Edit tour

Windows Analysis Report
hesaphareketi-01.pdf.SCR.exe

Overview

General Information

Sample name:	hesaphareketi-01.pdf.SCR.exe
Analysis ID:	1428352
MD5:	d4e8894fb5ed5f45972882fbc6ef04dc
SHA1:	f5ac926e2501659cd3933afb72e1172b1147f95d
SHA256:	4888ef9f557bfc04c0c7da3ff2dc1fc34767273d90053aa1e04c3892300afe12
Tags:	AgentTeslaexegeoSCRTUR
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: RegAsm connects to smtp port

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

hesaphareketi-01.pdf.SCR.exe (PID: 6592 cmdline: "C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe" MD5: D4E8894FB5ED5F45972882FBC6EF04DC)

powershell.exe (PID: 6692 cmdline: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tt.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 416 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

svchost.exe (PID: 5796 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cbsBVT.exe (PID: 1068 cmdline: "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 4628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cbsBVT.exe (PID: 6760 cmdline: "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 6880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "business29.web-hosting.com", "Username": "admin@purchase.boats", "Password": "Esupofo234@"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3042736012.0000000002EA4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3042736012.0000000002E9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3042736012.0000000002E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3042736012.0000000002E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3040210068.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3040210068.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: hesaphareketi-01.pdf.SCR.exe PID: 6592	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hesaphareketi-01.pdf.SCR.exe PID: 6592	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: hesaphareketi-01.pdf.SCR.exe PID: 6592	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 416	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 416	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3203f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x320b1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3213b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x321cd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32237:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x322a9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3233f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x323cf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e3f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33eb1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f3b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33fcd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34037:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340a9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3413f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341cf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e3f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f26f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaa48f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33eb1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f2e1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xaa501:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f3b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f36b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xaa58b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33fcd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f3fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xaa61d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34037:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f467:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xaa687:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340a9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f4d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaa6f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3413f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f56f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaa78f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.hesaphareketi-01.pdf.SCR.exe.37da1b0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-01.pdf.SCR.exe.37da1b0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-01.pdf.SCR.exe.37da1b0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xfb0df:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x13650f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x17172f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xfb151:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x136581:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1717a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xfb1db:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x13660b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x17182b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xfb26d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x13669d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1718bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xfb2d7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x136707:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x171927:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xfb349:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x136779:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x171999:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xfb3df:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x13680f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x171a2f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.hesaphareketi-01.pdf.SCR.exe.3789b80.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-01.pdf.SCR.exe.3789b80.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-01.pdf.SCR.exe.3789b80.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x14b70f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x186b3f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1c1d5f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x14b781:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x186bb1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1c1dd1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x14b80b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x186c3b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1c1e5b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x14b89d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x186ccd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1c1eed:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x14b907:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x186d37:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1c1f57:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x14b979:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x186da9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1c1fc9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x14ba0f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x186e3f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1c205f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

Networking

Sigma detected: RegAsm connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 198.54.114.199, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 416, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 416, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cbsBVT

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tt.exe', CommandLine: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tt.exe', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe", ParentImage: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe, ParentProcessId: 6592, ParentProcessName: hesaphareketi-01.pdf.SCR.exe, ProcessCommandLine: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tt.exe', ProcessId: 6692, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5796, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hesaphareketi-01.pdf.SCR.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Found malware configuration

Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "business29.web-hosting.com", "Username": "admin@purchase.boats", "Password": "Esupofo234@"}

Multi AV Scanner detection for submitted file

Source: hesaphareketi-01.pdf.SCR.exe

ReversingLabs: Detection: 36%

Machine Learning detection for sample

Source: hesaphareketi-01.pdf.SCR.exe

Joe Sandbox ML: detected

Source: hesaphareketi-01.pdf.SCR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: hesaphareketi-01.pdf.SCR.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\GT350\source\repos\AtllasRunp\AtllasRunp\obj\Debug\Bienvenida.pdb source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1802401807.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800362820.0000000002731000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000001.00000002.1815427737.0000000007939000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb source: cbsBVT.exe, 00000008.00000000.1943793689.0000000000252000.00000002.00000001.01000000.0000000B.sdmp, cbsBVT.exe.3.dr
Source:	Binary string: RegAsm.pdb4 source: cbsBVT.exe, 00000008.00000000.1943793689.0000000000252000.00000002.00000001.01000000.0000000B.sdmp, cbsBVT.exe.3.dr

