysis Process: WmiPrvSE.exePID: 4832, Parent PID: 660COMMON

Executed Functions

Function 00007FFB4B381DC2 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

2EAK, xrefs: 00007FFB4B381EA3

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: 2EAK
API String ID: 0-89867841
Opcode ID: b648b447c7b3734afe275e0a62fe23be4bc716cd2f6a42aaab578ba530663ca7
Instruction ID: 90e65ddf6bee6991515784127b777c3e3bc544b249a8e66c0cb72c790cbb6dbb
Opcode Fuzzy Hash: b648b447c7b3734afe275e0a62fe23be4bc716cd2f6a42aaab578ba530663ca7
Instruction Fuzzy Hash: 0C617F71A1CE498BDB59DE6CC8A15A977D2FFDC304B14466DE58AC3296CE30AC12C781

Function 00007FFB4B38C63D Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

%;~, xrefs: 00007FFB4B38C67E

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: %;~
API String ID: 0-1337976228
Opcode ID: ceada336ccb9a2cbfe9c55f9431342611a1b349c1462822b646c3e52ce6b6f42
Instruction ID: 9fe6b2df9d9aa6b2db4d041d30c4610a7f9aa004249e24428885e3c5d6081b1f
Opcode Fuzzy Hash: ceada336ccb9a2cbfe9c55f9431342611a1b349c1462822b646c3e52ce6b6f42
Instruction Fuzzy Hash: 4B41D8AB90E51A8EFB127E7DF5021FD7790FF42B30B4446B7E649C5093EE28344A42A1

Function 00007FFB4B38C6D3 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFB4B38C739

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 30bb476939ac8853a6a1607d07c4ac43bb59a6ccb81db6c56fdd5ccef7f52aca
Instruction ID: 59c2aa74eaff7d47f4bd0e38762930b3d7e3883aa4cbc16773b83f480924fbdd
Opcode Fuzzy Hash: 30bb476939ac8853a6a1607d07c4ac43bb59a6ccb81db6c56fdd5ccef7f52aca
Instruction Fuzzy Hash: 0241B5AAA0E51A4AFB127E7DFA411FD7794EF42F31F4441B7E649850D3DE24204A82A2

Function 00007FFB4B380A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

8v'K, xrefs: 00007FFB4B380A70

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: 8v'K
API String ID: 0-2137797069
Opcode ID: 5bb2fef20533268dd93ee6524aab9a9c31cf5631351e4c974f022d6abafa43a6
Instruction ID: fd08a2ed7251753c2e8cd4c11bd1c5a70bda8dbe4026ffb26c193b79bcd0e666
Opcode Fuzzy Hash: 5bb2fef20533268dd93ee6524aab9a9c31cf5631351e4c974f022d6abafa43a6
Instruction Fuzzy Hash: 4C118FB190C94E8FEB81FF78C8891BD7BE1FF58310F4085B6D559C60A2EE38A5418761

Function 00007FFB4B38122D Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

py'K, xrefs: 00007FFB4B38129D

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: py'K
API String ID: 0-714081826
Opcode ID: 7da00bdd4bca093c2ab0d4c61f4e1cb4ce1c70f2a8f62f99521ea3d59339b7d5
Instruction ID: ba014da4fbe152645b6eb43568e87a5ef32adf444b5848be1d93ea30191d08bc
Opcode Fuzzy Hash: 7da00bdd4bca093c2ab0d4c61f4e1cb4ce1c70f2a8f62f99521ea3d59339b7d5
Instruction Fuzzy Hash: 9211E2B090DA4A8FEF49AF78C4592B97BE0FF59311F0045BED54ACA0E1DE356850C741

Function 00007FFB4B381240 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

py'K, xrefs: 00007FFB4B38129D

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: py'K
API String ID: 0-714081826
Opcode ID: dd3783c4f7982965d423f116c6011249ca5eee0d43b0503b6efe1cc6cbe5dca1
Instruction ID: 0bfcd0e3077a1adbf6307ecf562d15427fb77d21f94138673ddf94f4e591f30d
Opcode Fuzzy Hash: dd3783c4f7982965d423f116c6011249ca5eee0d43b0503b6efe1cc6cbe5dca1
Instruction Fuzzy Hash: D7F0D1B091DA0A8AEF98AF79C9083BAB7E0FF59210F00407AD419C60E0DA3415248241

Function 00007FFB4B3836BE Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75fd4f9d49558b4bc3ab5347153578620a7333c81b8f6d785cf01aef3fff0c1c
Instruction ID: 2f706ad4df22f0c74007fafc21faf42ee0eea112645e22277be1ac857861f6b8
Opcode Fuzzy Hash: 75fd4f9d49558b4bc3ab5347153578620a7333c81b8f6d785cf01aef3fff0c1c
Instruction Fuzzy Hash: 4871B1B291DA4D8FEB95DF6CD8553ACBFE1EB9A310F5042BAD009C72D6DBB418018742

Function 00007FFB4B38BF79 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880e0b2bbabe4621189905562fe6b57e86fea9d59d8e4d51e3c1627fcc5ad08c
Instruction ID: c19349d7ec75524d50159559d093974481f19fcdec3a98355bbbd453a1b51fcf
Opcode Fuzzy Hash: 880e0b2bbabe4621189905562fe6b57e86fea9d59d8e4d51e3c1627fcc5ad08c
Instruction Fuzzy Hash: 1F6115B0D1CA1D8FEF94EF69C9546ADB7F1FF58300F50817AD109E32A2DA38A9458B41

Function 00007FFB4B383285 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 155a2f2071ab4e591363e87ae61eb73675262cf35169c8d4f1c849cb6a5688ba
Instruction ID: 9e5b84778e0619c5d7e13be922dd8686688d2d0adc20b551af16a3959d72026d
Opcode Fuzzy Hash: 155a2f2071ab4e591363e87ae61eb73675262cf35169c8d4f1c849cb6a5688ba
Instruction Fuzzy Hash: 425104B0D0860D8FEF54EFA9C5956EDBBF1EF48310F10907AE109E72A1DA78A944CB11

Function 00007FFB4B382135 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf671479cd1e68f75dcce52652856d548ca662896c817e81b786612714749acd
Instruction ID: 6852439c637396f6d5141f0b85e58a21204b278f6bcf8cf8aee43a016648d536
Opcode Fuzzy Hash: bf671479cd1e68f75dcce52652856d548ca662896c817e81b786612714749acd
Instruction Fuzzy Hash: EA412CB190D64A4FEB86EF78C8451B87BE0EF46310B4541FBD54DC71B2DE28A8418352

Function 00007FFB4B38AC78 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d92e8e6492add3f23ee819def8b90c7839cd7490fdcfbb712a3f0f0e1667aa
Instruction ID: cf75a1410380cf7e0dea822b14729b29ca59df7811f49d8cfebc77ebe0e20c9a
Opcode Fuzzy Hash: 23d92e8e6492add3f23ee819def8b90c7839cd7490fdcfbb712a3f0f0e1667aa
Instruction Fuzzy Hash: B231F4A190D9878FEB12BF79C9151E97BE1FF15210F0485F6C598C70B3EE24641A8392

Function 00007FFB4B383354 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddab9296b37d40ee9f4035daf3e0d7cd189f885ab38466828b824f0ff69449fe
Instruction ID: 1668f7fa1d4cd2d406341fc33399afd46df9dd000cb8f4ad11b1ce161b2ead87
Opcode Fuzzy Hash: ddab9296b37d40ee9f4035daf3e0d7cd189f885ab38466828b824f0ff69449fe
Instruction Fuzzy Hash: 4A21E3B1D0851D8FEF54EFAAD5946ECBBF1EF58301F10906AE109E72A1CE786940CB11

Function 00007FFB4B38C4D1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062f2e3d571bd05a4bb13e21210aa00df31c9e13280c1dd41d5c383948e60713
Instruction ID: b80b20ee26599e3296384e0ab6b18c1ad54514e45e7ddd7b687973eaf10f4138
Opcode Fuzzy Hash: 062f2e3d571bd05a4bb13e21210aa00df31c9e13280c1dd41d5c383948e60713
Instruction Fuzzy Hash: DD116DB0908A4E8FDF85EF68C4986BA7BE1FF68300F4145BAE419C71A1DB30A544CB41

Function 00007FFB4B3834A0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf96f04697740a6d7046bf618ca72940da5ef1699731529b4aaaf1a25ba45ff4
Instruction ID: e04c68226de96cedb06ef9cb2ab85aeac6747375d4623501c87490579932de21
Opcode Fuzzy Hash: bf96f04697740a6d7046bf618ca72940da5ef1699731529b4aaaf1a25ba45ff4
Instruction Fuzzy Hash: 3311AC7088E68A8FDB43AB74C8585A97FF4EF0A310F0544F6E449CB1A2DA38A446C721

Function 00007FFB4B38B043 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04abc9bf64eeb4e3c18e28441b321466779fcf9275744318ef97e611968b987
Instruction ID: aefa5304766de15e54e291dcd2db83045a39fc4f7939f0c54761735f70dbc475
Opcode Fuzzy Hash: c04abc9bf64eeb4e3c18e28441b321466779fcf9275744318ef97e611968b987
Instruction Fuzzy Hash: C2212FB0D0851A8FEF50EF69C8856FDB7F1EF58301F1081B5D519A2295DB3859858F41

Function 00007FFB4B38C7A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aecb64085c5ec911300d2679740ba76abc2eb5ccd519c77b015e3dd4db563ef
Instruction ID: 7cbb4db2c75072c1950e86bc8817b9609a01275135cd69c7fa33bd2948545380
Opcode Fuzzy Hash: 7aecb64085c5ec911300d2679740ba76abc2eb5ccd519c77b015e3dd4db563ef
Instruction Fuzzy Hash: AA1188B480D64E8FEB46EF78C8592B97BF0FF09700F8004BAE449C60A2DA356448C751

Function 00007FFB4B38085D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25240a2e1dc5e5045162f7ab38540894e4eb00f7420b53475de535776a6b72aa
Instruction ID: 8b35487409351428ceb13d227bba1d1023306dd4ecff8d9cc4a53bbc45a7bd89
Opcode Fuzzy Hash: 25240a2e1dc5e5045162f7ab38540894e4eb00f7420b53475de535776a6b72aa
Instruction Fuzzy Hash: 0001D2A194C68D8EEB42FF79D9985F87BE0EF59300F1184B2D589C70A3DD24B08586A2

Function 00007FFB4B3835B5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4120eeb677b06dfaa3bca88ccdeaed05c81c1a7d68f18df23e9da1ac5cacec44
Instruction ID: 1e30acb1a02bbcff113146583774a68e8d16a70f07181af775b1b280def824cd
Opcode Fuzzy Hash: 4120eeb677b06dfaa3bca88ccdeaed05c81c1a7d68f18df23e9da1ac5cacec44
Instruction Fuzzy Hash: 2E115AB090D64E8FDF45EF38C8992F97BE0FF18300F4054BAE55AD76A2DA35A4458B41

Function 00007FFB4B38CB90 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863c73c71a5793ac926170e46dec882446814606d849a09037c44498abc6477f
Instruction ID: d1dfd3d3b4617db0d930dd606d05438872946a96dd8b1d00b61aa55724d5b557
Opcode Fuzzy Hash: 863c73c71a5793ac926170e46dec882446814606d849a09037c44498abc6477f
Instruction Fuzzy Hash: 0C116DB090990E9EEB99EF78C4592B9B6F1FF58301F1045BAD42DC21A1CE3461548781

Function 00007FFB4B38BEF1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb4a61c1ec2a55a9e62cd554d43499821e2e9cddb39cd3361a7e42dc3fc9399
Instruction ID: 988e9bd84ce7d8f27bb15aee26b661fbfd4c77a99fcdfc83a445a812cf52a338
Opcode Fuzzy Hash: acb4a61c1ec2a55a9e62cd554d43499821e2e9cddb39cd3361a7e42dc3fc9399
Instruction Fuzzy Hash: EC118EB090C64E8FDF45EF78C4592B97BE0FF18300F4044BAD91DC61A2EA35A540CB01

Function 00007FFB4B3805D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f779ab3d623b842261147536b03dd62ce5517af0e00e62afde3f697e3f345614
Instruction ID: b93bee9703724c85444599a28e3f4b41476abd1363ff88db4e7649a34379cec3
Opcode Fuzzy Hash: f779ab3d623b842261147536b03dd62ce5517af0e00e62afde3f697e3f345614
Instruction Fuzzy Hash: 81016D7090890E8FDF48EF26C5446B977E1FF58304F50457AD81ED2194CA31A961C741

Function 00007FFB4B38AE25 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e26b4c7da5ad79614a7a152191ef68025e1a533c7f6d8ef9e8ca5ed3e36af97
Instruction ID: b1837dd6e4dbaea1256325e94b2826b561568149837b901405499f5d2fad0f97
Opcode Fuzzy Hash: 0e26b4c7da5ad79614a7a152191ef68025e1a533c7f6d8ef9e8ca5ed3e36af97
Instruction Fuzzy Hash: B6018CB0D1DA4A8FEB41FF38C9481A97BE4FF49300F0188B6D608C60A2EA38B4558642

Function 00007FFB4B38BAAA Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e8ad144e94059c3089bed8f615ae7d9b09c18ad186f2fa461fe1bfdf49c885
Instruction ID: c969816cb073924e09ebbef306fbf8032e006c8bad70ce8d580370a107ed2945
Opcode Fuzzy Hash: a0e8ad144e94059c3089bed8f615ae7d9b09c18ad186f2fa461fe1bfdf49c885
Instruction Fuzzy Hash: BA018CB090890E8FEF98EF78C4582B97AE0FF18301F1004BAD91AD21A1EE76A5508741

Function 00007FFB4B3828ED Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9152c97dd6f80b8477db6b4dd80ff603c7e85b424b77bb07bb976d3124628626
Instruction ID: 655070bada407428698508d6eb247ea5086484dc6037104a43a8658363be2ef6
Opcode Fuzzy Hash: 9152c97dd6f80b8477db6b4dd80ff603c7e85b424b77bb07bb976d3124628626
Instruction Fuzzy Hash: CF01BCB0D0C64D8FEF82FF38C9886B97BE0EF19300F4185B6D558C60A2EA34E0508782

Function 00007FFB4B38A8A9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af90282f13a2e831f778cddc4b2efdd76b95bc7ebed3fcd492c87e5a6440e4ef
Instruction ID: 802d3f7178db2ae04374916b83a410a2f0e618275a4cbce44b3e45442d80f594
Opcode Fuzzy Hash: af90282f13a2e831f778cddc4b2efdd76b95bc7ebed3fcd492c87e5a6440e4ef
Instruction Fuzzy Hash: E001D4B194D6498FEB42FF38C9491A97FF0EF19300F0545F6D548C70A2E928A4458712

Function 00007FFB4B382F89 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc05dfac47365f4d257987f2f9de1957c84df755cbaa0fdb9342ada2578329e
Instruction ID: f3afd1c4eb4de2428e5583a657a4aa57b5c3f9df33cf339e061358716ccbec08
Opcode Fuzzy Hash: bfc05dfac47365f4d257987f2f9de1957c84df755cbaa0fdb9342ada2578329e
Instruction Fuzzy Hash: F801D4B090D6498FEF42FB34CD491A97FE0EF49300F4548F2D548CB0A2DA28E544C712

Function 00007FFB4B38A915 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5569562e49b043d3f9b5f1e9a88093042b312157a0397a6d1d8f11ab413a4e82
Instruction ID: 9e05f57a968850254074b3bfe70ff9b850f9714a9be70fc945489094365c33da
Opcode Fuzzy Hash: 5569562e49b043d3f9b5f1e9a88093042b312157a0397a6d1d8f11ab413a4e82
Instruction Fuzzy Hash: 88F0C86760E38A4FDB129A2DECA11E93B74DF4222170583F3C144CA0A3E91D540B43A2

Function 00007FFB4B381C9D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4604fd416f57c67e9a06ce7ddedde9d2c2e7bed9c5be6867a07247bcca70fe
Instruction ID: c4ddbed311daf075b618fcbfe64b956d37b661b1c9e760a1aea069c08390f430
Opcode Fuzzy Hash: 1e4604fd416f57c67e9a06ce7ddedde9d2c2e7bed9c5be6867a07247bcca70fe
Instruction Fuzzy Hash: 5901D6B080DA4D8FEF54EE25C4555B97BF0FF59300F40417EE909C2091CB759860C741

Function 00007FFB4B380608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c178d284bb1e4e462ad6f6c194ff7ed0209b1ca152cc53a82e85d0b0b5299326
Instruction ID: 7cea0ee6738f74dc0cf1132d0b9f04b349b62fbe161463dd6e4c5fbdc17c1cf8
Opcode Fuzzy Hash: c178d284bb1e4e462ad6f6c194ff7ed0209b1ca152cc53a82e85d0b0b5299326
Instruction Fuzzy Hash: E6014B7091890E8AEF59EF34D9492B972E0FF18305F5048BED81AC21A1DE35B150C641

Function 00007FFB4B380610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2400477d9e8b9f3d7838a36c525630693e6984d9aefaca3c5a66323efdfea31b
Instruction ID: 7b5d3b55711ddbc08ce4c831a5e67bcbc38ecbaba7e40898ca30c144dfd6a2d1
Opcode Fuzzy Hash: 2400477d9e8b9f3d7838a36c525630693e6984d9aefaca3c5a66323efdfea31b
Instruction Fuzzy Hash: 16014B7091890E8AEF49EF34D8482B972E0FF18305F5044BEE81EC21A1DF35B590C641

Function 00007FFB4B3805D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888efb1eb87ce71820652e535a7c9811ebacd35355fea008d1d6fef053924d19
Instruction ID: 24b5067a1f04cce101334285824c722ca547de309e919e7085906064073c4c69
Opcode Fuzzy Hash: 888efb1eb87ce71820652e535a7c9811ebacd35355fea008d1d6fef053924d19
Instruction Fuzzy Hash: F8F0A9B080DA4E8FEF84AE3AD5056BA77E4EF09304F40457AE90DC20A1CA35A960CA81

Function 00007FFB4B382809 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e4557440e375250e0f4bcad9ae82b84395d2d1343b5c3dd08c1568c3b5da22
Instruction ID: 173145400411a2635527ef42f4366d989e7484fdf622083c4dece1d144b90cbc
Opcode Fuzzy Hash: 46e4557440e375250e0f4bcad9ae82b84395d2d1343b5c3dd08c1568c3b5da22
Instruction Fuzzy Hash: 6BF0AF7080E7898FEF5AAF34C9551A93BA0EF56201F4545FBD549C50E2DA28A548C342

Function 00007FFB4B380F84 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38039d5b8c0a79b09369befad1c88bb43ce805ff8c1e3cc7a1b1b8ad9f112f37
Instruction ID: df6789e9e36320127174c1db2b3053091b15930c18dab8ff6b520e95e71c4bf0
Opcode Fuzzy Hash: 38039d5b8c0a79b09369befad1c88bb43ce805ff8c1e3cc7a1b1b8ad9f112f37
Instruction Fuzzy Hash: C1011670D095098BEB50EF78CA54BADB3F4EF08300F1081B5D409A72A5DE356A408B61

Function 00007FFB4B38287D Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16ef3462edf9d6b249301dc67de4170e2ec321aaa3120b9addc0cedd3619c8a
Instruction ID: 11f475d7b253d1194e0ec2bdccacdc718974b4a947b1f6a055b2e7824984f349
Opcode Fuzzy Hash: a16ef3462edf9d6b249301dc67de4170e2ec321aaa3120b9addc0cedd3619c8a
Instruction Fuzzy Hash: FBF09AB180D68A8BEF59AF34C8592F97BE0FF55301F8085BEE959C10E2DB39A4548741

Function 00007FFB4B383F3E Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1546770783.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290eeb21d7955852a5a6036ff01b1a76bf0aa92e7153c1e33e62596d5d06ca18
Instruction ID: 1dbea9fc0b696e975c138900f180f0d69b298797459bfbd6c35c64c9bdf5b2c0
Opcode Fuzzy Hash: 290eeb21d7955852a5a6036ff01b1a76bf0aa92e7153c1e33e62596d5d06ca18
Instruction Fuzzy Hash: CAF098B090952D8FDF65EF25C9447A8B7B1FB49304F5041E9820EA7261DB301A80CF15

Analysis Process: WmiPrvSE.exePID: 5828, Parent PID: 660COMMON

Executed Functions

Function 00007FFB4B38D7E9 Relevance: 2.9, Strings: 2, Instructions: 390COMMON

Download Yara Rule

Strings

p\&K, xrefs: 00007FFB4B38D902
N&K, xrefs: 00007FFB4B38D894

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B38A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B38A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b38a000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: N&K$p\&K
API String ID: 0-2299876715
Opcode ID: e82b45cae96e016759bc94b37a20f5e80b84b9b55d102e2f2d2aaece5c3fdc39
Instruction ID: 15bf9bc75b77c6e536bb5d876e10e50e151461415d8d9d339f21d05b2a95bf59
Opcode Fuzzy Hash: e82b45cae96e016759bc94b37a20f5e80b84b9b55d102e2f2d2aaece5c3fdc39
Instruction Fuzzy Hash: E7E13BB1D19A5A8FEB99EF68C4957A8B7F1FF58300F1441BED04DD32A2CA386841DB41

Function 00007FFB4B391356 Relevance: 2.6, Strings: 2, Instructions: 68COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFB4B391817
-, xrefs: 00007FFB4B3913B6

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: -$/
API String ID: 0-2515390558
Opcode ID: 1700f56375e175062acd48bd55af63e9d5e5d1e7a5aa3475e35654767db8d1e7
Instruction ID: 6bc227a344555e7fe67de686c00d9589f9f7dafeb86355fc2f3b50aaac5f4c8b
Opcode Fuzzy Hash: 1700f56375e175062acd48bd55af63e9d5e5d1e7a5aa3475e35654767db8d1e7
Instruction Fuzzy Hash: B231D8B1D0862D8FEB68EF25C8947EDB6B1FB59301F0085AE954DA7291DB346D80DF10

Function 00007FFB4B381DC2 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

2EAK, xrefs: 00007FFB4B381EA3

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: 2EAK
API String ID: 0-89867841
Opcode ID: b648b447c7b3734afe275e0a62fe23be4bc716cd2f6a42aaab578ba530663ca7
Instruction ID: 90e65ddf6bee6991515784127b777c3e3bc544b249a8e66c0cb72c790cbb6dbb
Opcode Fuzzy Hash: b648b447c7b3734afe275e0a62fe23be4bc716cd2f6a42aaab578ba530663ca7
Instruction Fuzzy Hash: 0C617F71A1CE498BDB59DE6CC8A15A977D2FFDC304B14466DE58AC3296CE30AC12C781

Function 00007FFB4B38C63D Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

%;~, xrefs: 00007FFB4B38C67E

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B38A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B38A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b38a000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: %;~
API String ID: 0-1337976228
Opcode ID: d53035da9e244cfe52bd98a8a55f2608da10918815a76871a1ac96b0c52a00d5
Instruction ID: 9fe6b2df9d9aa6b2db4d041d30c4610a7f9aa004249e24428885e3c5d6081b1f
Opcode Fuzzy Hash: d53035da9e244cfe52bd98a8a55f2608da10918815a76871a1ac96b0c52a00d5
Instruction Fuzzy Hash: 4B41D8AB90E51A8EFB127E7DF5021FD7790FF42B30B4446B7E649C5093EE28344A42A1

Function 00007FFB4B38C6D3 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFB4B38C739

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B38A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B38A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b38a000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: e3fca4b00a74d434a9737d4a4674b0dcb5b3684ad5e9c2324cc259aa81a14da3
Instruction ID: 59c2aa74eaff7d47f4bd0e38762930b3d7e3883aa4cbc16773b83f480924fbdd
Opcode Fuzzy Hash: e3fca4b00a74d434a9737d4a4674b0dcb5b3684ad5e9c2324cc259aa81a14da3
Instruction Fuzzy Hash: 0241B5AAA0E51A4AFB127E7DFA411FD7794EF42F31F4441B7E649850D3DE24204A82A2

Function 00007FFB4B380A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

8v'K, xrefs: 00007FFB4B380A70

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: 8v'K
API String ID: 0-2137797069
Opcode ID: 79bc8d93f2e0795ac70a558bd12d377a6de8b620a452da93fb23eeafbdae4ad4
Instruction ID: 98978d2c713c54651b44051ff5707a04afcd22fe5bb06219fbaf6f10876f8436
Opcode Fuzzy Hash: 79bc8d93f2e0795ac70a558bd12d377a6de8b620a452da93fb23eeafbdae4ad4
Instruction Fuzzy Hash: 6D118FB190C94E8FEB81FF78C8891BD7BE1FF58310F4085B6D559C60A2DE38A5418761

Function 00007FFB4B38122D Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

py'K, xrefs: 00007FFB4B38129D

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: py'K
API String ID: 0-714081826
Opcode ID: 7da00bdd4bca093c2ab0d4c61f4e1cb4ce1c70f2a8f62f99521ea3d59339b7d5
Instruction ID: ba014da4fbe152645b6eb43568e87a5ef32adf444b5848be1d93ea30191d08bc
Opcode Fuzzy Hash: 7da00bdd4bca093c2ab0d4c61f4e1cb4ce1c70f2a8f62f99521ea3d59339b7d5
Instruction Fuzzy Hash: 9211E2B090DA4A8FEF49AF78C4592B97BE0FF59311F0045BED54ACA0E1DE356850C741

Function 00007FFB4B3913CB Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFB4B391817

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 18a9fc7f72989e37d207219ec2525f82ab22db2e027fe7aa2d5c507869f21761
Instruction ID: eb2b076ab6033d621f06404f9eeeba7292332c31a9f549ed8a019aea692d7627
Opcode Fuzzy Hash: 18a9fc7f72989e37d207219ec2525f82ab22db2e027fe7aa2d5c507869f21761
Instruction Fuzzy Hash: 1C11F370D086298BEB58EF15D894BECB7B2FB55300F0081AE944AA72A1DB386984CF10

Function 00007FFB4B381240 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

py'K, xrefs: 00007FFB4B38129D

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: py'K
API String ID: 0-714081826
Opcode ID: dd3783c4f7982965d423f116c6011249ca5eee0d43b0503b6efe1cc6cbe5dca1
Instruction ID: 0bfcd0e3077a1adbf6307ecf562d15427fb77d21f94138673ddf94f4e591f30d
Opcode Fuzzy Hash: dd3783c4f7982965d423f116c6011249ca5eee0d43b0503b6efe1cc6cbe5dca1
Instruction Fuzzy Hash: D7F0D1B091DA0A8AEF98AF79C9083BAB7E0FF59210F00407AD419C60E0DA3415248241

Function 00007FFB4B3911EB Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFB4B391817

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 312dbc83d177cbafb50da2b50f41d2af2ae78386a1a754322596dfe215dcd67d
Instruction ID: 9be719bab7e5df3945fb67cc18d28fa8cdf6e8004c379ccc448da22d5eec35ab
Opcode Fuzzy Hash: 312dbc83d177cbafb50da2b50f41d2af2ae78386a1a754322596dfe215dcd67d
Instruction Fuzzy Hash: 4BF049B190C61D8BDB28EF50C8947ED73B1EB11300F158A2AC009AB2A1DB786D14DB00

Function 00007FFB4B3931B5 Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c67b57889b273fe96380d2c0c84b3ff2cfc4ca6e4c402930615250c4f2797e6
Instruction ID: ccca1f1d015ba3e1800496f554d112384c0fa8f836c734a66ce0575a2b8a2df2
Opcode Fuzzy Hash: 0c67b57889b273fe96380d2c0c84b3ff2cfc4ca6e4c402930615250c4f2797e6
Instruction Fuzzy Hash: 9251C5D290E7C65FE713AB79C9661A97FB0EF17210B0941FBD5C8CB0B3D918A8098391

Function 00007FFB4B393278 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa20d1848a63ccc8e8c08877cf28336ff2e4ad77ba6ad31b08ccf4d51922222
Instruction ID: 1a6944c6864f310ae765dd99648f9554070005c831c31cd34042a5922513b514
Opcode Fuzzy Hash: 3fa20d1848a63ccc8e8c08877cf28336ff2e4ad77ba6ad31b08ccf4d51922222
Instruction Fuzzy Hash: 391166E180E7CA9FE753AB75C9551A9BFB0EF16204F0941FBD9C8DA1B3DA289404C352

Function 00007FFB4B3927C1 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539ebfa5db65eae8da3d57935e4bf7c8fd8e64007acccbb7439bcd60f3a93688
Instruction ID: a42c45422ddb2081f70fbd3d77e07696c876d7c1f04ea0b81db2a0347bdb747d
Opcode Fuzzy Hash: 539ebfa5db65eae8da3d57935e4bf7c8fd8e64007acccbb7439bcd60f3a93688
Instruction Fuzzy Hash: 69B1F8B0D0891D8EEB94EF68C9557ECB7F1EF58300F5041BAD50DE3292DE3869858B41

Function 00007FFB4B3836BE Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea7202121c8c94f09bdf9f6e0b8d390d7714dc4ea7167018addfab587f2402d
Instruction ID: 7cfd234b1ed8d4c2c0accee223fec8454d332ba9036c3ed15fcb809343d36c5c
Opcode Fuzzy Hash: 2ea7202121c8c94f09bdf9f6e0b8d390d7714dc4ea7167018addfab587f2402d
Instruction Fuzzy Hash: 5971A1B291DA4D8FEB94DF6CD8553ACBFE1EB9A310F5042BAD009D72D6CBB418058741

Function 00007FFB4B38BF79 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B38A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B38A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b38a000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d318b77e8c3b1e3e728a88eceea177adba66d4495c4c1e39d1a97dc9cacbe45
Instruction ID: c19349d7ec75524d50159559d093974481f19fcdec3a98355bbbd453a1b51fcf
Opcode Fuzzy Hash: 4d318b77e8c3b1e3e728a88eceea177adba66d4495c4c1e39d1a97dc9cacbe45
Instruction Fuzzy Hash: 1F6115B0D1CA1D8FEF94EF69C9546ADB7F1FF58300F50817AD109E32A2DA38A9458B41

Function 00007FFB4B383285 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a66df67a6566e08850967867705be693774d93875f1b1f21fafb0321ed5a211
Instruction ID: 36bc21e5fab786418558b98cd1e0e60205ca12ce23af33375b5db83683884afa
Opcode Fuzzy Hash: 4a66df67a6566e08850967867705be693774d93875f1b1f21fafb0321ed5a211
Instruction Fuzzy Hash: EA5114B0D0860D8FEF54EFA9C5956ECBBF1EF48300F10907AE109E72A1DA78A940CB11

Function 00007FFB4B382135 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea87897fce09213307ab0b38b251a0337eeb9a444c629d455c87c688f9774c3
Instruction ID: cc51184bf4e2928d2fe63a1073354054636620498cd46696a9d36c2ff13d8454
Opcode Fuzzy Hash: 3ea87897fce09213307ab0b38b251a0337eeb9a444c629d455c87c688f9774c3
Instruction Fuzzy Hash: ED412CB190D64A4FEB86EF78C8451B87BE0EF46310B4545FBD54DC71B2DE28A8418352

Function 00007FFB4B392A38 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70bb635c2cbae5e726914f7621718e0a7089bf17921ff122d94356ca54510c17
Instruction ID: e30af0e3bcd77fedb5be297b8507584dd2b52549547b40714f1d86f55533ee21
Opcode Fuzzy Hash: 70bb635c2cbae5e726914f7621718e0a7089bf17921ff122d94356ca54510c17
Instruction Fuzzy Hash: 9151C5B0D08A1D8EEFA4EF68D9547ACB7F1EF54300F5080AAD10DE32A1DE346A85CB41

Function 00007FFB4B393AD5 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6747aaeb407b2debbc5b7cd45f77224a6d16be6e537ac1b6bb1d4082442cb4
Instruction ID: 66eaf9deda083afec2701891d301ba07cd7779d830f0d34afd29a51901520847
Opcode Fuzzy Hash: 3f6747aaeb407b2debbc5b7cd45f77224a6d16be6e537ac1b6bb1d4082442cb4
Instruction Fuzzy Hash: F041F7B0D0CA1D9EEB94FF79C9997A9B6B1FF58300F4041B9D14DD72A2DE3869808B50

Function 00007FFB4B38AC78 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B38A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B38A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b38a000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd8887bf4a4d27ca54c5af2167ae6bf2f761a16714a030716a67ab8e5188423
Instruction ID: 2060bad594c2895ed52c8303dbbc91db013b7eac533dbac805c93e8cc2c7ea84
Opcode Fuzzy Hash: 5bd8887bf4a4d27ca54c5af2167ae6bf2f761a16714a030716a67ab8e5188423
Instruction Fuzzy Hash: ED31F4A190D9878FEB12BF79C9151E97BE1FF15211F0485F6C598C70B3EE24641A8392

Function 00007FFB4B3939FA Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d134731d63b667a234f0ec5c250b9c17e07b5183f202e838e20dbcbd00d7398
Instruction ID: acfe42931639c2e5c86cc7eb8b6b142dfbad3d9c7963081e2339e421fc8f064f
Opcode Fuzzy Hash: 6d134731d63b667a234f0ec5c250b9c17e07b5183f202e838e20dbcbd00d7398
Instruction Fuzzy Hash: D931F1E190E68A9EE716FFB9C8991E97BF0FF06310F0441F7D588C61A3DA34A4448781