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 198.54.114.199:587

Source: Joe Sandbox View

IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 198.54.114.199:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: RegAsm.exe, 00000003.00000002.3042736012.0000000002E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://business29.web-hosting.com
Source: RegAsm.exe, 00000003.00000002.3040895408.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3042736012.0000000002EA4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3041850407.000000000127C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3050148563.0000000006290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: RegAsm.exe, 00000003.00000002.3041850407.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: svchost.exe, 00000004.00000002.3042082562.000001F37AC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: RegAsm.exe, 00000003.00000002.3042736012.0000000002EA4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3041850407.000000000127C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3050148563.0000000006290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: svchost.exe, 00000004.00000003.1791796088.000001F37AE18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000004.00000003.1791796088.000001F37AE18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000004.00000003.1791796088.000001F37AE18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000004.00000003.1791796088.000001F37AE4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.4.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000001.00000002.1808727641.00000000051FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000001.00000002.1812874915.0000000005D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: RegAsm.exe, 00000003.00000002.3040895408.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3042736012.0000000002EA4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3041850407.000000000127C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3050148563.0000000006290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: RegAsm.exe, 00000003.00000002.3042736012.0000000002EA4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3041850407.000000000127C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3050148563.0000000006290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0-
Source: powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000001.00000002.1808727641.0000000004D01000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3042736012.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3040210068.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000001.00000002.1815427737.0000000007939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka..winsvrxd
Source: powershell.exe, 00000001.00000002.1808727641.0000000004D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3042736012.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3040210068.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegAsm.exe, 00000003.00000002.3042736012.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegAsm.exe, 00000003.00000002.3042736012.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: powershell.exe, 00000001.00000002.1812874915.0000000005D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1812874915.0000000005D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1812874915.0000000005D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000004.00000003.1791796088.000001F37AEC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000004.00000003.1791796088.000001F37AEC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1802601250.0000000004EF0000.00000004.08000000.00040000.00000000.sdmp, hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sam210723/goesrecv-monitor/releases/latest
Source: powershell.exe, 00000001.00000002.1812874915.0000000005D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000004.00000003.1791796088.000001F37AEC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.4.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: RegAsm.exe, 00000003.00000002.3042736012.0000000002EA4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3041850407.000000000127C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3050148563.0000000006290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1802601250.0000000004EF0000.00000004.08000000.00040000.00000000.sdmp, hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vksdr.com/goesrecv-monitor

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, cPKWk.cs

.Net Code: f0r

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.37da1b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.3789b80.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: hesaphareketi-01.pdf.SCR.exe

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Code function: 0_2_04B7CD3C	0_2_04B7CD3C
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Code function: 0_2_04B7F5B8	0_2_04B7F5B8
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Code function: 0_2_04B7F5A8	0_2_04B7F5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D04B10	3_2_02D04B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D03EF8	3_2_02D03EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D04240	3_2_02D04240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D0CC98	3_2_02D0CC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D0CCA8	3_2_02D0CCA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B04131	3_2_06B04131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B2B6C8	3_2_06B2B6C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B2CE58	3_2_06B2CE58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B27440	3_2_06B27440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B2ADD0	3_2_06B2ADD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B24D58	3_2_06B24D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B219E8	3_2_06B219E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B2C778	3_2_06B2C778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B21A99	3_2_06B21A99

Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1802601250.0000000004EF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamegoesrecv.dllB vs hesaphareketi-01.pdf.SCR.exe
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegoesrecv.dllB vs hesaphareketi-01.pdf.SCR.exe
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2379f9fe-9543-4c0b-b671-f5490ed118f9.exe4 vs hesaphareketi-01.pdf.SCR.exe
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1802401807.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBienvenida.exe6 vs hesaphareketi-01.pdf.SCR.exe
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1798752762.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs hesaphareketi-01.pdf.SCR.exe
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800362820.0000000002731000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBienvenida.exe6 vs hesaphareketi-01.pdf.SCR.exe
Source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800362820.0000000002731000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2379f9fe-9543-4c0b-b671-f5490ed118f9.exe4 vs hesaphareketi-01.pdf.SCR.exe
Source: hesaphareketi-01.pdf.SCR.exe	Binary or memory string: OriginalFilenamePoster.exe. vs hesaphareketi-01.pdf.SCR.exe