Function 00007FFB4B383354 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc5d8b76e4b4b1a12fd17c7a50bf23c7e63c483edea07902d93cf49a8aa19af
Instruction ID: 44fac12f9d240267bd1c8948611ac26eb391b3443e409edda7c96a9364da16a6
Opcode Fuzzy Hash: 7cc5d8b76e4b4b1a12fd17c7a50bf23c7e63c483edea07902d93cf49a8aa19af
Instruction Fuzzy Hash: 9621C2B1D0851D8FEF54EFA9D5946ECBBF1FF58301F50906AE109E72A1CA786940CB11

Function 00007FFB4B3920E0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b28cad441398ee7fe0e97501a9e49d23fe996a76e53d303605beb2b7403d2f0
Instruction ID: 7e2d4d5abc18f9aa0ce6dae0d8733d6ecf7838c12d0f705ef0210d56d0b3228a
Opcode Fuzzy Hash: 6b28cad441398ee7fe0e97501a9e49d23fe996a76e53d303605beb2b7403d2f0
Instruction Fuzzy Hash: 7321AFB084E6C94FEB07AB7488655E97FB0EF07210F0940EAD58ACA1A3D9296556C312

Function 00007FFB4B392558 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dfb4a4e81a299bcbd9e1f8f4c3d26c21f8314a6af20c827ebd156cfb05288ec
Instruction ID: b4fb9aee88aa27c24314a8df484edab962d8a257ac58b53fca299331016714e8
Opcode Fuzzy Hash: 5dfb4a4e81a299bcbd9e1f8f4c3d26c21f8314a6af20c827ebd156cfb05288ec
Instruction Fuzzy Hash: D5216FB080D7CA4FDB46EF7488651A47FB0EF16300F0584EBD489CB0A3DA695949C711

Function 00007FFB4B396C91 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17dbe5cc606573a69c7653d1c54a5db29d3c103aaed28afe6cfa8b2cea242a3d
Instruction ID: 74b56b6e47acbf605e5e9847994f3bf59f1a2f9443c7c30cb09d8f58bbdf559b
Opcode Fuzzy Hash: 17dbe5cc606573a69c7653d1c54a5db29d3c103aaed28afe6cfa8b2cea242a3d
Instruction Fuzzy Hash: BC1190B090DA4E8FEB59EF38C4552BD7BF0FF58311F4045BAE419C35A1DA35A4458B81

Function 00007FFB4B396D35 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0058b89135cc8b0f6e08a1f3919f9780f0b629fa406e9ff5db20c3e0bae8eb4d
Instruction ID: 42208957ee7e09ed69bc5c441f4dd44f972a86bc38da3d604ead002eecc1d65c
Opcode Fuzzy Hash: 0058b89135cc8b0f6e08a1f3919f9780f0b629fa406e9ff5db20c3e0bae8eb4d
Instruction Fuzzy Hash: CD119DB090DA4E8FEB99EF78C4592B97BF1FF58300F0045BED459C21A2DA34A4448781

Function 00007FFB4B3945E9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6201050a5d9d98913622463329b975d94883823af4ec2039e64156550ea66d3
Instruction ID: 3bfd9a359c590d06241977959ffc7c2945c2cc3b12ca09653ead4226a457c6c5
Opcode Fuzzy Hash: a6201050a5d9d98913622463329b975d94883823af4ec2039e64156550ea66d3
Instruction Fuzzy Hash: 4D21C0B080D68E9FEB59EF78C4592B97BF0FF59300F0041BBD459C25A2CA74A440CB81

Function 00007FFB4B396DD5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e58c49d9b5fc577284aca71b8e68107b06c6dd4fc6e1dddcaaac354a265bd5
Instruction ID: d37960da9505bc02bd291a8274afe4d1f3982b0b0fa722a710d9c1bb255d7673
Opcode Fuzzy Hash: 39e58c49d9b5fc577284aca71b8e68107b06c6dd4fc6e1dddcaaac354a265bd5
Instruction Fuzzy Hash: E71127B1D0EA498BEB49EF38C6A61B97BE1FF14300F0040FED54DC21A2DE256404C341

Function 00007FFB4B394685 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db1c75d00e2643748813ea1987d533529f3ba490d9cb4e4964aaa77964b10f1
Instruction ID: 7642cce92a9b7e45f6ce87142acb0f6e342f05e129a8381e9477f95f18232178
Opcode Fuzzy Hash: 0db1c75d00e2643748813ea1987d533529f3ba490d9cb4e4964aaa77964b10f1
Instruction Fuzzy Hash: 5F11AFB090DA4E9FEB99EF78C4592B9BBF0FF58311F0041BED419C61A2DA34A450C780

Function 00007FFB4B3834A0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf96f04697740a6d7046bf618ca72940da5ef1699731529b4aaaf1a25ba45ff4
Instruction ID: e04c68226de96cedb06ef9cb2ab85aeac6747375d4623501c87490579932de21
Opcode Fuzzy Hash: bf96f04697740a6d7046bf618ca72940da5ef1699731529b4aaaf1a25ba45ff4
Instruction Fuzzy Hash: 3311AC7088E68A8FDB43AB74C8585A97FF4EF0A310F0544F6E449CB1A2DA38A446C721

Function 00007FFB4B38B043 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B38A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B38A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b38a000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f1b8eb2015a1035d9d878e8c0cf5ef4f4d8e81df834df37fa53c149fe76548
Instruction ID: 03341c9a10ab1a9d808ccbce7aead43a02d597369b5dba877fcf9347cdd01ef6
Opcode Fuzzy Hash: 75f1b8eb2015a1035d9d878e8c0cf5ef4f4d8e81df834df37fa53c149fe76548
Instruction Fuzzy Hash: A6212FB0D0851A8FEF50EF69C8856FDB7F1EF58301F1081B5D519A2295DB3859858F41

Function 00007FFB4B38C7A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B38A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B38A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b38a000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e0c26d42696018a40487ae251ee88bfe98fff8d970bb571ae741cb6540d5d5
Instruction ID: 7cbb4db2c75072c1950e86bc8817b9609a01275135cd69c7fa33bd2948545380
Opcode Fuzzy Hash: e4e0c26d42696018a40487ae251ee88bfe98fff8d970bb571ae741cb6540d5d5
Instruction Fuzzy Hash: AA1188B480D64E8FEB46EF78C8592B97BF0FF09700F8004BAE449C60A2DA356448C751

Function 00007FFB4B394BA5 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b7278c292cd553da426e3af7b377c8163504abda8549e3f883a2a6c9c410c0c
Instruction ID: f96b4679f8316c9bf4937263ccd015a8984cb9a25c3d1da7b26d8818782df64c
Opcode Fuzzy Hash: 7b7278c292cd553da426e3af7b377c8163504abda8549e3f883a2a6c9c410c0c
Instruction Fuzzy Hash: B11104B190DA898FE769EF78C8A52B9BBE0EF18304F0440FED59DC24A2DE256455C741

Function 00007FFB4B394F19 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93cb0827369ec65a98a5d6a036f976ba6111853253063e3d6d9d344930269d2
Instruction ID: 82f1029e76e7247fd151463eb1e303a92827fe3eb49ed65e6f6fad5b3f788100
Opcode Fuzzy Hash: d93cb0827369ec65a98a5d6a036f976ba6111853253063e3d6d9d344930269d2
Instruction Fuzzy Hash: E8117CB090D68E8FEB65EF78C8592B9BBF0FF19300F0145BAD45AC65A2DA35A440C741

Function 00007FFB4B38085D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25240a2e1dc5e5045162f7ab38540894e4eb00f7420b53475de535776a6b72aa
Instruction ID: 8b35487409351428ceb13d227bba1d1023306dd4ecff8d9cc4a53bbc45a7bd89
Opcode Fuzzy Hash: 25240a2e1dc5e5045162f7ab38540894e4eb00f7420b53475de535776a6b72aa
Instruction Fuzzy Hash: 0001D2A194C68D8EEB42FF79D9985F87BE0EF59300F1184B2D589C70A3DD24B08586A2

Function 00007FFB4B3973A1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9c4eea1d0f812c6762093f85962631f9ecc3c9403dd98ce18de71233f80d4c
Instruction ID: de96f191cdf826b34a2d34d2f3c84afab70b79fe932f01be5167e29532d49b43
Opcode Fuzzy Hash: 2a9c4eea1d0f812c6762093f85962631f9ecc3c9403dd98ce18de71233f80d4c
Instruction Fuzzy Hash: E5118E70A1D54ACFE741FF78C8886AA7BF4FF19300F0445B6D859C70A1DB34A1818791

Function 00007FFB4B392741 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cdbeade1e6b4a2ade3da9d18eb383d451ea6bc11d97910c94d34316aa82d423
Instruction ID: ae477ed4f9f72f9ebe1757775b0a17517f0a3d8a1557f25401c113f3c4e5cb7e
Opcode Fuzzy Hash: 1cdbeade1e6b4a2ade3da9d18eb383d451ea6bc11d97910c94d34316aa82d423
Instruction Fuzzy Hash: C111A1B490CA8E8FEB42FB78C9885F97BF4FF19300F0549B6D458D6062DA34A5458B41

Function 00007FFB4B396E6D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47559145cf4e891185eb9c303cb3a1f30de3a0c74ebc7f8860f3a85b05419075
Instruction ID: 2d0c61fd0644beb9a3439204e7ca8487556f7f6c161eb2b9f970e6573f885e9d
Opcode Fuzzy Hash: 47559145cf4e891185eb9c303cb3a1f30de3a0c74ebc7f8860f3a85b05419075
Instruction Fuzzy Hash: DB119DB0D0E64A8FEB49EF39C5692B97AA1FF18300F4481BED449C21A2DA3965408781

Function 00007FFB4B3835B5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4120eeb677b06dfaa3bca88ccdeaed05c81c1a7d68f18df23e9da1ac5cacec44
Instruction ID: 1e30acb1a02bbcff113146583774a68e8d16a70f07181af775b1b280def824cd
Opcode Fuzzy Hash: 4120eeb677b06dfaa3bca88ccdeaed05c81c1a7d68f18df23e9da1ac5cacec44
Instruction Fuzzy Hash: 2E115AB090D64E8FDF45EF38C8992F97BE0FF18300F4054BAE55AD76A2DA35A4458B41

Function 00007FFB4B395FB9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12fb0a8223942355e84d8db3c89e2d2b6fa7a007c1131b385e34c337521c535d
Instruction ID: b61267d30e99ee4c386d2695bd347ecc2bbba48781a522a5ee1940831075ef35
Opcode Fuzzy Hash: 12fb0a8223942355e84d8db3c89e2d2b6fa7a007c1131b385e34c337521c535d
Instruction Fuzzy Hash: 2E1182B090D64A8EE741FB78C9591A9BFF1FF19310F0545F6D449C61A2EA34A4448751

Function 00007FFB4B394E8D Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37bc3926675ecbc31c88336c0b077998bbf149f425a4d84d42863992a3ff1e1c
Instruction ID: 04e06eace582ad10fefb4d02b4a05bcc4aef37e8ebff40498073d65cf5f593a6
Opcode Fuzzy Hash: 37bc3926675ecbc31c88336c0b077998bbf149f425a4d84d42863992a3ff1e1c
Instruction Fuzzy Hash: 7F119DB1D09A4E8FEB59EF3CC8596B9BBE0FF18304F0004BAD459C64A2DA34A6408741

Function 00007FFB4B38BEF1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B38A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B38A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b38a000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6aa0e1584986ae8218a8f5691a0942ece5ecf6d41c49f502112e2bb60ae0c3b
Instruction ID: 988e9bd84ce7d8f27bb15aee26b661fbfd4c77a99fcdfc83a445a812cf52a338
Opcode Fuzzy Hash: d6aa0e1584986ae8218a8f5691a0942ece5ecf6d41c49f502112e2bb60ae0c3b
Instruction Fuzzy Hash: EC118EB090C64E8FDF45EF78C4592B97BE0FF18300F4044BAD91DC61A2EA35A540CB01

Function 00007FFB4B394CCD Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d08af8995c1a4b348578f98cec7afc309dd4bcad247087885da3a07eac1153
Instruction ID: fcd4cc7c0765c04bfd4482facff359d1773709cda82b61649ca5dfe1dd5804b2
Opcode Fuzzy Hash: 95d08af8995c1a4b348578f98cec7afc309dd4bcad247087885da3a07eac1153
Instruction Fuzzy Hash: 3A119DB480D64A8FFB59EF38C4592B9BBF0FF18304F0444BAD449C31A2DA35A544C741

Function 00007FFB4B397AE9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9810f34db4753e4033f894b283c7cd77497950f44d09eb07414bd8de4e177ab
Instruction ID: cbf8455a64466c0d6f84d1cef075b4289948bea46cc06476cb95400227714161
Opcode Fuzzy Hash: b9810f34db4753e4033f894b283c7cd77497950f44d09eb07414bd8de4e177ab
Instruction Fuzzy Hash: 02118BB090E289CFDB1AAF34C9592B97BB0FF15304F0504FAD54AC64E2DE69A544C781

Function 00007FFB4B3805D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f779ab3d623b842261147536b03dd62ce5517af0e00e62afde3f697e3f345614
Instruction ID: b93bee9703724c85444599a28e3f4b41476abd1363ff88db4e7649a34379cec3
Opcode Fuzzy Hash: f779ab3d623b842261147536b03dd62ce5517af0e00e62afde3f697e3f345614
Instruction Fuzzy Hash: 81016D7090890E8FDF48EF26C5446B977E1FF58304F50457AD81ED2194CA31A961C741

Function 00007FFB4B38BAAA Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B38A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B38A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b38a000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44870ba7134e81d5f1c0b9aaa8b420b11044ad075753343640d558e96a26abb
Instruction ID: c969816cb073924e09ebbef306fbf8032e006c8bad70ce8d580370a107ed2945
Opcode Fuzzy Hash: d44870ba7134e81d5f1c0b9aaa8b420b11044ad075753343640d558e96a26abb
Instruction Fuzzy Hash: BA018CB090890E8FEF98EF78C4582B97AE0FF18301F1004BAD91AD21A1EE76A5508741

Function 00007FFB4B3828ED Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9152c97dd6f80b8477db6b4dd80ff603c7e85b424b77bb07bb976d3124628626
Instruction ID: 655070bada407428698508d6eb247ea5086484dc6037104a43a8658363be2ef6
Opcode Fuzzy Hash: 9152c97dd6f80b8477db6b4dd80ff603c7e85b424b77bb07bb976d3124628626
Instruction Fuzzy Hash: CF01BCB0D0C64D8FEF82FF38C9886B97BE0EF19300F4185B6D558C60A2EA34E0508782

Function 00007FFB4B38A8A9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B38A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B38A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b38a000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48067f723b6bdec44a6f9b605a9865ad9de47c8c38de2fe14509e0c57c1c537a
Instruction ID: 802d3f7178db2ae04374916b83a410a2f0e618275a4cbce44b3e45442d80f594
Opcode Fuzzy Hash: 48067f723b6bdec44a6f9b605a9865ad9de47c8c38de2fe14509e0c57c1c537a
Instruction Fuzzy Hash: E001D4B194D6498FEB42FF38C9491A97FF0EF19300F0545F6D548C70A2E928A4458712

Function 00007FFB4B397B5D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdbd29b4a879bea613f06e73bb7b079209515c6d76709021cc1bd978b3e84b1b
Instruction ID: f34c378b478dd3493d453cb1815e3939dd927672b5ae385571193765caaa1feb
Opcode Fuzzy Hash: fdbd29b4a879bea613f06e73bb7b079209515c6d76709021cc1bd978b3e84b1b
Instruction Fuzzy Hash: 7C019EB090D64ACFDB5AEF38C4992BA7BA0FF08304F5144BED55AC61E2DE35A440CB41

Function 00007FFB4B38A915 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B38A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B38A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b38a000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73bac93b98fe0802051385eca726983498265e12ab761084ac2793ef7c3e8cea
Instruction ID: 9e05f57a968850254074b3bfe70ff9b850f9714a9be70fc945489094365c33da
Opcode Fuzzy Hash: 73bac93b98fe0802051385eca726983498265e12ab761084ac2793ef7c3e8cea
Instruction Fuzzy Hash: 88F0C86760E38A4FDB129A2DECA11E93B74DF4222170583F3C144CA0A3E91D540B43A2