Source: hesaphareketi-01.pdf.SCR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.37da1b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.3789b80.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: hesaphareketi-01.pdf.SCR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.hesaphareketi-01.pdf.SCR.exe.4ef0000.6.raw.unpack, Symbols.cs	Base64 encoded string: 'xHpF2m2TxzO3qr4FIuPswPaRZvbKhAgsHoUgVc5c1AMOAI4xiJqOjlkD3YO/6qULkSENmFl3GsolqcGGkZrBbaRXVu7YY+n3wiyv8wS+UHUpwhx/IX6ZerqvTzuOLuRdO08npei7HwfH2wKRuaecB8P/FVecfW9FoWjF1A6O/68O0qK192cnIhUcctWjx/GW8ULXo/Un0WwvyWYxGKqhFtUjf6hQETjLzO/F68/W3GXggNfn4E0tbsHcWJ4Qs9QeauMywyAB+V1+9Uw+hcoLBpcocrYAhSqf6iaaMKaTanR4JlGBlD4IjJQmV1gvQRYmjDXbZawN8IgwRgaI+xcKtFjiFVvuA6CawFF5jzi4mENimIA39OD54y/zMb7idEh4oTy+f+VDOiQ16HbDvRyX1gv6ar2K+vNdRpiEk+FL75Dwi1y2R1DSLLrnXH75cn9Sxxkx16fkjltmZNwZYnnZc0VCbJz5PE8snBKcKUEemoAvDwcgj8rVX1tuhqqeYXrhP1hn6oaUpa8dLV9GkxPvUPm2U2PxYjlaVQk75pkxpaspctI89cBy4lXgWn0XYPaK1+WjxY5j1F5jeSb75FxuowoTWUXfk8j1s2KbANCsBuN3nd5227aIGAKGm+1kHAm/4MePOuLnj7mVqVrGuW9smZZvnluk2n2p0v6RGPmD818=', 'kcUEXaQPPIwtVFtC1PL/HXXkxfIZB03eNHvJetoP4hJTCBXd428OqcdPbPWqvhIczQvj71Ac6LZ7OG/e+yr4Bxet9vqIWevSzbdwqqWPf8nK2cPiNSfXdemqzBs1kBKEGQlnxKecRQs0Fim2Dq/kkqqyy4FT/M/7aleIZqMCZ4mq5jKj7zWHx8js/y7INNJykRnbqqkNJse2whyml6+Dho8xXhyKKjEjHHCQ++yYATPvU+ZwZGQ1aiyg3xM2+Mufv6OdiWo+NL8qVblSY+ML74QQ3+qn2cEZW8xaJcMAsMta6fJiSREwzJ1z86EfJ/jsm5waxGaL/ovb6ftrSW+RglFtTXsgBL0RqWZpQItqPDkF2hues0c5OGEtzNWaUVXn+H8FUCAJ+aqWE9AG5vtPYKXmrSZj5IG/6FHSIYC0nWBx5wHsGRTyzUgkPZMLeX0qotsCm9lMlGpxKlh+Z1oic1vbrF8QbV1eNo4t2Pb5oYAk/LIRoTnuPlLXjaubmL1hSqvzPQ/sVXzd5mXTvaOq58aApZHbOXkjfhfbDwVLc3Bjs25RTwPrIWsIAKwX/3kGBu/AxMY0Wb07NTJmloyghXyX9HTSpFE3N+D/N7l3tVWX/n6tnybXZUsRqFSB6rG1tbIR1a+4GVp+//5BqD3kM0VXcBGmG3xpyDSDCLIVVEXY5GyYN1vEkdGhjGvmeOX02f1RKB3vh5V5M5RcsEYhGsS36zuGpaNhrGf4h+7HDzTIU9/1Xl1nPdFaQmDFTIiidpmn26+9CW+g2SPIPlPDTjgkYnTmXT+O8PHwjD7K5IOwDZUbbAFA1Lrdc9IlU412XoEdl5mDZkue1zwbLWf+qvNJbFX8sXHehpGS3HbJZGQqyBs/WGnME/zTep7mu3SAbJ/9lw9DubLAWm3eZ/MVjBNuE3yDINYwtRQMJcyCjqvOUaWeWaIkvESwPYK4f4DzXPSa187wG+9AlgF8f2wQOygxX1dsc+xQUYb6mjfKphwvQfA49LiS6QNKSqz15qqR0H8SkeLLJ7txSyPf5o/Vb8ElYF2R/Dsozjt09H5PLZg8Mx42byNjie81RXixtgWQpr4xblQ9zxj5IaMqOBw3U6yvkKqUNQd1pRUx/33LazNTVFgHRwpx+LutF/m3Ilc9LDSXQ2sLYadTLNM4H6sg88B3Ku0bJgNkN8dFdIsCjQkk9Mdt0ps7+1BSph400PLXGB8Ouast6dmU+lpkXpEGr/mWHaX4VEifmt6MFtiG9jSUTjA2VqhJ2qS66jKrnf1CuWF5qWbXjRlBXUK1jLibI8Is03eHlVAWQOFZcrfOpPq3o0OxUDbCLddsIsPCScNdGrBY2q9RllmuBZNg/W6T5m+X2KNwjQyVBQxBU34LaUg9GMhx5G6e5/2Gji8UiH7/fu4jgyKbpw9r0egwJJndmdSHGUdUQ49W56s9vPelsDJb08XuAjWQXFOdA1Kmsw9Dh45XsM/m10+4XbpvyJ7XmTYJAvhQMXLFqtS4GpKG69JRuO4n+L6rSLGlFzxmsEhm3QM9iDYz2US4Un+EjCOwvFtl/eeSBED1CLnNZf4IbflrasiyFM6IFES8MG62FqpfoichpMq3Dt3tPmAgGD89QmkCsMCq8pGj+3BeDc98BauK1JlOc3iObuBFb0NChpfWa1lZmLvdMib+Wp2pqytptC5Ad7o8p4gSVACx6up/YNr6I8YhsqGIHpFV7Jvk6nzQ19vdCSYcUt+o2i12lPTyUqO5WujSq7P41U0w2rtJQ26/ZzkoCHMKUckEWvk2ei4A+bBCG2520B3/6O1EclfvsvlFIIf2mfft+6FFGP8enxtpFqG/1EAjM3sSS6IKARWsy3s4D5H+dtzPSaR/PDr2jejgFGRPxSbuLutKf4Kq55+afwF989Ad3WDqFcnmc5BwJhXFPxqlmhbPFSMnMVSksaW8UAhMCwLnt31FSm9CfeXXjCj8+hrMcPtn4+PDQeiLyf5/nD/vwOnFGKuLEm9JR/FzB5RktFNWqSYEqRzg8LgsYcEHc4zWyBiABM1LbR2nzax5QE3aZASIx1za/lqdqTVimq7MZbrwQrWQinziaucgzSHxKw880yNElAHNJZFw5Z4rZRzj/oK/kMoAhV4H1jnZbSuePHvddP24l9YOvlGpCsWrI3fk7BWzD8DJD3X2bGim8xoEt4g/R1aCZC/UMvPk/1IixbWw1P+li3OayxAQlbUqmb7DPHGvkbTD8evGdp3QwQWtGkbPRmu+iUWIEefvCP02tcFiIPdm82jN+Oc7+krSiRmxMiJMVt8h+1THUxoF3qD
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.37da1b0.4.raw.unpack, Symbols.cs	Base64 encoded string: 'xHpF2m2TxzO3qr4FIuPswPaRZvbKhAgsHoUgVc5c1AMOAI4xiJqOjlkD3YO/6qULkSENmFl3GsolqcGGkZrBbaRXVu7YY+n3wiyv8wS+UHUpwhx/IX6ZerqvTzuOLuRdO08npei7HwfH2wKRuaecB8P/FVecfW9FoWjF1A6O/68O0qK192cnIhUcctWjx/GW8ULXo/Un0WwvyWYxGKqhFtUjf6hQETjLzO/F68/W3GXggNfn4E0tbsHcWJ4Qs9QeauMywyAB+V1+9Uw+hcoLBpcocrYAhSqf6iaaMKaTanR4JlGBlD4IjJQmV1gvQRYmjDXbZawN8IgwRgaI+xcKtFjiFVvuA6CawFF5jzi4mENimIA39OD54y/zMb7idEh4oTy+f+VDOiQ16HbDvRyX1gv6ar2K+vNdRpiEk+FL75Dwi1y2R1DSLLrnXH75cn9Sxxkx16fkjltmZNwZYnnZc0VCbJz5PE8snBKcKUEemoAvDwcgj8rVX1tuhqqeYXrhP1hn6oaUpa8dLV9GkxPvUPm2U2PxYjlaVQk75pkxpaspctI89cBy4lXgWn0XYPaK1+WjxY5j1F5jeSb75FxuowoTWUXfk8j1s2KbANCsBuN3nd5227aIGAKGm+1kHAm/4MePOuLnj7mVqVrGuW9smZZvnluk2n2p0v6RGPmD818=', 'kcUEXaQPPIwtVFtC1PL/HXXkxfIZB03eNHvJetoP4hJTCBXd428OqcdPbPWqvhIczQvj71Ac6LZ7OG/e+yr4Bxet9vqIWevSzbdwqqWPf8nK2cPiNSfXdemqzBs1kBKEGQlnxKecRQs0Fim2Dq/kkqqyy4FT/M/7aleIZqMCZ4mq5jKj7zWHx8js/y7INNJykRnbqqkNJse2whyml6+Dho8xXhyKKjEjHHCQ++yYATPvU+ZwZGQ1aiyg3xM2+Mufv6OdiWo+NL8qVblSY+ML74QQ3+qn2cEZW8xaJcMAsMta6fJiSREwzJ1z86EfJ/jsm5waxGaL/ovb6ftrSW+RglFtTXsgBL0RqWZpQItqPDkF2hues0c5OGEtzNWaUVXn+H8FUCAJ+aqWE9AG5vtPYKXmrSZj5IG/6FHSIYC0nWBx5wHsGRTyzUgkPZMLeX0qotsCm9lMlGpxKlh+Z1oic1vbrF8QbV1eNo4t2Pb5oYAk/LIRoTnuPlLXjaubmL1hSqvzPQ/sVXzd5mXTvaOq58aApZHbOXkjfhfbDwVLc3Bjs25RTwPrIWsIAKwX/3kGBu/AxMY0Wb07NTJmloyghXyX9HTSpFE3N+D/N7l3tVWX/n6tnybXZUsRqFSB6rG1tbIR1a+4GVp+//5BqD3kM0VXcBGmG3xpyDSDCLIVVEXY5GyYN1vEkdGhjGvmeOX02f1RKB3vh5V5M5RcsEYhGsS36zuGpaNhrGf4h+7HDzTIU9/1Xl1nPdFaQmDFTIiidpmn26+9CW+g2SPIPlPDTjgkYnTmXT+O8PHwjD7K5IOwDZUbbAFA1Lrdc9IlU412XoEdl5mDZkue1zwbLWf+qvNJbFX8sXHehpGS3HbJZGQqyBs/WGnME/zTep7mu3SAbJ/9lw9DubLAWm3eZ/MVjBNuE3yDINYwtRQMJcyCjqvOUaWeWaIkvESwPYK4f4DzXPSa187wG+9AlgF8f2wQOygxX1dsc+xQUYb6mjfKphwvQfA49LiS6QNKSqz15qqR0H8SkeLLJ7txSyPf5o/Vb8ElYF2R/Dsozjt09H5PLZg8Mx42byNjie81RXixtgWQpr4xblQ9zxj5IaMqOBw3U6yvkKqUNQd1pRUx/33LazNTVFgHRwpx+LutF/m3Ilc9LDSXQ2sLYadTLNM4H6sg88B3Ku0bJgNkN8dFdIsCjQkk9Mdt0ps7+1BSph400PLXGB8Ouast6dmU+lpkXpEGr/mWHaX4VEifmt6MFtiG9jSUTjA2VqhJ2qS66jKrnf1CuWF5qWbXjRlBXUK1jLibI8Is03eHlVAWQOFZcrfOpPq3o0OxUDbCLddsIsPCScNdGrBY2q9RllmuBZNg/W6T5m+X2KNwjQyVBQxBU34LaUg9GMhx5G6e5/2Gji8UiH7/fu4jgyKbpw9r0egwJJndmdSHGUdUQ49W56s9vPelsDJb08XuAjWQXFOdA1Kmsw9Dh45XsM/m10+4XbpvyJ7XmTYJAvhQMXLFqtS4GpKG69JRuO4n+L6rSLGlFzxmsEhm3QM9iDYz2US4Un+EjCOwvFtl/eeSBED1CLnNZf4IbflrasiyFM6IFES8MG62FqpfoichpMq3Dt3tPmAgGD89QmkCsMCq8pGj+3BeDc98BauK1JlOc3iObuBFb0NChpfWa1lZmLvdMib+Wp2pqytptC5Ad7o8p4gSVACx6up/YNr6I8YhsqGIHpFV7Jvk6nzQ19vdCSYcUt+o2i12lPTyUqO5WujSq7P41U0w2rtJQ26/ZzkoCHMKUckEWvk2ei4A+bBCG2520B3/6O1EclfvsvlFIIf2mfft+6FFGP8enxtpFqG/1EAjM3sSS6IKARWsy3s4D5H+dtzPSaR/PDr2jejgFGRPxSbuLutKf4Kq55+afwF989Ad3WDqFcnmc5BwJhXFPxqlmhbPFSMnMVSksaW8UAhMCwLnt31FSm9CfeXXjCj8+hrMcPtn4+PDQeiLyf5/nD/vwOnFGKuLEm9JR/FzB5RktFNWqSYEqRzg8LgsYcEHc4zWyBiABM1LbR2nzax5QE3aZASIx1za/lqdqTVimq7MZbrwQrWQinziaucgzSHxKw880yNElAHNJZFw5Z4rZRzj/oK/kMoAhV4H1jnZbSuePHvddP24l9YOvlGpCsWrI3fk7BWzD8DJD3X2bGim8xoEt4g/R1aCZC/UMvPk/1IixbWw1P+li3OayxAQlbUqmb7DPHGvkbTD8evGdp3QwQWtGkbPRmu+iUWIEefvCP02tcFiIPdm82jN+Oc7+krSiRmxMiJMVt8h+1THUxoF3qD
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.3789b80.2.raw.unpack, Symbols.cs	Base64 encoded string: 'xHpF2m2TxzO3qr4FIuPswPaRZvbKhAgsHoUgVc5c1AMOAI4xiJqOjlkD3YO/6qULkSENmFl3GsolqcGGkZrBbaRXVu7YY+n3wiyv8wS+UHUpwhx/IX6ZerqvTzuOLuRdO08npei7HwfH2wKRuaecB8P/FVecfW9FoWjF1A6O/68O0qK192cnIhUcctWjx/GW8ULXo/Un0WwvyWYxGKqhFtUjf6hQETjLzO/F68/W3GXggNfn4E0tbsHcWJ4Qs9QeauMywyAB+V1+9Uw+hcoLBpcocrYAhSqf6iaaMKaTanR4JlGBlD4IjJQmV1gvQRYmjDXbZawN8IgwRgaI+xcKtFjiFVvuA6CawFF5jzi4mENimIA39OD54y/zMb7idEh4oTy+f+VDOiQ16HbDvRyX1gv6ar2K+vNdRpiEk+FL75Dwi1y2R1DSLLrnXH75cn9Sxxkx16fkjltmZNwZYnnZc0VCbJz5PE8snBKcKUEemoAvDwcgj8rVX1tuhqqeYXrhP1hn6oaUpa8dLV9GkxPvUPm2U2PxYjlaVQk75pkxpaspctI89cBy4lXgWn0XYPaK1+WjxY5j1F5jeSb75FxuowoTWUXfk8j1s2KbANCsBuN3nd5227aIGAKGm+1kHAm/4MePOuLnj7mVqVrGuW9smZZvnluk2n2p0v6RGPmD818=', 