Function 00007FFB4B397529 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e234c86d4dd54c8652ea1e8354e2961dad1062a8f47b2dc5c366f1cf2553ad38
Instruction ID: cba73ff2adafd0f186a217d8b58b25d0f7657b09fac6c1e859344aa9656aa52e
Opcode Fuzzy Hash: e234c86d4dd54c8652ea1e8354e2961dad1062a8f47b2dc5c366f1cf2553ad38
Instruction Fuzzy Hash: D201D4B090E64ACFE792FB38C8491A97BF1EF59310F4544F2D558C70E2EA24A4448701

Function 00007FFB4B381C9D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4604fd416f57c67e9a06ce7ddedde9d2c2e7bed9c5be6867a07247bcca70fe
Instruction ID: c4ddbed311daf075b618fcbfe64b956d37b661b1c9e760a1aea069c08390f430
Opcode Fuzzy Hash: 1e4604fd416f57c67e9a06ce7ddedde9d2c2e7bed9c5be6867a07247bcca70fe
Instruction Fuzzy Hash: 5901D6B080DA4D8FEF54EE25C4555B97BF0FF59300F40417EE909C2091CB759860C741

Function 00007FFB4B382F89 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc05dfac47365f4d257987f2f9de1957c84df755cbaa0fdb9342ada2578329e
Instruction ID: f3afd1c4eb4de2428e5583a657a4aa57b5c3f9df33cf339e061358716ccbec08
Opcode Fuzzy Hash: bfc05dfac47365f4d257987f2f9de1957c84df755cbaa0fdb9342ada2578329e
Instruction Fuzzy Hash: F801D4B090D6498FEF42FB34CD491A97FE0EF49300F4548F2D548CB0A2DA28E544C712

Function 00007FFB4B380608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c178d284bb1e4e462ad6f6c194ff7ed0209b1ca152cc53a82e85d0b0b5299326
Instruction ID: 7cea0ee6738f74dc0cf1132d0b9f04b349b62fbe161463dd6e4c5fbdc17c1cf8
Opcode Fuzzy Hash: c178d284bb1e4e462ad6f6c194ff7ed0209b1ca152cc53a82e85d0b0b5299326
Instruction Fuzzy Hash: E6014B7091890E8AEF59EF34D9492B972E0FF18305F5048BED81AC21A1DE35B150C641

Function 00007FFB4B380610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2400477d9e8b9f3d7838a36c525630693e6984d9aefaca3c5a66323efdfea31b
Instruction ID: 7b5d3b55711ddbc08ce4c831a5e67bcbc38ecbaba7e40898ca30c144dfd6a2d1
Opcode Fuzzy Hash: 2400477d9e8b9f3d7838a36c525630693e6984d9aefaca3c5a66323efdfea31b
Instruction Fuzzy Hash: 16014B7091890E8AEF49EF34D8482B972E0FF18305F5044BEE81EC21A1DF35B590C641

Function 00007FFB4B3805D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888efb1eb87ce71820652e535a7c9811ebacd35355fea008d1d6fef053924d19
Instruction ID: 24b5067a1f04cce101334285824c722ca547de309e919e7085906064073c4c69
Opcode Fuzzy Hash: 888efb1eb87ce71820652e535a7c9811ebacd35355fea008d1d6fef053924d19
Instruction Fuzzy Hash: F8F0A9B080DA4E8FEF84AE3AD5056BA77E4EF09304F40457AE90DC20A1CA35A960CA81

Function 00007FFB4B382809 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e4557440e375250e0f4bcad9ae82b84395d2d1343b5c3dd08c1568c3b5da22
Instruction ID: 173145400411a2635527ef42f4366d989e7484fdf622083c4dece1d144b90cbc
Opcode Fuzzy Hash: 46e4557440e375250e0f4bcad9ae82b84395d2d1343b5c3dd08c1568c3b5da22
Instruction Fuzzy Hash: 6BF0AF7080E7898FEF5AAF34C9551A93BA0EF56201F4545FBD549C50E2DA28A548C342

Function 00007FFB4B380F84 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad744becf3f23f186083ab921c09a153dcbf8cde928436477ea879669df439a9
Instruction ID: ccc497766620e7ff58caae9d1b3f93bb89124c8111f3f0a5d764d66f455490e1
Opcode Fuzzy Hash: ad744becf3f23f186083ab921c09a153dcbf8cde928436477ea879669df439a9
Instruction Fuzzy Hash: 0D011670D095098BEB60EF74CA54BADB3F4EF08300F1081B5D409A72A5DE356A408B61

Function 00007FFB4B38287D Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b380000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16ef3462edf9d6b249301dc67de4170e2ec321aaa3120b9addc0cedd3619c8a
Instruction ID: 11f475d7b253d1194e0ec2bdccacdc718974b4a947b1f6a055b2e7824984f349
Opcode Fuzzy Hash: a16ef3462edf9d6b249301dc67de4170e2ec321aaa3120b9addc0cedd3619c8a
Instruction Fuzzy Hash: FBF09AB180D68A8BEF59AF34C8592F97BE0FF55301F8085BEE959C10E2DB39A4548741

Function 00007FFB4B38FAFC Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B38F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B38F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b38f000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c82686bf87ee26526415ed9c3c42b61700aa092e3ff6cfc6b7a78ab4b714718
Instruction ID: 0cf5ba9300ad2de2eb1bbed9a8be221d9110dc05c2bd45a7c02d92f502cb786c
Opcode Fuzzy Hash: 8c82686bf87ee26526415ed9c3c42b61700aa092e3ff6cfc6b7a78ab4b714718
Instruction Fuzzy Hash: 0BF067B0D1992D8EDBA4EF19C9947B9B6F1EF58301F1040EA940DE22A1CA341A818F41

Function 00007FFB4B388C02 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B387000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B387000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b387000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2360cffdeae565a30a7327744b3bff3e653b500c6d476dcd3b933b8daf6ff2ba
Instruction ID: f2a10971c567ba3ca1611b7f7d770a34beb757fc76d60b1b04951e81a63e7936
Opcode Fuzzy Hash: 2360cffdeae565a30a7327744b3bff3e653b500c6d476dcd3b933b8daf6ff2ba
Instruction Fuzzy Hash: FBD06CB09095298EDFA4EA29C9457A8B7B1AB48300F1041E9824DE3260EF302A818F15

Non-executed Functions

Function 00007FFB4B3954E1 Relevance: 11.6, Strings: 9, Instructions: 341COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFB4B395701
@ZBK, xrefs: 00007FFB4B395559
L_^, xrefs: 00007FFB4B395601
PZBK, xrefs: 00007FFB4B395569
0ZBK, xrefs: 00007FFB4B395549
pZBK, xrefs: 00007FFB4B395589
YBK, xrefs: 00007FFB4B395529
`ZBK, xrefs: 00007FFB4B395579
0YBK, xrefs: 00007FFB4B395539

Memory Dump Source

Source File: 00000013.00000002.1551553695.00007FFB4B391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffb4b391000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: YBK$0YBK$0ZBK$@ZBK$PZBK$`ZBK$pZBK$L_^$L_^
API String ID: 0-3155745129
Opcode ID: ee2e99724bb1a245eb656b3d47f73a66c05bbb2f73df29bf2e96f3bd1910ff5c
Instruction ID: 59a3cb0ee257bb650659392c3f5b93c792f305524c9350ce406e9591df510452
Opcode Fuzzy Hash: ee2e99724bb1a245eb656b3d47f73a66c05bbb2f73df29bf2e96f3bd1910ff5c
Instruction Fuzzy Hash: 68A1EAC3A0E6924BF3127ABCF9971FD3FA0EF436B574941F7D1898A0A3AC19544A42D1

Analysis Process: XnhYPNWiKV.exePID: 4032, Parent PID: 660COMMON

Executed Functions

Function 00007FFB4B3634A0 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ed8fbcf5a9f193252ab3f88534b1ef1ab4e5b540d0415ae6fdf8f6d86912b7
Instruction ID: 6c8ef034c1966c80b0160aa455f1af19a55ecaaeb16e3f83db90f8820783fd8e
Opcode Fuzzy Hash: b7ed8fbcf5a9f193252ab3f88534b1ef1ab4e5b540d0415ae6fdf8f6d86912b7
Instruction Fuzzy Hash: F2E1BEB190DA8A8FEB55EF7CC8553A97BE0FF99310F4041BEC109C72A2DB7858468B51

Function 00007FFB4B36CBE8 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ac6670df36260296fd2802ad9ab101502335c6835f77564bac63d4dc195cde
Instruction ID: ceb74b731ff285c9de765917eb90831456225cb55be9264a84775573e9e46e8c
Opcode Fuzzy Hash: 98ac6670df36260296fd2802ad9ab101502335c6835f77564bac63d4dc195cde
Instruction Fuzzy Hash: 0BE1A0B090D64E8FEB99FF38C8596B9BBF1FF18310F0185BAC589C61A2DA346545CB41

Function 00007FFB4B36A63D Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8b9a2593ffb9fd6eac70165483e590c895105b7f9205f7cd7717b8327f48ac
Instruction ID: a0f2b1d9f931855b5678e546d015cafde76f485ce687de326d5762ea2f83d8fa
Opcode Fuzzy Hash: 6c8b9a2593ffb9fd6eac70165483e590c895105b7f9205f7cd7717b8327f48ac
Instruction Fuzzy Hash: B9B1BCB090D68A8FD756EF38C8582B97BF0FF1A300F0185BBD549C70A2EA38A556C711

Function 00007FFB4B36E6C5 Relevance: 7.7, Strings: 6, Instructions: 180COMMON

Download Yara Rule

Strings

T, xrefs: 00007FFB4B36F6CD
0, xrefs: 00007FFB4B36EF26
_, xrefs: 00007FFB4B36EF53
(, xrefs: 00007FFB4B36F74F
{, xrefs: 00007FFB4B36E6D9
F, xrefs: 00007FFB4B36E7AE

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: ($0$F$T$_${
API String ID: 0-1251583540
Opcode ID: de2c3be70b2a10900ccbbaaccee9724797a74a73f9c37a2a2b02ac4c7b8b404e
Instruction ID: a6e595d6a1b0c132836413098b0d4f466966812183c21f79e18b527b55ad9bcc
Opcode Fuzzy Hash: de2c3be70b2a10900ccbbaaccee9724797a74a73f9c37a2a2b02ac4c7b8b404e
Instruction Fuzzy Hash: F471D4B4D096298FDBA4EF29C9547E9B7B1FB58305F0041EAD60DE3291DB345A858F40

Function 00007FFB4B36D6C0 Relevance: 3.0, Strings: 2, Instructions: 519COMMON

Download Yara Rule

Strings

N$K, xrefs: 00007FFB4B36D894
p\$K, xrefs: 00007FFB4B36D902

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: N$K$p\$K
API String ID: 0-750528192
Opcode ID: a27fbaf8f5b717d988df6b63119e986dafe956b6c60714642f9d52506e78b033
Instruction ID: 58063ebea45f5f045f71bed04812ea67aae1807bed0f78931df392d74982f4bb
Opcode Fuzzy Hash: a27fbaf8f5b717d988df6b63119e986dafe956b6c60714642f9d52506e78b033
Instruction Fuzzy Hash: 7B125EB091DA4A8FEB69EF68C4557B8BBB1FF19300F0440BED44DD72A2CA386845DB51

Function 00007FFB4B36122D Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

py%K, xrefs: 00007FFB4B36129D

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: py%K
API String ID: 0-413557920
Opcode ID: 2bdec3b366ea488511890ab67ea01828d4b0714f5ec1cc5ab3df2aefdcb6d3cd
Instruction ID: 7e239dab2eeacc63326d52eb6310a1d32aca964ad33a04111ef2f6eb53c5351a
Opcode Fuzzy Hash: 2bdec3b366ea488511890ab67ea01828d4b0714f5ec1cc5ab3df2aefdcb6d3cd
Instruction Fuzzy Hash: B271E1B090DA4E8FEB65EF7DC8592B97BF1FF59310F0451BED50AC71A1DA24A8148780

Function 00007FFB4B361B65 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

2E?K, xrefs: 00007FFB4B361B8B

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: 2E?K
API String ID: 0-3035042361
Opcode ID: 560ff8a4de499e51348796282d3364383bd06161bb867c05ea2bcaa86855af0c
Instruction ID: d942a695fd9f386a79bd0ac47fef727ff187708a2361e4a7a299c1f6dfce6e5e
Opcode Fuzzy Hash: 560ff8a4de499e51348796282d3364383bd06161bb867c05ea2bcaa86855af0c
Instruction Fuzzy Hash: AD61D57190DB8E4FD766AE39C8552F93FA1FF46300F0451BED548C71A2EA689C29C741

Function 00007FFB4B361DC2 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

2E?K, xrefs: 00007FFB4B361EA3

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: 2E?K
API String ID: 0-3035042361
Opcode ID: f75f666c9238496c6f7f6423d8be01e87b7ceac7d2e88544cc5a57037efb4638
Instruction ID: 6bc2e0259b2d8fb81b0c46e3c065b7ed8d14c8c2d91dd68046fe0eb17292cf6f
Opcode Fuzzy Hash: f75f666c9238496c6f7f6423d8be01e87b7ceac7d2e88544cc5a57037efb4638
Instruction Fuzzy Hash: 86618F71A0CA498BDB59EE6CC8A15B977E2FFD8344B14416DE58EC3292CE30EC12C781

Function 00007FFB4B36C63D Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

%;~, xrefs: 00007FFB4B36C67E

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: %;~
API String ID: 0-1337976228
Opcode ID: f3460f3dce17430c442f3d97972f65ba3657e83e657ceb4a7e4e7f7f20109307
Instruction ID: 8da086033b0d758df53a89143f1487b38cc4246c27f8233d3ee1200defe69eaf
Opcode Fuzzy Hash: f3460f3dce17430c442f3d97972f65ba3657e83e657ceb4a7e4e7f7f20109307
Instruction Fuzzy Hash: 50510BAA90E6568EF3127B7DE5021ED3B60FF42B30B4445F7D649C9093EE28244682B1

Function 00007FFB4B36C5CF Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

%;~, xrefs: 00007FFB4B36C67E

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: %;~
API String ID: 0-1337976228
Opcode ID: c9d1d33612ccadb1e51c6fc66ead13cadbbe594615de966750ceb13967692370
Instruction ID: 4c584d989e25b9334f4603191859a14d78e3638f443181967d41ae2ae4d4f7f9
Opcode Fuzzy Hash: c9d1d33612ccadb1e51c6fc66ead13cadbbe594615de966750ceb13967692370
Instruction Fuzzy Hash: 8951DBA790E6568EF3167B7DE5021ED3B60EF42F30B4445F7D689C9093EE28744682A1

Function 00007FFB4B361240 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

py%K, xrefs: 00007FFB4B36129D

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: py%K
API String ID: 0-413557920
Opcode ID: 25f5374fd5f9d69113ca2e308113f090a80f402aac87a3acc700039acac4cc07
Instruction ID: 660f1a92d42068e32eda1a6bde5a59ff85f98b9685069e3dcad8ae8a869fe30d
Opcode Fuzzy Hash: 25f5374fd5f9d69113ca2e308113f090a80f402aac87a3acc700039acac4cc07
Instruction Fuzzy Hash: 8631D3B090DA4E8FEBA8EF7DC9156F97BE0FF55311F04507ED509C71A1DA6468248780

Function 00007FFB4B3609B0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

8v%K, xrefs: 00007FFB4B360A70

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: 8v%K
API String ID: 0-1297765199
Opcode ID: d3077734ea6e5c873ec7e10b4c8ed5d571a739520daa38c3bdd58ad84cff8589
Instruction ID: b57c16ed70da41a2f111caa128e0eed2ccc1c30f9aa5b48dd81c6c497f5eb936
Opcode Fuzzy Hash: d3077734ea6e5c873ec7e10b4c8ed5d571a739520daa38c3bdd58ad84cff8589
Instruction Fuzzy Hash: 9731ADB091C60E8EE791FF7CC88A2A97BE1FF58300F4085BAD559C60A2EE34A5448750

Function 00007FFB4B360991 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

8v%K, xrefs: 00007FFB4B360A70

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: 8v%K
API String ID: 0-1297765199
Opcode ID: af1fd76b5b296f99c3248b0a3bc80db4769a1e156eb15d6eca73303ad4dc893f
Instruction ID: bf9c151604423bed205d31d2594135ae25195ece1ed2b72df672b6917485b250
Opcode Fuzzy Hash: af1fd76b5b296f99c3248b0a3bc80db4769a1e156eb15d6eca73303ad4dc893f
Instruction Fuzzy Hash: 2721F5A1C5D68E4FE761AF7CC99A1F97FE0FF45200F4045BBD648C60E2EA68A4048351

Function 00007FFB4B360A18 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

8v%K, xrefs: 00007FFB4B360A70

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: 8v%K
API String ID: 0-1297765199
Opcode ID: 0901981826952ca887e4e875a756af6179746283485c850cbaaa523d2eefeeae
Instruction ID: 7393334e09b871f8da94232fbc97cd8ec9587cee680b9bec4183dff5190bcfdb
Opcode Fuzzy Hash: 0901981826952ca887e4e875a756af6179746283485c850cbaaa523d2eefeeae
Instruction Fuzzy Hash: 5F0162A5D1C54F4AE7A0BF7CD9961FD77A4FF58240F4044BED61CD20A2DE7869048750

Function 00007FFB4B36C700 Relevance: .7, Instructions: 672COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c359389e7bde961ed8f8b3ee04201070374d9001d11ec2806ccfe9dea73e0c36
Instruction ID: 12e56b6befbda79d0006d9723f2564bfc6b62e76ede0e75a2d60766040ccdd9b
Opcode Fuzzy Hash: c359389e7bde961ed8f8b3ee04201070374d9001d11ec2806ccfe9dea73e0c36
Instruction Fuzzy Hash: 5C51A27090D64ACFEB86EF38C8592B97BB0FF19300F5184BAC45AC65A2DE35A545C741

Function 00007FFB4B36BCE8 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ac0d8f76be29939cf3fec091df8e68b2c1c33529cbea0936f6bc64588b86bc
Instruction ID: 8f45a3ddd8c83620be7f3c878a9bb3c4991406362444c226c0a69b767b8698e6
Opcode Fuzzy Hash: 58ac0d8f76be29939cf3fec091df8e68b2c1c33529cbea0936f6bc64588b86bc
Instruction Fuzzy Hash: E7F19CB090D68D8FEB65EF78C8596B97BB0FF19300F4040BED549C71A2EA38A845CB51

Function 00007FFB4B362D3D Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea96661b0ecf20d9ea5f106fe3c7460ac2e42597e0213b1957dc3ca6cef3a902
Instruction ID: 416d0068064e8f1bb4efc2bc8c48e898c2a49526b49537ae782c9e2de0d7c1a6
Opcode Fuzzy Hash: ea96661b0ecf20d9ea5f106fe3c7460ac2e42597e0213b1957dc3ca6cef3a902
Instruction Fuzzy Hash: 22C1B2B0D0D64A8FEB61FF3DC9486A9BBE0FF19300F0685BAD549C70A2DA38A5448751

Function 00007FFB4B362135 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa3593c9cd2319cac49af0dcde0758ae68bfffe39af069ec4edf618d18e4d70
Instruction ID: f36083fdb0f4fd566e3a3c580b8cf6dd949f3617c8bbe85914dfc30f904d266f
Opcode Fuzzy Hash: 1aa3593c9cd2319cac49af0dcde0758ae68bfffe39af069ec4edf618d18e4d70
Instruction Fuzzy Hash: 64A104B1D0D64A8FEBA5EF39CD456B8B7A0FF45300F0181BED54EC71A2DE2869458741

Function 00007FFB4B375F40 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dfecfb54391e83a9aa005f786a446cbf138269fc70f2f4c9be5cfe82fcf3a13
Instruction ID: 1c8a19140aa3508ed2f50fde351d97f0d37afb2c5bfc80951ad7d038d5058e5b
Opcode Fuzzy Hash: 7dfecfb54391e83a9aa005f786a446cbf138269fc70f2f4c9be5cfe82fcf3a13
Instruction Fuzzy Hash: E7C13DB0D0C65A8FEBA4EF69C9557ADBBB0FF05310F1081BAD54DD2292DB385984CB41

Function 00007FFB4B36BE30 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259e27f3be17c5b6b10f0562f619e87a6f966f6e834aec07ae3b417d1da64b31
Instruction ID: c97d3dfd69878e7ed813c0d30caf88dcf6aa2bb04f5168785d7690e85cdceb14
Opcode Fuzzy Hash: 259e27f3be17c5b6b10f0562f619e87a6f966f6e834aec07ae3b417d1da64b31
Instruction Fuzzy Hash: C9A14BB0D1D64D8FEBA4EF78C9556ED7BB0FF09300F4081BAD509D71A2EA38A9448B41

Function 00007FFB4B362AC0 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf61a848d3ab57d6513702a500580da89f98ba2601cb5bcc5f00731c8553bee
Instruction ID: 0f74717d891ae891230f24d85f13df72c8347d21d1888fce696ccca494335bca
Opcode Fuzzy Hash: faf61a848d3ab57d6513702a500580da89f98ba2601cb5bcc5f00731c8553bee
Instruction Fuzzy Hash: C29196B090D64A8FEB55EF78C9582FD7BB1EF09310F1084BAD499C61A2DA38A544CB41

Function 00007FFB4B36AAE0 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf94eb9bd21ef207f4371e7031edef6cdb8b1fe9872df44f32f3bc4aa224936f
Instruction ID: 678f9fcc878646bd5f2271733d4f3c8753e851da13e516acc823e0060d9a61a4
Opcode Fuzzy Hash: cf94eb9bd21ef207f4371e7031edef6cdb8b1fe9872df44f32f3bc4aa224936f
Instruction Fuzzy Hash: C2818BB090D64E8FDB95EF78C8586BA7BB1FF19300F0085BAD48AD71A1DA35A945CB40

Function 00007FFB4B36BEA0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b051fb924c9585a6efad8c3dfaece9683b3903260080d27c13b31cd6d07d7ef4
Instruction ID: a3cd5562453a51128db254807e3a35c166253170d48926673fe89e33100108eb
Opcode Fuzzy Hash: b051fb924c9585a6efad8c3dfaece9683b3903260080d27c13b31cd6d07d7ef4
Instruction Fuzzy Hash: 2C7127B0D1CA5D8FEBA4EF69C9556FDBBB1FF09300F4041BAD509D31A2DA38A9458B40

Function 00007FFB4B3636BE Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a308953b823ec652e3aaa2069b46cf28c4681e8d6434f4bb730948a360b6e41
Instruction ID: c95d161278198844891dd4c6bc25db623d8f993df546c4e5cb39d3c49f0862bc
Opcode Fuzzy Hash: 9a308953b823ec652e3aaa2069b46cf28c4681e8d6434f4bb730948a360b6e41
Instruction Fuzzy Hash: 7E718DB291894D8FEB98DF6CD8553AC7FE1EB9A310F4041BAD00CD72D6DBB818068B51

Function 00007FFB4B362A88 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283dc2e2601db5fae69931a90d6834a1a4efaf207c87b0acc5fa4d0fe7bed9d3
Instruction ID: 04f17a06c17157cab23dc70e106bddd773c9ff6b6aa60697a7c1cea951728dbc
Opcode Fuzzy Hash: 283dc2e2601db5fae69931a90d6834a1a4efaf207c87b0acc5fa4d0fe7bed9d3
Instruction Fuzzy Hash: 1471ABB0D0D24A8FEB61EF7DC9552EDBBB0EF49310F0080BAD509D61A2DE78A945CB10

Function 00007FFB4B360600 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902c1abde1578b4399b9bd084a4da0536a9a2686dbe5ace13955c702a1b5af8f
Instruction ID: f18019adcbfc51a4af79d269773986ba607063516fa8d0488cdbff98d6c8052f
Opcode Fuzzy Hash: 902c1abde1578b4399b9bd084a4da0536a9a2686dbe5ace13955c702a1b5af8f
Instruction Fuzzy Hash: 5751CF7090DA8E8FE765AF39C8586BA7BE1FF45300F0095BED509C71A2DA34AC55C741

Function 00007FFB4B36310F Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c305f24a518321e6ce53cabd40f5267eb8081fee01244bca5ca47de801d00e
Instruction ID: a713b234bb6acd766a091386d7bfde48fc932bcce67a5edc53b8f82adceca97a
Opcode Fuzzy Hash: 67c305f24a518321e6ce53cabd40f5267eb8081fee01244bca5ca47de801d00e
Instruction Fuzzy Hash: 4661D270D0D68A8FE762AF3DC9593E97BF0EF06300F0485BAD548C61A2EA38A545C751

Function 00007FFB4B36AC78 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3dc274bb7b1c930d46a1024263a72ca27a36c170b0db3bbf0f184f9a194fafc
Instruction ID: de989d92bd7b97f9fbfc8881b1e764dfed0309cc4975882a72a3c3d784d9c8be
Opcode Fuzzy Hash: f3dc274bb7b1c930d46a1024263a72ca27a36c170b0db3bbf0f184f9a194fafc
Instruction Fuzzy Hash: 7F61D7B190D68A8FE761FF3DC9591E97BE0FF15301F0484BAC558C70B2EE24A4698750

Function 00007FFB4B36C6D3 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1426038d40d2c47d80b91ed3504c923413b0fa71af1755cfe8b73661ff53fc57
Instruction ID: 5fdd4fd1eceb6e2a3ca3b7fa913fe57496e220306fe6674b6043280f8eab4375
Opcode Fuzzy Hash: 1426038d40d2c47d80b91ed3504c923413b0fa71af1755cfe8b73661ff53fc57
Instruction Fuzzy Hash: E95107AAA0E6564EF7167B7DF5121FC3B60EF42F31B4441FBD648C9093DE28244A82B1

Function 00007FFB4B362AA8 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569a827a08ca7dfa23947a9919b3ba8b5cadfa8004ab94d4b1192c8ad4a51dde
Instruction ID: c83d2b435186b28cf35a8f3ec01410f75507de914bf79bbb71ac11707fb8ecc2
Opcode Fuzzy Hash: 569a827a08ca7dfa23947a9919b3ba8b5cadfa8004ab94d4b1192c8ad4a51dde
Instruction Fuzzy Hash: 6F617AB0D0D64A8FEB65EF7DC9552EDBBB0EF49300F10407AD509E61A2DE78A945CB10

Function 00007FFB4B362E99 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e8da2b2b2e2aa1109c403553ffb4fe9892f4dd27eb5e25b1dd955c384df9cb
Instruction ID: 214add507316146fdc0c0bd01063437df993da1424ed196a1faf43d990d60826
Opcode Fuzzy Hash: f3e8da2b2b2e2aa1109c403553ffb4fe9892f4dd27eb5e25b1dd955c384df9cb
Instruction Fuzzy Hash: 725191B0D0D28A8FEB61EF79CD192FA7BB0EF05300F0545BAD544C60A2EA78A549C751

Function 00007FFB4B36BAA8 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083f6b32bc490b0f499c138b912b02d08db7dadf0b0f0f9fcf04c8a02193605b
Instruction ID: 14a5428222f2f8a46ddeb10eaa25c6864fde0d89de7ae5f0f838a123c7f329f4
Opcode Fuzzy Hash: 083f6b32bc490b0f499c138b912b02d08db7dadf0b0f0f9fcf04c8a02193605b
Instruction Fuzzy Hash: 6D5136B0D0964D8FEB64EF68C5556EDBBF1EF08310F1044BED509E72A1EA38AA44CB54

Function 00007FFB4B360500 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e165a2bcc61d7ac45de8320085a9705759cc3c3ba00daeb477ae4dba35435de
Instruction ID: 66ccf7214f1caebebcbf7f9d618c5833e934eb762c0ccb98f2b7994511e72835
Opcode Fuzzy Hash: 2e165a2bcc61d7ac45de8320085a9705759cc3c3ba00daeb477ae4dba35435de
Instruction Fuzzy Hash: AC51D67091D68E8FEB66EF38CD585A97BF0FF19300F0644BAD948C60A2DA38E454CB11

Function 00007FFB4B361C39 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 506a3e01bf606817b6de0860f62320914d20b4edfa492b6320ecca0dc476aac1
Instruction ID: 256cd45e5a9025b7245f61758b054f2d3349a9b2f8f29ff6655e3a5ef2ead8ff
Opcode Fuzzy Hash: 506a3e01bf606817b6de0860f62320914d20b4edfa492b6320ecca0dc476aac1
Instruction Fuzzy Hash: 7841D27180DA8E4FEBA5AE39C8542BA3BE1FF45300F0051BED509C71A2DA759C25C781

Function 00007FFB4B36AED5 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792234c0cdfbbf7952487c7054484dfb49b2b36e4910d1d7f377d6ea6f50610e
Instruction ID: 6659238f485ee30728175ac0168d78a1b2be8e99aa3e808f67b77bc2af8ee950
Opcode Fuzzy Hash: 792234c0cdfbbf7952487c7054484dfb49b2b36e4910d1d7f377d6ea6f50610e
Instruction Fuzzy Hash: 3F519FB0D0860A8FEB61EF39C8556EE77F0FF48300F1085BAC109D71A2DA38A9958B50

Function 00007FFB4B3626AD Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b883e586add9cbdbe3464361b4b876768938ecff4d83d7bc664eb6c6ba2de68
Instruction ID: 67a1beb8db6ca45733b29de8f9f2405c03f3ef9cf2ca212e6d5d25ff48f0fad6
Opcode Fuzzy Hash: 8b883e586add9cbdbe3464361b4b876768938ecff4d83d7bc664eb6c6ba2de68
Instruction Fuzzy Hash: D441927081E78A8FDB66EF38CD545A57FB0FF16300F4545FAD948C60A3EA68A454C741

Function 00007FFB4B3605F0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47018ede9f053040a544bad28875b4e603bbf0f86b3b4eff42ffedec40af21a8
Instruction ID: c9325aae99f5ec42df30b6fdf19d9f9d393346c8e3f1341025efe9994e309358
Opcode Fuzzy Hash: 47018ede9f053040a544bad28875b4e603bbf0f86b3b4eff42ffedec40af21a8
Instruction Fuzzy Hash: 5041C27080DA8E4FEBA5AE39C8542BA7BE1FF55300F0091BED509C71A2DA349C25C781

Function 00007FFB4B36085D Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3319dc1b33515ec6b8849677bb8be223838f567264902b7db1532f6af39bffb5
Instruction ID: ed83f4d6bd6c1a6cec8b4ec163818383c8fcb6c958472e33faa5fcdf5cb201e4
Opcode Fuzzy Hash: 3319dc1b33515ec6b8849677bb8be223838f567264902b7db1532f6af39bffb5
Instruction Fuzzy Hash: A241057194D64D8FE762FB3CC98A1E97BE0FF59300F0145BAC588C60A2EA64A444C751

Function 00007FFB4B3631C0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff03d3c6e150c0ddd7aa1bb67566ace4f20e540ae3fdbb1967ed36b441b87115
Instruction ID: 2d2e7192548748dc9b903f7872f8d314b6beb73cce1d59f4d4bce69415a1cb38
Opcode Fuzzy Hash: ff03d3c6e150c0ddd7aa1bb67566ace4f20e540ae3fdbb1967ed36b441b87115
Instruction Fuzzy Hash: D941BF70A1D64D8FE762FB3DC9497AA7BE0EF49300F0585BAD508C70A2EA38A545C701

Function 00007FFB4B3628ED Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6af48dcdc129d0a4c619cc40a8fb355b4dda59ed4720cb7bef9328f21b82619
Instruction ID: eb992badbfdb12e5e3316a443d7f6ad1ee7e8402dc9efd309a60ad809b39edcf
Opcode Fuzzy Hash: e6af48dcdc129d0a4c619cc40a8fb355b4dda59ed4720cb7bef9328f21b82619
Instruction Fuzzy Hash: EC412BB590E2558FE712FF7CE8859D93BB4EF46720B0582F7D1C8CA0A3D938A4498761

Function 00007FFB4B36CB90 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e407d7b2351a67f8327053d9bb8f9fd7bc9adfba8f5f5aafaaab0b672692f5f2
Instruction ID: e4c25541e8a9afc8daab1ae50f9cd32964247b9b7657bc4cfba51a6d4db073c1
Opcode Fuzzy Hash: e407d7b2351a67f8327053d9bb8f9fd7bc9adfba8f5f5aafaaab0b672692f5f2
Instruction Fuzzy Hash: F341ACB090CA4E8FEB99FF38C5A96B97BA1FF18300F0081BED58DC25A2DA356444C751

Function 00007FFB4B36ECBA Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2542db6162a1a9b82722cb9529dc9c851f27578db75898ea6c4d4c41b144514e
Instruction ID: 9e3741cf83e9561265ac914fa3b6705eef62d4dd880670bd13c7e601e9347958
Opcode Fuzzy Hash: 2542db6162a1a9b82722cb9529dc9c851f27578db75898ea6c4d4c41b144514e
Instruction Fuzzy Hash: 83413CB1D189598FEBA8EF28C8457A8B7B1EB58301F0041EED50DE3291DE346E828F55

Function 00007FFB4B362F28 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76271a59cb4770a96a4f4a85d9d1578885008395e8cbea5432b0f4db05ce6d17
Instruction ID: 99a2834a080edbeb5285a67500c86af1692fc504e5dc5f739415b66fbe3ece04
Opcode Fuzzy Hash: 76271a59cb4770a96a4f4a85d9d1578885008395e8cbea5432b0f4db05ce6d17
Instruction Fuzzy Hash: D441D4B0D0D24A8FEB61AF3DCE152FABBB0EF05300F05457AD505C61A2EE78A509C741