'kcUEXaQPPIwtVFtC1PL/HXXkxfIZB03eNHvJetoP4hJTCBXd428OqcdPbPWqvhIczQvj71Ac6LZ7OG/e+yr4Bxet9vqIWevSzbdwqqWPf8nK2cPiNSfXdemqzBs1kBKEGQlnxKecRQs0Fim2Dq/kkqqyy4FT/M/7aleIZqMCZ4mq5jKj7zWHx8js/y7INNJykRnbqqkNJse2whyml6+Dho8xXhyKKjEjHHCQ++yYATPvU+ZwZGQ1aiyg3xM2+Mufv6OdiWo+NL8qVblSY+ML74QQ3+qn2cEZW8xaJcMAsMta6fJiSREwzJ1z86EfJ/jsm5waxGaL/ovb6ftrSW+RglFtTXsgBL0RqWZpQItqPDkF2hues0c5OGEtzNWaUVXn+H8FUCAJ+aqWE9AG5vtPYKXmrSZj5IG/6FHSIYC0nWBx5wHsGRTyzUgkPZMLeX0qotsCm9lMlGpxKlh+Z1oic1vbrF8QbV1eNo4t2Pb5oYAk/LIRoTnuPlLXjaubmL1hSqvzPQ/sVXzd5mXTvaOq58aApZHbOXkjfhfbDwVLc3Bjs25RTwPrIWsIAKwX/3kGBu/AxMY0Wb07NTJmloyghXyX9HTSpFE3N+D/N7l3tVWX/n6tnybXZUsRqFSB6rG1tbIR1a+4GVp+//5BqD3kM0VXcBGmG3xpyDSDCLIVVEXY5GyYN1vEkdGhjGvmeOX02f1RKB3vh5V5M5RcsEYhGsS36zuGpaNhrGf4h+7HDzTIU9/1Xl1nPdFaQmDFTIiidpmn26+9CW+g2SPIPlPDTjgkYnTmXT+O8PHwjD7K5IOwDZUbbAFA1Lrdc9IlU412XoEdl5mDZkue1zwbLWf+qvNJbFX8sXHehpGS3HbJZGQqyBs/WGnME/zTep7mu3SAbJ/9lw9DubLAWm3eZ/MVjBNuE3yDINYwtRQMJcyCjqvOUaWeWaIkvESwPYK4f4DzXPSa187wG+9AlgF8f2wQOygxX1dsc+xQUYb6mjfKphwvQfA49LiS6QNKSqz15qqR0H8SkeLLJ7txSyPf5o/Vb8ElYF2R/Dsozjt09H5PLZg8Mx42byNjie81RXixtgWQpr4xblQ9zxj5IaMqOBw3U6yvkKqUNQd1pRUx/33LazNTVFgHRwpx+LutF/m3Ilc9LDSXQ2sLYadTLNM4H6sg88B3Ku0bJgNkN8dFdIsCjQkk9Mdt0ps7+1BSph400PLXGB8Ouast6dmU+lpkXpEGr/mWHaX4VEifmt6MFtiG9jSUTjA2VqhJ2qS66jKrnf1CuWF5qWbXjRlBXUK1jLibI8Is03eHlVAWQOFZcrfOpPq3o0OxUDbCLddsIsPCScNdGrBY2q9RllmuBZNg/W6T5m+X2KNwjQyVBQxBU34LaUg9GMhx5G6e5/2Gji8UiH7/fu4jgyKbpw9r0egwJJndmdSHGUdUQ49W56s9vPelsDJb08XuAjWQXFOdA1Kmsw9Dh45XsM/m10+4XbpvyJ7XmTYJAvhQMXLFqtS4GpKG69JRuO4n+L6rSLGlFzxmsEhm3QM9iDYz2US4Un+EjCOwvFtl/eeSBED1CLnNZf4IbflrasiyFM6IFES8MG62FqpfoichpMq3Dt3tPmAgGD89QmkCsMCq8pGj+3BeDc98BauK1JlOc3iObuBFb0NChpfWa1lZmLvdMib+Wp2pqytptC5Ad7o8p4gSVACx6up/YNr6I8YhsqGIHpFV7Jvk6nzQ19vdCSYcUt+o2i12lPTyUqO5WujSq7P41U0w2rtJQ26/ZzkoCHMKUckEWvk2ei4A+bBCG2520B3/6O1EclfvsvlFIIf2mfft+6FFGP8enxtpFqG/1EAjM3sSS6IKARWsy3s4D5H+dtzPSaR/PDr2jejgFGRPxSbuLutKf4Kq55+afwF989Ad3WDqFcnmc5BwJhXFPxqlmhbPFSMnMVSksaW8UAhMCwLnt31FSm9CfeXXjCj8+hrMcPtn4+PDQeiLyf5/nD/vwOnFGKuLEm9JR/FzB5RktFNWqSYEqRzg8LgsYcEHc4zWyBiABM1LbR2nzax5QE3aZASIx1za/lqdqTVimq7MZbrwQrWQinziaucgzSHxKw880yNElAHNJZFw5Z4rZRzj/oK/kMoAhV4H1jnZbSuePHvddP24l9YOvlGpCsWrI3fk7BWzD8DJD3X2bGim8xoEt4g/R1aCZC/UMvPk/1IixbWw1P+li3OayxAQlbUqmb7DPHGvkbTD8evGdp3QwQWtGkbPRmu+iUWIEefvCP02tcFiIPdm82jN+Oc7+krSiRmxMiJMVt8h+1THUxoF3qD