Function 00007FFB4B3605D0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8890b697900876375ef13a541fea26b6b6167b668996c049c71f992200ff427d
Instruction ID: fa1163219a333007f9d967960a56d1a87151e4dcd1bae3e2d4cfe7bd3c94930b
Opcode Fuzzy Hash: 8890b697900876375ef13a541fea26b6b6167b668996c049c71f992200ff427d
Instruction Fuzzy Hash: DC31E3B180DA8E4FD765AE39C8142BA3BE1EF55300F1441BED409C71A2DA359C15C781

Function 00007FFB4B36C7A0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81440b6f39abaf1b809aa24f84d5dd5caaf4e6821f64cae19432dd1d2b1fd113
Instruction ID: 0c2b6b977335c5c0276e29826bdd3267e19dfe02c56fd797f88cd12b0b617b29
Opcode Fuzzy Hash: 81440b6f39abaf1b809aa24f84d5dd5caaf4e6821f64cae19432dd1d2b1fd113
Instruction Fuzzy Hash: 4731E4B590E7868FE716BB7CD8161E93FB0FF06610B4444FBD589CA0A3DA38644AC761

Function 00007FFB4B36240F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e812071e2cc85358930e63032b509ddc08056ba2786cc70376b266d609acd107
Instruction ID: e5bac2d301812178ffae5fed18878954bb277cd9309b92d7e05709d85d95c709
Opcode Fuzzy Hash: e812071e2cc85358930e63032b509ddc08056ba2786cc70376b266d609acd107
Instruction Fuzzy Hash: 3741D9B1D091298EEB65EF29CA457EDB2B0BF15300F5185BAD14DE72A1DF786A84CF00

Function 00007FFB4B362739 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6abc9342275300e582424320938ae8178aa9c372bfb9320ecb9445414d84ca2
Instruction ID: e14d7419d9b9959090c9a67b0e89719f5c9a5208944a9b18cb7f4b77bf9c3b4f
Opcode Fuzzy Hash: d6abc9342275300e582424320938ae8178aa9c372bfb9320ecb9445414d84ca2
Instruction Fuzzy Hash: 5731C47581E78E8FEB66EF38CD542A97BA0FF15300F4645BAD908C60A2EA78E454C741

Function 00007FFB4B3605F8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a953ea19e684417ecca665a2da9a95de3c80c82cca4c09c03c394f3fcff9f65
Instruction ID: 8d0e8818ab5fa20e3c82b9b99c9fc9b235cd236b49091b5e2bd91882d4367a40
Opcode Fuzzy Hash: 9a953ea19e684417ecca665a2da9a95de3c80c82cca4c09c03c394f3fcff9f65
Instruction Fuzzy Hash: 6131B37481E78E8FEB6AEF38CD546A97BA0FF15300F4544BAD908C60E2EA28E554C741

Function 00007FFB4B363228 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28fcceaf7d545decd897745c84b31ebd7facd58e7bf522887fd7d8428f304343
Instruction ID: adff76b70fe8b078cc2fc163ac2ea54bd919954eb98a5ab1aa97928f0b750a8a
Opcode Fuzzy Hash: 28fcceaf7d545decd897745c84b31ebd7facd58e7bf522887fd7d8428f304343
Instruction Fuzzy Hash: 96319AB0D0D64E8EEB65AF7DCA553EDBBA0EF45300F50847ED509D21A2EE78A5058B00

Function 00007FFB4B3604F8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a4d60c317dc5a0219247c5593e994136dc3767a00449f47250f15b2be78b18
Instruction ID: 5ec2b52ffabef47973c1717ab7f2bcf27b0869c6267a290ca30573b71a5a8de9
Opcode Fuzzy Hash: 30a4d60c317dc5a0219247c5593e994136dc3767a00449f47250f15b2be78b18
Instruction Fuzzy Hash: CC31AD7090DA4E8FEB99FF38C8486A97BE0FF19301F0184BED809C60A2DA35E544CB10

Function 00007FFB4B362F99 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f52c2b4f7f8f62e80287420dab2e2e594769bd3dc7ee108f8e008ce7c7a336d
Instruction ID: ef0704a72a3c1fa0cd7b460a953167375d1bd84e02154a5a2e87d12ab746dd9b
Opcode Fuzzy Hash: 8f52c2b4f7f8f62e80287420dab2e2e594769bd3dc7ee108f8e008ce7c7a336d
Instruction Fuzzy Hash: 3E21B1F1D0D24B8AEB21AE7DCA052FABBA0FF05301F05447AD505D61A1EE78A619CB81

Function 00007FFB4B36ADC8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae220f22088dd54c5c405d2bbd470c1110601cf6f95640d43fb622eeda650f9
Instruction ID: fa8e830358ddb2d937e33a7e84564b5c65d9260846bbefe9082609175e8784f1
Opcode Fuzzy Hash: dae220f22088dd54c5c405d2bbd470c1110601cf6f95640d43fb622eeda650f9
Instruction Fuzzy Hash: 3411D670C5E78A8FE761BF3DCA551FA7BE0FF05300F0094BED604C50A2EA68A429C601

Function 00007FFB4B363298 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2064dba35ca861a01f0f12e7c090d8cabf782613c51dd6885d55459b810652f9
Instruction ID: 88f87cb10c6d7b8257f69795cecab14a19cdd94573712bfe1410702f2cd98f2f
Opcode Fuzzy Hash: 2064dba35ca861a01f0f12e7c090d8cabf782613c51dd6885d55459b810652f9
Instruction Fuzzy Hash: E22158B0E0D60E8AEB64EFBEC9553FDB7B1EF44300F508539D509E22A1DE78A9058B41

Function 00007FFB4B3627A8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6270f5393d039455bbef7259fa96641de3cedc2dc7193024a3e342f57fa0ae00
Instruction ID: f1165e5b9fdb8719e51f38ab20907c9431f550846f9eb1248d356e0814c2e28b
Opcode Fuzzy Hash: 6270f5393d039455bbef7259fa96641de3cedc2dc7193024a3e342f57fa0ae00
Instruction Fuzzy Hash: DE11A27081D78E8FEBAAEF38CD541A93BA0FF15301F0544BED948C60A2DA79E554C741

Function 00007FFB4B3605D8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf57c31267759623637b00c746107eb4eae8926cafb5300dc02e85347f4b4d1
Instruction ID: 7c7c99b1b16f822719417bff3fb4a9a4ba96609c6d73bfa996e6448c322f1147
Opcode Fuzzy Hash: bdf57c31267759623637b00c746107eb4eae8926cafb5300dc02e85347f4b4d1
Instruction Fuzzy Hash: A911DD7090CA8D8FDB69EF39C4545B97BA1FF09300F1081BED80AC30A2DA35A860C740

Function 00007FFB4B36B043 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abacee4c5b7d63e908b8aa70be6d5b9f9d55db86ec25fb5b35c91ee401f9e1e6
Instruction ID: 966af790e4790816d92b0b7eb9ed6839f782b2ad7442ce391ee15c00df45a767
Opcode Fuzzy Hash: abacee4c5b7d63e908b8aa70be6d5b9f9d55db86ec25fb5b35c91ee401f9e1e6
Instruction Fuzzy Hash: 8911E9B0D085298EEFA4EF69C445BEDB7F0AF58300F1081BAD51CA2296DB3859858F50

Function 00007FFB4B360610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee1942a1311764baf783dc50c77dd68aeb822d3ea7eb228bb08af345ac266ae
Instruction ID: 07f81fdd8722db5a25ab61858d42d1bcbecaf561245f82f71ec826a87878b8e7
Opcode Fuzzy Hash: 2ee1942a1311764baf783dc50c77dd68aeb822d3ea7eb228bb08af345ac266ae
Instruction Fuzzy Hash: 52014B70918A0E8AEB59EF38C8482B972A0FF18305F5148BEE81EC21E1DF39B590C640

Function 00007FFB4B36AE3A Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0a423c3baeaab333b92157fbb8a611d20d7a15145dcdde671b2d19836d5baf
Instruction ID: 28b05bd91e6ec1af0c9000e2460ee3db2e49d1b277bc88c88b5f9b3044f09b10
Opcode Fuzzy Hash: fa0a423c3baeaab333b92157fbb8a611d20d7a15145dcdde671b2d19836d5baf
Instruction Fuzzy Hash: AFF09670D1DA4A8FE761BF3DCA051F977A4FF04300F00957ED608C50A2EA28A435C641

Function 00007FFB4B362344 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c96c5d9c6525e3f14e65fcb78ab3a488eb6c0f574759253371c9dc286a69417
Instruction ID: 3bd1bbdd7f8638b780d96e395a2928d22cf88feb964faeaa9f0eb795bcdd6417
Opcode Fuzzy Hash: 5c96c5d9c6525e3f14e65fcb78ab3a488eb6c0f574759253371c9dc286a69417
Instruction Fuzzy Hash: 2E010C7084E5598FEB61EF25CD95BA877B0EB51300F1181EAC149D71A2DEB81989CF10

Function 00007FFB4B36287D Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6458ff8fc6061f87d8ee21f860650d7ade6663fda739c13357ee1c4ad189e4ff
Instruction ID: 09c2c3adcb2385244a170373fe063d2858fd75dbe79dc33b046cc06024a27e3f
Opcode Fuzzy Hash: 6458ff8fc6061f87d8ee21f860650d7ade6663fda739c13357ee1c4ad189e4ff
Instruction Fuzzy Hash: 17F090B180DA8A8BEB69AF38CC551F97BA0FF55301F4145BEE919C10E1DB39A4548740

Function 00007FFB4B360F84 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a56eefcf627732dfe18ea42e44d363ced41503776ae1d0686cf6182ca90c21
Instruction ID: 57927b6c1242fe774941153ebfd5e5dffa749d55d488e03de773a62d0e980272
Opcode Fuzzy Hash: 10a56eefcf627732dfe18ea42e44d363ced41503776ae1d0686cf6182ca90c21
Instruction Fuzzy Hash: 82F01970E095098BEB60EF78C985AEDB3B5EB58300F1082B9D409E7295DE75A9448B54

Function 00007FFB4B362818 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcffce8d0433fdb3e89e8e4ea5cd036824feabcf17b573e0cd21fa4fe2928760
Instruction ID: c62a3a5fc64b314fab78708ca9fa704ff32094399475d11578fd48986567e04e
Opcode Fuzzy Hash: fcffce8d0433fdb3e89e8e4ea5cd036824feabcf17b573e0cd21fa4fe2928760
Instruction Fuzzy Hash: B6F05E7081DA4F8AEB69AF38CD551F976A0FF55301F4185BDEA19C10E1DB78A1548640

Function 00007FFB4B362375 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2683f34d8ef9deb9f1f0946ef469b19da0aab2e70d39259086c35e6f536c6233
Instruction ID: f96febbafe3eb11e09ebc2b6405653849de9d484d5d8f393ac3a92fb777386f8
Opcode Fuzzy Hash: 2683f34d8ef9deb9f1f0946ef469b19da0aab2e70d39259086c35e6f536c6233
Instruction Fuzzy Hash: 3AF0EC7190851A8BEB64EF25CD557A8B3B0FB50300F1185A9C149D32A1DF746A848F00

Function 00007FFB4B360608 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d71a11ff59c065b1e52a81160562b02b80c6a78efaf4abef39ddbb6f737c8d
Instruction ID: 51a2db553e065841912fc8e55295c67834b90b8c2786aa6e609c3366a4b90033
Opcode Fuzzy Hash: 42d71a11ff59c065b1e52a81160562b02b80c6a78efaf4abef39ddbb6f737c8d
Instruction Fuzzy Hash: F6F01C7081960E8AEB69AE39CD152B972A4FF59215F41887DE919C11E0DA38B1548640

Function 00007FFB4B363F3E Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290eeb21d7955852a5a6036ff01b1a76bf0aa92e7153c1e33e62596d5d06ca18
Instruction ID: 550478107363d119f2a30e43504826876f057ab98760785f559a877d1629f789
Opcode Fuzzy Hash: 290eeb21d7955852a5a6036ff01b1a76bf0aa92e7153c1e33e62596d5d06ca18
Instruction Fuzzy Hash: 78F098B090952D8FDB75DF19C954BA8B771FB49304F5041ED820EA7261EB301A80CF14

Function 00007FFB4B36AC0F Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1558333388.00007FFB4B360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4b360000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4727336d63ddcc31efffecc141a75b099c8b5b2389b27f4b642a6ac6b37fef0
Instruction ID: be16651e929c866e5996b5ae61d1a34e84b382c4c95ae4f248a060704f8bebf2
Opcode Fuzzy Hash: e4727336d63ddcc31efffecc141a75b099c8b5b2389b27f4b642a6ac6b37fef0
Instruction Fuzzy Hash: C6A0021215E7950E965302A46CA50D96B50EB464383454793C4446E0934C490A5A5211

Analysis Process: XnhYPNWiKV.exePID: 3580, Parent PID: 660COMMON

Executed Functions

Function 00007FFB4B3734A0 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4039ae83dfab289e4234f91d7e205d640083159f995a193121aa687f3da7f24
Instruction ID: 4f21c921e360a909444326e20a3d389b51e7463b5e10dad052b2393d0ee00039
Opcode Fuzzy Hash: d4039ae83dfab289e4234f91d7e205d640083159f995a193121aa687f3da7f24
Instruction Fuzzy Hash: 75E1A0B190DA8A8FEB45EF78C8553AD7BF1FF5A310F4081BAD049C7292DB7864068B41

Function 00007FFB4B37A63D Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd8a07c20f89b001e53efbd6ca2f3ffdd2dd204ae43e1f2de1be9f4cafa9d64
Instruction ID: 879da1afa494315d397e56c2449e740aa43c1d670068f2fe93a8ebff78797929
Opcode Fuzzy Hash: 4bd8a07c20f89b001e53efbd6ca2f3ffdd2dd204ae43e1f2de1be9f4cafa9d64
Instruction Fuzzy Hash: D8B1AC7490D68A8FD746EF78C8582AA7BF0FF19300F0585FBD589C70A2EA38A546C751

Function 00007FFB4B37E6C5 Relevance: 7.7, Strings: 6, Instructions: 180COMMON

Download Yara Rule

Strings

F, xrefs: 00007FFB4B37E7AE
0, xrefs: 00007FFB4B37EF26
(, xrefs: 00007FFB4B37F74F
_, xrefs: 00007FFB4B37EF53
T, xrefs: 00007FFB4B37F6CD
{, xrefs: 00007FFB4B37E6D9

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: ($0$F$T$_${
API String ID: 0-1251583540
Opcode ID: 8444d3a454790b1aec30bf2fdb3ea82de96b3b23a60271f69a0bdbe226c61d41
Instruction ID: 40acd6e78c80641b8abbafa8bf4563d028463cdeaa16a1abdb8f7c6eaba3ff2b
Opcode Fuzzy Hash: 8444d3a454790b1aec30bf2fdb3ea82de96b3b23a60271f69a0bdbe226c61d41
Instruction Fuzzy Hash: 8171E4B4D096298FDBA4EF25C954BE9B7B1FB58305F0081EAD64DA3291DB345A808F40

Function 00007FFB4B37C5BD Relevance: 5.4, Strings: 4, Instructions: 368COMMON

Download Yara Rule

Strings

{N_^, xrefs: 00007FFB4B37C96A
{|N_^, xrefs: 00007FFB4B37C841
_, xrefs: 00007FFB4B37C739
%;~, xrefs: 00007FFB4B37C67E

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: %;~$_${N_^${|N_^
API String ID: 0-3145152815
Opcode ID: ba45b5c88e0961c8813e43a135640ac02a6d769e6d03d236626c9e17232b30d8
Instruction ID: 9bf5c273a2b1c650c6d26e8f9b17aec0aa92f2b50bd4939bb12b93c3091f0992
Opcode Fuzzy Hash: ba45b5c88e0961c8813e43a135640ac02a6d769e6d03d236626c9e17232b30d8
Instruction Fuzzy Hash: C6B13ED7A0D6924AE3527A7DE9111FD7BB0EF42A31B48C0F7D6C8C90A3DD18644B83A1

Function 00007FFB4B37C63D Relevance: 4.0, Strings: 3, Instructions: 220COMMON

Download Yara Rule

Strings

{|N_^, xrefs: 00007FFB4B37C841
_, xrefs: 00007FFB4B37C739
%;~, xrefs: 00007FFB4B37C67E

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: %;~$_${|N_^
API String ID: 0-2063675421
Opcode ID: 6a5ec81159a15f3d2dbce80b35f5ee52507e52124f4a049461e02d9d369e3823
Instruction ID: 3bce5fda4d6a9271ebffa10bfea0b791f4039e6e86700690be710c98aeaf7152
Opcode Fuzzy Hash: 6a5ec81159a15f3d2dbce80b35f5ee52507e52124f4a049461e02d9d369e3823
Instruction Fuzzy Hash: 3861ECA7A0D6A68EE7027B7DF9011FD7770FF42B31B4481B7D689C9093DE28644683A1

Function 00007FFB4B37D6C0 Relevance: 3.0, Strings: 2, Instructions: 519COMMON

Download Yara Rule

Strings

N%K, xrefs: 00007FFB4B37D894
p\%K, xrefs: 00007FFB4B37D902

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: N%K$p\%K
API String ID: 0-2479889461
Opcode ID: 1b0dea408b725f66eabf184989067b7de28a6b8f0787c07d1c581c13016e8f85
Instruction ID: 750028ace4008f0b5df95872daca190c5886d3a3adc6599b740f191e9daa831b
Opcode Fuzzy Hash: 1b0dea408b725f66eabf184989067b7de28a6b8f0787c07d1c581c13016e8f85
Instruction Fuzzy Hash: 9D125EB091964A8FEB99EF68C4557B8BBB1FF19300F0480FED48DD72A2CA346845DB51

Function 00007FFB4B37C6D3 Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

{|N_^, xrefs: 00007FFB4B37C841
_, xrefs: 00007FFB4B37C739

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: _${|N_^
API String ID: 0-2966639192
Opcode ID: a936103b66c2fd5675a496235eda1327854cfe584a0275aefbecff598cfaec77
Instruction ID: de95770557e52d4bd654a5aadd66c3dc28ffdcf9d181c90d36b4248b0b3058f9
Opcode Fuzzy Hash: a936103b66c2fd5675a496235eda1327854cfe584a0275aefbecff598cfaec77
Instruction Fuzzy Hash: D751E9A6A0E6964EF7027A7DF9111FD7B74EF42F31B4481F7D689C9093DE28204683A1

Function 00007FFB4B371B65 Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

2E@K, xrefs: 00007FFB4B371B8B

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: 2E@K
API String ID: 0-473986816
Opcode ID: 862b0d0c6df9eb2c99e6337c35fd179febd04c598016a93fba05cf0a560a243e
Instruction ID: 92216af2d482a901801723ace92b498e94e8f799bbf49ce7fd63162c70776785
Opcode Fuzzy Hash: 862b0d0c6df9eb2c99e6337c35fd179febd04c598016a93fba05cf0a560a243e
Instruction Fuzzy Hash: 1F61C47280DB8E4FE756AE3588596F93FF1EF56300F0481BBD988C71A2DA24AC59C741

Function 00007FFB4B371DC2 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

2E@K, xrefs: 00007FFB4B371EA3

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: 2E@K
API String ID: 0-473986816
Opcode ID: d88b445af3c74c9d4a03e973677d55f2c57e1e689485ec71b51e904daa1f149b
Instruction ID: ea2488ce380beaa20905aa9e2e6117a40d1dca210122010be322fa90685d5cc5
Opcode Fuzzy Hash: d88b445af3c74c9d4a03e973677d55f2c57e1e689485ec71b51e904daa1f149b
Instruction Fuzzy Hash: 1061A572A0CE494BDB49EE6CC8A15B977E2FFD8314B14856DE58DC3292CE30AC12C785

Function 00007FFB4B37122D Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

py&K, xrefs: 00007FFB4B37129D

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: py&K
API String ID: 0-864761699
Opcode ID: 63ae625c9c023dfe0594d80c8bd780cb0041429f8eaed32195d49f2a7874dcfc
Instruction ID: 6779b864c589332780e1f6e49589327e891d66dc7d9a6c2c5f4db531b942d89c
Opcode Fuzzy Hash: 63ae625c9c023dfe0594d80c8bd780cb0041429f8eaed32195d49f2a7874dcfc
Instruction Fuzzy Hash: A751D2B190CA4E8FEB49EF78C4592F97BF0FF59311F0080BAD589D75A1CA25A854C750

Function 00007FFB4B371240 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

py&K, xrefs: 00007FFB4B37129D

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: py&K
API String ID: 0-864761699
Opcode ID: 234ddd4f869544cb05484db137b0332761c7d4a552993c616a6cc20140c0b10d
Instruction ID: e6e0f47d7dc656793743d978fc9d815f5d833fec75c384de8314da84674b3f4a
Opcode Fuzzy Hash: 234ddd4f869544cb05484db137b0332761c7d4a552993c616a6cc20140c0b10d
Instruction Fuzzy Hash: EC31EEB290DA4E8FFB88EF79C9142F9BBF0FF59311F0480BAD589D31A1DA2468148750

Function 00007FFB4B370A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

8v&K, xrefs: 00007FFB4B370A70

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: 8v&K
API String ID: 0-1719074956
Opcode ID: e315360270a0af3bb102a9f9db9a89c43315f0f3111158c3e8c0efe1e81115ea
Instruction ID: 4f58efc1da2211ad618eaf55fa78de2b5e50d0ce2e6189a62482690ae1c24ed5
Opcode Fuzzy Hash: e315360270a0af3bb102a9f9db9a89c43315f0f3111158c3e8c0efe1e81115ea
Instruction Fuzzy Hash: BC116DB190C54E8EE781FFB8C8892BD7BF1FF58310F4185B6D599C60A2DE34A5458750

Function 00007FFB4B37C7FB Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

{|N_^, xrefs: 00007FFB4B37C841

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: {|N_^
API String ID: 0-2721948741
Opcode ID: 390740a7a702c33edfc74b85cbe4368766bfc708abf9b3276dd3440a791ade51
Instruction ID: 14cff152ff8470fd621445204c1675e4f7ffbdf0cf8b9a4cd99c473e8adfe443
Opcode Fuzzy Hash: 390740a7a702c33edfc74b85cbe4368766bfc708abf9b3276dd3440a791ade51
Instruction Fuzzy Hash: DE11A76550E2928FE703BB38E8621ED3F70FF0362470480F7D589CA093DD29644AC761

Function 00007FFB4B37C700 Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96de4a45c17ed3ecab03c70fda81fc474c578be970e35b66584e37d7e2733693
Instruction ID: 760fa87eb30201aed6b618c938fe65c12b1f1a7fb1b69f1b0e47a4a1b73177bc
Opcode Fuzzy Hash: 96de4a45c17ed3ecab03c70fda81fc474c578be970e35b66584e37d7e2733693
Instruction Fuzzy Hash: EC51CFB091D6898FDB46EF39C8592BA7BE2FF09300F1144BEC45AC61A2DE39A544C742

Function 00007FFB4B37BCE8 Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d157d8d249d7eb813c75ac093e4febbc1a1fd9368a64b6b55ab66f5580fac65e
Instruction ID: b5fdf963e5e13cac825a145b59563d4736357bdc9a53c32e225288c18c19fe58
Opcode Fuzzy Hash: d157d8d249d7eb813c75ac093e4febbc1a1fd9368a64b6b55ab66f5580fac65e
Instruction Fuzzy Hash: 15F18EB091D64D8FEB45EF78C8696B97BF0FF19300F4081BAD589D71A2DA38A945CB40

Function 00007FFB4B37CBC5 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09fbbacf4fbf9683d8827e5cd6a34fcf8a52d759b7f5a70c441d726ce8275dba
Instruction ID: 1a22ac3d274b8cc45af56253e000474743d27ad9ab481e78ed30c6935cb7256c
Opcode Fuzzy Hash: 09fbbacf4fbf9683d8827e5cd6a34fcf8a52d759b7f5a70c441d726ce8275dba
Instruction Fuzzy Hash: D9D1C1B090D68E8FEB55EF38C9592FD7BF1FF15310F0085BAD949C21A2DA3865488782

Function 00007FFB4B372D3D Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4dba0afd60cb2b13dc6c1fe487893b7504ce70bcf328c44409994b28a898652
Instruction ID: 951d17643ed9acbb682dd55f56e054b70bff698d42333947b5e4a30f112c069d
Opcode Fuzzy Hash: f4dba0afd60cb2b13dc6c1fe487893b7504ce70bcf328c44409994b28a898652
Instruction Fuzzy Hash: B2C1BEB090D64E8FEB52FF39C9496B9BBF0FF0A300F0585B6D589C70A2DA38A5458751

Function 00007FFB4B37AA68 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067fd6a11b2eef365280ee77003ecb7efa6ae138073cdfc9b23cd1e34c3596c9
Instruction ID: 0a98d4bce97284af44ef70968aab074cf2098b0d413ee2c912c4e81c164e19c6
Opcode Fuzzy Hash: 067fd6a11b2eef365280ee77003ecb7efa6ae138073cdfc9b23cd1e34c3596c9
Instruction Fuzzy Hash: E4D108B0D1961ACFEB98EF79C5956BDB7F1EF59301F1040B9D04DA22A1CA386881CB52

Function 00007FFB4B372135 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecdc3dc747901b7dacfc586d508121c3072b94c7acf118c0f4fbfe96f6f3147c
Instruction ID: 98d9574ddc626243f539f15a69f072ed4c8fa3eee447c8863ddf52784314ffdd
Opcode Fuzzy Hash: ecdc3dc747901b7dacfc586d508121c3072b94c7acf118c0f4fbfe96f6f3147c
Instruction Fuzzy Hash: B0A1F2B190D64A8FEB95EF35CD452B8B7B0FF46300F00C1BAD58DD71A2DE28A9458B41

Function 00007FFB4B37BE30 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182fc073bab50dd68ed116f15e7a417c4ec9c5c0ae309f4fd2ccf48be91ae2e9
Instruction ID: fe516b3cd47042804a6dfeafaade797be8f2a0100115f50c8253335b7774b452
Opcode Fuzzy Hash: 182fc073bab50dd68ed116f15e7a417c4ec9c5c0ae309f4fd2ccf48be91ae2e9
Instruction Fuzzy Hash: B0A15CB0D1D64D8FEB94EF78C9556EDBBB0FF19300F4081BAD549D31A2DA38A9448B80

Function 00007FFB4B37AAE0 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d984378ae3cbd264f567be80bf5c141f45c18d5c74103b80304202f159c00fa
Instruction ID: 719c93bf8cb64b054527c4dabc33c25f764b9fe77aa70b1688f02efbaa8da040
Opcode Fuzzy Hash: 4d984378ae3cbd264f567be80bf5c141f45c18d5c74103b80304202f159c00fa
Instruction Fuzzy Hash: AD81ABB090D64E8FEB95EF38C8582BA7BF1FF19300F0045BAD45AD71A2CA35A944CB51

Function 00007FFB4B37BEA0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ffd6aec9d9334ef78984e5058b1f03c5a668ec076b4c5bab2e28b38e59380b
Instruction ID: a28c3b32c861c18292ae082fcdca8c57ad6ec408919f2599e60b6a360dcb521d
Opcode Fuzzy Hash: c1ffd6aec9d9334ef78984e5058b1f03c5a668ec076b4c5bab2e28b38e59380b
Instruction Fuzzy Hash: E7713AB0D1CA5D8FEB94EF68C9556EDBBB1FF09300F4081BAD549D31A2DA3868448B80

Function 00007FFB4B3736BE Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7da188e33a233ac49b5f4b5171dcd25b0665464031d2c387e4536aa3b69f2d3
Instruction ID: 5aa987071740de2df1dc20c2e29851c91ed2e7cffa6d8e8c7f0d0ba8efe7d20a
Opcode Fuzzy Hash: d7da188e33a233ac49b5f4b5171dcd25b0665464031d2c387e4536aa3b69f2d3
Instruction Fuzzy Hash: 43719FB2918A9D8FEB94DF6CD8553AD7FF1EB9A320F4041BAD048D32D6DBB418068741

Function 00007FFB4B372A88 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0c214ffe7217a033e4216f67f18ffc45a633ff0672141b1714aa2f366b6fe3
Instruction ID: c51ae91f99633090ae582b3b05c1454356b4729791856beb79e8d479b2e097ad
Opcode Fuzzy Hash: 6a0c214ffe7217a033e4216f67f18ffc45a633ff0672141b1714aa2f366b6fe3
Instruction Fuzzy Hash: 9D71BBB1D1D64A8FEB51EF79C9552EDBBF0EF09310F0080BAD589D61A2DE38A945CB10

Function 00007FFB4B370600 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d882c88147aedc922938f6ae72301e21e180c9d5b694725b8e1f84ffba8e7cb
Instruction ID: 98bd5a6a1cdd0613be5d2c4ade850343d441695a81e5b1df8b976eccb6c8d8e2
Opcode Fuzzy Hash: 4d882c88147aedc922938f6ae72301e21e180c9d5b694725b8e1f84ffba8e7cb
Instruction Fuzzy Hash: 5151F17190CA8E8FE755EF79C8586BA7BF1FF49300F0085BAD889C70A2DA34A855C741

Function 00007FFB4B37310F Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715389bb6c0645dc291513937022f91f5b3ee8af374158beaf1abfe8710ed543
Instruction ID: 33d27f440ff78bc049df8bcabffd847d421294b1c5d32809ecb47f34c1997ab1
Opcode Fuzzy Hash: 715389bb6c0645dc291513937022f91f5b3ee8af374158beaf1abfe8710ed543
Instruction Fuzzy Hash: 2A61CFB0D1E2898FE752AF75C9592E97BF0EF06300F0585BAD588C60A2EA28A549C711

Function 00007FFB4B372AA8 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7fef8994b39f927e029fd4a33cda0327dd407e0af0c67ce23c97f6e099eba54
Instruction ID: 29f45ab5cf979a7fbef66dffddf22fe8e8af4531424c24261fc1ba942537176c
Opcode Fuzzy Hash: b7fef8994b39f927e029fd4a33cda0327dd407e0af0c67ce23c97f6e099eba54
Instruction Fuzzy Hash: A9619CB1D1D64E8FEB55EF79C9552EDBBB0EF09300F0080BAD549E61A2DE38A945CB10

Function 00007FFB4B37AC78 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2e748dc6cc0af7b8d8d746d9052ba7741cd0e61fcb1a54c33b3310d6051b6d
Instruction ID: e0b0105fdc644e08d2b62eed475ebe944bed445ac2da4eb2e22668a8f7a98a22
Opcode Fuzzy Hash: ed2e748dc6cc0af7b8d8d746d9052ba7741cd0e61fcb1a54c33b3310d6051b6d
Instruction Fuzzy Hash: 5F61F2A590D68A8FE752FF38C9585E97BF0FF15311F04C5BAC698C70B2EA24A4498740

Function 00007FFB4B372E99 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f1998b570794719aa68e798620ecc8420ba22d12e0981aea00e6a7e6b3bed3e
Instruction ID: 4ede254b524ac444ffc83cc9285df9e3fb8f514dd56df5dc088efe8564540cea
Opcode Fuzzy Hash: 4f1998b570794719aa68e798620ecc8420ba22d12e0981aea00e6a7e6b3bed3e
Instruction Fuzzy Hash: 9151B4B0D0D28A8FEB51EF75CD592FA7BF0EF06300F0485BAD584C60A2EA38A545C791

Function 00007FFB4B37BAA8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cdb6a62b8ff1935b319fce3de7aa223749a8d8a0f3a503ca01fb5f9befe1985
Instruction ID: ba38b9aa876f4a5f2b07cbbc69508883d1ef635f3eb65ff4cc98a7751d3e56c8
Opcode Fuzzy Hash: 9cdb6a62b8ff1935b319fce3de7aa223749a8d8a0f3a503ca01fb5f9befe1985
Instruction Fuzzy Hash: 23513AB0D0964E8FEB94EF64C5586ED7BF1EF18310F1084BAD589E72A1EA34A944CB50

Function 00007FFB4B370500 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ed486fb65ed5d680630746e4bd233bedcb6d088cc8aa4569ce19d9116dc9da
Instruction ID: 13125957634e8073f79acaf7f383f42a048a987e6efc4b63351a124384442512
Opcode Fuzzy Hash: c7ed486fb65ed5d680630746e4bd233bedcb6d088cc8aa4569ce19d9116dc9da
Instruction Fuzzy Hash: 6551B37491D68D8FEB52EF38C9596A97BF0FF1A300F0584F6D998C60A2DA38E544CB41

Function 00007FFB4B371C39 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d8189103aeb771ad68d227c73e40acde22fb89378a854eea0c7a7e03ba3451
Instruction ID: ea4a3e1cc244fdb658667d024a0a43a7f3a4993e2a5f9f78e7d23e9f00548034
Opcode Fuzzy Hash: 84d8189103aeb771ad68d227c73e40acde22fb89378a854eea0c7a7e03ba3451
Instruction Fuzzy Hash: 0541D07280DA8E4FEB55AE29C8596BA3BF1EF55300F0081BAD999C71A2CA249C55C781