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@11/14@2/3

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hesaphareketi-01.pdf.SCR.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6708:120:WilError_03
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6880:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xlcbossz.gmt.ps1

Jump to behavior

Source: hesaphareketi-01.pdf.SCR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: hesaphareketi-01.pdf.SCR.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hesaphareketi-01.pdf.SCR.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe "C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe"
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tt.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tt.exe'	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: hesaphareketi-01.pdf.SCR.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: hesaphareketi-01.pdf.SCR.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\GT350\source\repos\AtllasRunp\AtllasRunp\obj\Debug\Bienvenida.pdb source: hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1802401807.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800362820.0000000002731000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000001.00000002.1815427737.0000000007939000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb source: cbsBVT.exe, 00000008.00000000.1943793689.0000000000252000.00000002.00000001.01000000.0000000B.sdmp, cbsBVT.exe.3.dr
Source:	Binary string: RegAsm.pdb4 source: cbsBVT.exe, 00000008.00000000.1943793689.0000000000252000.00000002.00000001.01000000.0000000B.sdmp, cbsBVT.exe.3.dr

Source: hesaphareketi-01.pdf.SCR.exe

Static PE information: 0xF7E2BC69 [Sat Oct 15 15:02:01 2101 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D00B4F push edi; ret	3_2_02D00CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D00C95 push edi; retf	3_2_02D00C3A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B0244F push es; ret	3_2_06B02460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B01E3D push es; ret	3_2_06B01E44

Source: hesaphareketi-01.pdf.SCR.exe

Static PE information: section name: .text entropy: 7.96694997733209

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cbsBVT			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cbsBVT			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe:Zone.Identifier read attributes | delete

Jump to behavior

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.scr

Static PE information: hesaphareketi-01.pdf.SCR.exe

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: hesaphareketi-01.pdf.SCR.exe PID: 6592, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Memory allocated: D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Memory allocated: 2730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Memory allocated: 2550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 2380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 2630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 2380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 2B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 2930000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7053	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2450	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1022	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 5455	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe TID: 6660	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6932	Thread sleep count: 7053 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6956	Thread sleep count: 2450 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7076	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -99671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -99105s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -98997s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -98779s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -98671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -98429s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -98093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -97984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -97875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -97765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -97656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -97546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -97437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -97328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -97218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -97109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -96999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -96890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -96781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -96671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -96562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3068	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6352	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 4940	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 1696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99105	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98997	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98779	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98429	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: svchost.exe, 00000004.00000002.3042182633.000001F37AC54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.3041011255.000001F37562B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000003.00000002.3050148563.0000000006290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllbb3
Source: powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, Ljq6xD21ACX.cs	Reference to suspicious API methods: OZkujShDCVG.OpenProcess(aPNZ30.DuplicateHandle, bInheritHandle: true, (uint)snUp2.ProcessID)
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.4cc0000.5.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	Reference to suspicious API methods: MyGetProcAddress(hProcess, Name)
Source: 0.2.hesaphareketi-01.pdf.SCR.exe.4cc0000.5.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	Reference to suspicious API methods: LoadLibraryA(ref name)