Function 00007FFB4B3726AD Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3584572574082b8b2e0934a3c8ea48aa73a7e70337a2b672f9507c0a8c182af7
Instruction ID: 9a7f1e4e5e3085122131b5e25e06de5e917d087ee5137cb607a493b4a4505f62
Opcode Fuzzy Hash: 3584572574082b8b2e0934a3c8ea48aa73a7e70337a2b672f9507c0a8c182af7
Instruction Fuzzy Hash: BF417D7481D7C98FEB56EF34CD592A57FB0FF16200F0585FAD988C60A3EA28A558CB41

Function 00007FFB4B3705F0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc260bac6fa1f33213af06783678b5459424317984d9e0565faf72aeced1809
Instruction ID: 0790e0a04a21d267a5f1ebda87133a0bde0ad46069b31afda6c30f20020c6667
Opcode Fuzzy Hash: 7cc260bac6fa1f33213af06783678b5459424317984d9e0565faf72aeced1809
Instruction Fuzzy Hash: 5841D27280DA8E4FEB55AE35C8586FA3BF1FF45300F0081BAD999C71A2CA34AC55C781

Function 00007FFB4B37085D Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19efb3aa78d4a7534ff209af01319b91151f59694b6bcf5906eb524cee997c82
Instruction ID: 3ec2977d67be1316273f55818785baf24d599b0cc901fe0b148f7cc9d4701720
Opcode Fuzzy Hash: 19efb3aa78d4a7534ff209af01319b91151f59694b6bcf5906eb524cee997c82
Instruction Fuzzy Hash: 7D41F0B194D6898FE742BFB8C9891E97BF0FF5A300F0185F6D5C9C60A2DA24A445C751

Function 00007FFB4B3731C0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a4688879467a0b25450a79ede59e710d33ec08f9fa485257c0100346f81eaf
Instruction ID: 81e5c6b91d0f432e12898bbfc75af9c231c8390eb208d71f6df808af25ae4123
Opcode Fuzzy Hash: 39a4688879467a0b25450a79ede59e710d33ec08f9fa485257c0100346f81eaf
Instruction Fuzzy Hash: 2C41D0B0A1D64D8FE752FB39C8496A97BF0EF09300F0585B6C588C70A2EE38E545C701

Function 00007FFB4B3728ED Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c853d21178a7321505dd359690f233e109fe0c65009bfc043040769fe3603f
Instruction ID: a0992814bb33c60546d03fb48404ba6944871a337b01bed130cd0c672eb72501
Opcode Fuzzy Hash: c9c853d21178a7321505dd359690f233e109fe0c65009bfc043040769fe3603f
Instruction Fuzzy Hash: A5411A7550D6558FE702FF39D8956E83B70EF87721B0885F7C1C8CA093D938A4498351

Function 00007FFB4B372F28 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d92e17669d127570bc47f711aea340c12cd02968e06041339ea0d7b809b372d
Instruction ID: e2921baf932c1a09da426e691b215a6214a423872bb84b5e540b82166a887df0
Opcode Fuzzy Hash: 4d92e17669d127570bc47f711aea340c12cd02968e06041339ea0d7b809b372d
Instruction Fuzzy Hash: EB4173B0D0D68A8FEB51AF75CD592FA7BF0EF06300F04857AD685C61A2EE38A5458781

Function 00007FFB4B3705D0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2654167b9af3594a1152090f6b0d0541dff907e6883cedae9d897d93d2333a0
Instruction ID: 3533539191fa82b5ba9909608903f3c35a43247eff9815366d5c7b0eaa0c4127
Opcode Fuzzy Hash: a2654167b9af3594a1152090f6b0d0541dff907e6883cedae9d897d93d2333a0
Instruction Fuzzy Hash: ED31E57280DA8E4FE755AE39C8186FA3BF1EF55300F1481BAD499C71A2CA349C55CB81

Function 00007FFB4B37240F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6773f5a8579922b89974bcd321178cd4519e658da0ed214667d464236da7d33
Instruction ID: a419df5562d79a8dd5946d9cd7364fe78e649cbebf66b7a515ab9f78966881a9
Opcode Fuzzy Hash: d6773f5a8579922b89974bcd321178cd4519e658da0ed214667d464236da7d33
Instruction Fuzzy Hash: 3941C8B1D081298EEB64EF65C9447EDB2B0BF15300F4081BAD18DE6291DE786A84CF00

Function 00007FFB4B372739 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc7453ba31a59fecd6213abeb28647dd78c738f8f2c5eed2872c0b2e41eeb10
Instruction ID: 9529c7a5fc4582b352d7e01b92ccaa661d6996cf25a386a2edbdcd9b89aeec79
Opcode Fuzzy Hash: ddc7453ba31a59fecd6213abeb28647dd78c738f8f2c5eed2872c0b2e41eeb10
Instruction Fuzzy Hash: 0831A37581D7C98FEB56EF38CD552A93BB0FF16300F0484BAD994C60A2EA29E544C741

Function 00007FFB4B3705F8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c69d3a3d823ddcab40c0228f2712108b6462a246a32134ce5c409660501552c
Instruction ID: 46811b3e236dd749df0b2c37e01718bd660040bb6db5899a001ffc39a856e9ef
Opcode Fuzzy Hash: 7c69d3a3d823ddcab40c0228f2712108b6462a246a32134ce5c409660501552c
Instruction Fuzzy Hash: 4031B27481D7898FEB56EF34CE552A93BB0EF16300F0484BAD988C60A2EA29E544C741

Function 00007FFB4B373228 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 780a1ccd9e0ede91a6e449f48392689256d63b292975ec2e98f30edc3dfbba2d
Instruction ID: 38fdf18c1e8554c45ce7d7aeca90f0257ee939f28fda483a8e40eaf9d0de52ef
Opcode Fuzzy Hash: 780a1ccd9e0ede91a6e449f48392689256d63b292975ec2e98f30edc3dfbba2d
Instruction Fuzzy Hash: E131ABB0D1D64E8FEB65AF75C9552EDBBB0EF05300F00847AD588E21A2DE78A505CB01

Function 00007FFB4B3704F8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf7426444d1d1c77ef06a048456d2a81d0298b04f5b6bcf8ca4bc252c1b34ce
Instruction ID: a020573a2e9277bf0c6e216717f99fe68def28cb94bd64b6dfa07f556b2c25d7
Opcode Fuzzy Hash: abf7426444d1d1c77ef06a048456d2a81d0298b04f5b6bcf8ca4bc252c1b34ce
Instruction Fuzzy Hash: B1317C7091D68D8FEB45EF38C9486A97BF0FF1A301F4084BAD999C61A2DA35A544CB10

Function 00007FFB4B372F99 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a0c0ba54f1b539b3572be22077b2d137b719bdaea41b4bdb7a1dbb65730e97
Instruction ID: d4ba5f72672ff635261b30c46588b6e19a7ecf7a249a00ded7516c019302dca2
Opcode Fuzzy Hash: 71a0c0ba54f1b539b3572be22077b2d137b719bdaea41b4bdb7a1dbb65730e97
Instruction Fuzzy Hash: 342194B0D0D24A8EEB51EE75CA552FAB7F0FF05300F048576D685D61A2EE38A645CB81

Function 00007FFB4B3727A8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33d9a9ab22cd3ea37d8cb2ad06d5e5c0ec33b617abb467b701b08f110a797b4
Instruction ID: 12e602f9ee17371468b28e63e0144e40b55751de5ff75a819c5ec68a1a0027d5
Opcode Fuzzy Hash: c33d9a9ab22cd3ea37d8cb2ad06d5e5c0ec33b617abb467b701b08f110a797b4
Instruction Fuzzy Hash: 3F11A27481D78E8FEB96EF38CD541A93BB0FF16201F4484BAD998C60E2DA29E554C741

Function 00007FFB4B373298 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b4a5a4f6a76996fb5cdb59526f78d5c9d2e381c6e87cba4fa49f2dc389670b
Instruction ID: 59d058affa75cb2aea8d3fc6e139b50aaf577de0803d6175a52cd7973f82a8df
Opcode Fuzzy Hash: 64b4a5a4f6a76996fb5cdb59526f78d5c9d2e381c6e87cba4fa49f2dc389670b
Instruction Fuzzy Hash: 102188B0D1D60E8BEB64EFBAC9546FDB7F0EF04300F108439D549E22A1DE78A9058B01

Function 00007FFB4B37B043 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16316b0b062413d7337c383e35893ee327b6a34255d04325e3d6736d1c91ecf0
Instruction ID: 286b5473a1a4aee845963336a43a2ebb42f920bb519f46a16454108617c0b95a
Opcode Fuzzy Hash: 16316b0b062413d7337c383e35893ee327b6a34255d04325e3d6736d1c91ecf0
Instruction Fuzzy Hash: 1A212CB0D0851A8EEF50EF69C595BEDB7F0EF58301F10C1B6D159A2295DB385985CF80

Function 00007FFB4B3705D8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1427f3f7c84d803a893f982e3ac23ec6c150f52e2c68dbd88737a6e90235f7
Instruction ID: 815c3e81a552abdbcda176a090c7fb9478fb302842ac35fab5badd073077a9d1
Opcode Fuzzy Hash: ed1427f3f7c84d803a893f982e3ac23ec6c150f52e2c68dbd88737a6e90235f7
Instruction Fuzzy Hash: 4411047190CA8E8FDB45EF75C4595B97BB1FF19300F1081BED899C30A2CA35A861C740

Function 00007FFB4B370610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423d250690acb07a5dc09463c257cbc7772e44e68783e53e85380b71d5d12683
Instruction ID: cfdaa078718ebc9af2fbd7c8a77e8088f5a67a5b36f5d4b02cc1b9bee419bfbd
Opcode Fuzzy Hash: 423d250690acb07a5dc09463c257cbc7772e44e68783e53e85380b71d5d12683
Instruction Fuzzy Hash: BE014B7091890E9AEB49EF34C8482B972F0FF19305F5084BEE85ED21A1DF36B590CA40

Function 00007FFB4B372344 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c96c5d9c6525e3f14e65fcb78ab3a488eb6c0f574759253371c9dc286a69417
Instruction ID: 4f18e97e3a129680c36b065a9ba9da31cc5a3e3c6c1793a2e59f87819c3732dd
Opcode Fuzzy Hash: 5c96c5d9c6525e3f14e65fcb78ab3a488eb6c0f574759253371c9dc286a69417
Instruction Fuzzy Hash: 2901087084E65A8FEB51EF21CD55BA877B0EB52300F1481EAC189E71A2DE782989CB10

Function 00007FFB4B37287D Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a340a3ca416fac4fecbc895a2e4f6fc141f2bba7818fd10770b5425a82729faf
Instruction ID: fa09894621f77d1f006026df8cd32c12312f1969c62e44a8ef78da83c5039ae8
Opcode Fuzzy Hash: a340a3ca416fac4fecbc895a2e4f6fc141f2bba7818fd10770b5425a82729faf
Instruction Fuzzy Hash: 24F090B180D68A8BEB59AF34C8591F97BB0FF56301F4085BEE999C10E1DB39A4548740

Function 00007FFB4B370F84 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b445eeea45a70a15951b7d4420263b1fa46e3c1ecc2beceb488c0d8adceb0f7d
Instruction ID: b1e97ef0069bcbc9ff517cc47718aa5eae2ff8cda17d13a80634d27d45b6f63c
Opcode Fuzzy Hash: b445eeea45a70a15951b7d4420263b1fa46e3c1ecc2beceb488c0d8adceb0f7d
Instruction Fuzzy Hash: 63F01970E0951A8BEB50EFB4C954AEDB3B5EB58300F10C2B5D409E7295DE35A9408F90

Function 00007FFB4B372818 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17027f23a4c5df4e5a2c146097b7573dbf8c33e442132665331dfb0b302d01e
Instruction ID: e85cc63ef1678f6e9220deb812c4956cf808af4e78fa9f4caf1d573bcf4c303a
Opcode Fuzzy Hash: d17027f23a4c5df4e5a2c146097b7573dbf8c33e442132665331dfb0b302d01e
Instruction Fuzzy Hash: 38F05E7481D64E9AEB69EF34C9051F97AB0FF56301F4088BEEA99C10E1EA3AA154C640

Function 00007FFB4B372375 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2683f34d8ef9deb9f1f0946ef469b19da0aab2e70d39259086c35e6f536c6233
Instruction ID: 896dff0d207438b51eeb81e43101b42ae0e460bb536d737906c5fc13072e256d
Opcode Fuzzy Hash: 2683f34d8ef9deb9f1f0946ef469b19da0aab2e70d39259086c35e6f536c6233
Instruction Fuzzy Hash: 9EF0E7B190851ACBEB64EF20CD54BA8B3B0FB51300F1081A9C189E32A1DE78AA848F00

Function 00007FFB4B370608 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92bbe6231eaf74e1aa27f1a74551866af3fb341788839d2cd1df1cd55f66b103
Instruction ID: 167699e1d209864579af9e8f8d6658fe4c52797a69065e0fa3b9c5a0261065a2
Opcode Fuzzy Hash: 92bbe6231eaf74e1aa27f1a74551866af3fb341788839d2cd1df1cd55f66b103
Instruction Fuzzy Hash: B9F08C7081960E9AEB59AE35C9042B972A4FF0A205F0088B9E859C10E0DA39B154C640

Function 00007FFB4B373F3E Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290eeb21d7955852a5a6036ff01b1a76bf0aa92e7153c1e33e62596d5d06ca18
Instruction ID: fbe224b1bf9686e463e1b19295979bc9c01bcd092991e25e989dc18c7becc219
Opcode Fuzzy Hash: 290eeb21d7955852a5a6036ff01b1a76bf0aa92e7153c1e33e62596d5d06ca18
Instruction Fuzzy Hash: 8EF098B090952D8FDB65DF15C9447A8B7B1FB49304F5041E9C24EA7261DB301A80CF14

Non-executed Functions

Function 00007FFB4B37ABF5 Relevance: 11.6, Strings: 9, Instructions: 394COMMON

Download Yara Rule

Strings

YAK, xrefs: 00007FFB4B385529
0ZAK, xrefs: 00007FFB4B385549
@ZAK, xrefs: 00007FFB4B385559
pZAK, xrefs: 00007FFB4B385589
M_^, xrefs: 00007FFB4B385701
PZAK, xrefs: 00007FFB4B385569
M_^, xrefs: 00007FFB4B385601
0YAK, xrefs: 00007FFB4B385539
`ZAK, xrefs: 00007FFB4B385579

Memory Dump Source

Source File: 00000018.00000002.1546770674.00007FFB4B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4b370000_XnhYPNWiKV.jbxd

Similarity

API ID:
String ID: YAK$0YAK$0ZAK$@ZAK$PZAK$`ZAK$pZAK$M_^$M_^
API String ID: 0-3863108115
Opcode ID: 22e06abd47795902d2e31aa444ff70f5011ae91bcb1a944813f259c807eaa140
Instruction ID: f8c608281a6e0ccbb1bdce7e82bb85668498182fe03479b15528f78dfa64be95
Opcode Fuzzy Hash: 22e06abd47795902d2e31aa444ff70f5011ae91bcb1a944813f259c807eaa140
Instruction Fuzzy Hash: 18B16CD3A0F69A4BE312BB7CE9961FD7BD0EF4366570843F7D1898A0A3EC2554064292

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CrPH91TEUL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Java\XnhYPNWiKV.exe

C:\Program Files (x86)\Java\XnhYPNWiKV.exe:Zone.Identifier

C:\Program Files (x86)\Java\d792c5fedef0ed

C:\Program Files (x86)\Windows Defender\en-GB\XnhYPNWiKV.exe

C:\Program Files (x86)\Windows Defender\en-GB\XnhYPNWiKV.exe:Zone.Identifier

C:\Program Files (x86)\Windows Defender\en-GB\d792c5fedef0ed

C:\Program Files (x86)\Windows NT\TableTextService\en-US\XnhYPNWiKV.exe

C:\Program Files (x86)\Windows NT\TableTextService\en-US\XnhYPNWiKV.exe:Zone.Identifier

C:\Program Files (x86)\Windows NT\TableTextService\en-US\d792c5fedef0ed

C:\Program Files\MSBuild\Microsoft\27d1bcfc3c54e0

C:\Program Files\MSBuild\Microsoft\System.exe

C:\Program Files\MSBuild\Microsoft\System.exe:Zone.Identifier

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\XnhYPNWiKV.exe:Zone.Identifier

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\d792c5fedef0ed

C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9

C:\Program Files\Windows Portable Devices\RuntimeBroker.exe

Windows Analysis Report
CrPH91TEUL.exe