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tt.exe'			Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" ??????????-??????????e??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????p??????????o??????????l??????????i??????????c??????????y?????????? ??????????b??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????c?????????o?????????p?????????y?????????-?????????i?????????t?????????e?????????m 'c:\users\user\desktop\hesaphareketi-01.pdf.scr.exe' 'c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\tt.exe'
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" ??????????-??????????e??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????p??????????o??????????l??????????i??????????c??????????y?????????? ??????????b??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????c?????????o?????????p?????????y?????????-?????????i?????????t?????????e?????????m 'c:\users\user\desktop\hesaphareketi-01.pdf.scr.exe' 'c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\tt.exe'			Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.SCR.exe.37da1b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.SCR.exe.3789b80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3042736012.0000000002EA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3042736012.0000000002E9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3042736012.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3040210068.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-01.pdf.SCR.exe PID: 6592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 416, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.SCR.exe.37da1b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.SCR.exe.3789b80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3042736012.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3040210068.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-01.pdf.SCR.exe PID: 6592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 416, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.SCR.exe.38a1450.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.SCR.exe.37da1b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-01.pdf.SCR.exe.3789b80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3042736012.0000000002EA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3042736012.0000000002E9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3042736012.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3040210068.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-01.pdf.SCR.exe PID: 6592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 416, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	121 Obfuscated Files or Information	1 Credentials in Registry	121 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
hesaphareketi-01.pdf.SCR.exe	37%	ReversingLabs	Win32.Trojan.Generic
hesaphareketi-01.pdf.SCR.exe	100%	Avira	HEUR/AGEN.1311129
hesaphareketi-01.pdf.SCR.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://contoso.com/License	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://go.micros	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high
business29.web-hosting.com	198.54.114.199	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka..winsvrxd	powershell.exe, 00000001.00000002.1815427737.0000000007939000.00000004.00000020.00020000.00000000.sdmp	false		low
http://www.founder.com.cn/cn/bThe	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers?	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000001.00000002.1812874915.0000000005D68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.4.dr	false		high
http://www.fontbureau.com/designers	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.micros	powershell.exe, 00000001.00000002.1808727641.00000000051FC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.4.dr	false		high
http://www.founder.com.cn/cn/cThe	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.galapagosdesign.com/staff/dennis.htm	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3042736012.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3040210068.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.4.dr	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000001.00000002.1808727641.0000000004D01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000001.00000002.1812874915.0000000005D68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1812874915.0000000005D68000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1808727641.0000000004D01000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3042736012.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000004.00000003.1791796088.000001F37AEC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	false		high
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	RegAsm.exe, 00000003.00000002.3042736012.0000000002EA4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3041850407.000000000127C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3050148563.0000000006290000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1812874915.0000000005D68000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	RegAsm.exe, 00000003.00000002.3042736012.0000000002EA4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3041850407.000000000127C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3050148563.0000000006290000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0-	RegAsm.exe, 00000003.00000002.3042736012.0000000002EA4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3041850407.000000000127C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3050148563.0000000006290000.00000004.00000020.00020000.00000000.sdmp	false		low
https://account.dyn.com/	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3040210068.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1812874915.0000000005D68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000004.00000002.3042082562.000001F37AC00000.00000004.00000020.00020000.00000000.sdmp	false		low
https://api.ipify.org/t	RegAsm.exe, 00000003.00000002.3042736012.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/sam210723/goesrecv-monitor/releases/latest	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1802601250.0000000004EF0000.00000004.08000000.00040000.00000000.sdmp, hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers/frere-user.html	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000004.00000003.1791796088.000001F37AEC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr	false		high
http://business29.web-hosting.com	RegAsm.exe, 00000003.00000002.3042736012.0000000002E9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vksdr.com/goesrecv-monitor	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1802601250.0000000004EF0000.00000004.08000000.00040000.00000000.sdmp, hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.1808727641.0000000004E56000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	hesaphareketi-01.pdf.SCR.exe, 00000000.00000002.1804166325.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
198.54.114.199	business29.web-hosting.com	United States		22612	NAMECHEAP-NETUS	false
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428352
Start date and time:	2024-04-18 21:15:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hesaphareketi-01.pdf.SCR.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@11/14@2/3
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 100% Number of executed functions: 109 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.220.189.216
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target cbsBVT.exe, PID 1068 because it is empty
Execution Graph export aborted for target cbsBVT.exe, PID 6760 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6692 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: hesaphareketi-01.pdf.SCR.exe

Simulations

Behavior and APIs

Time	Type	Description
20:16:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run cbsBVT C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
20:16:59	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run cbsBVT C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
21:16:43	API Interceptor	23x Sleep call for process: powershell.exe modified
21:16:44	API Interceptor	2x Sleep call for process: svchost.exe modified
21:16:51	API Interceptor	32x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
198.54.114.199	http://duckyblogs.com/2022/08/30/keith-cederholm-barn	Get hash	malicious	Unknown	Browse	duckyblogs.com/2022/08/30/keith-cederholm-barn
104.26.12.205	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
business29.web-hosting.com	hesaphareketi_1.SCR.exe	Get hash	malicious	AgentTesla	Browse	198.54.114.199
api.ipify.org	order & specification.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	SHIPPING DOCUMENTS_PDF..vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Payment Advice.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	order 4500381478001.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Scan-IMG PO Order CW289170-A CW201.bat.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	TransactionSummary_910020049836765_110424045239.xlsx	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PRODUCT LIST_002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	WZM.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.12.205
	hesaphareketi_1.SCR.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	2020.xls	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.206.230
	Signed Proforma Invoice 3645479_pdf.vbs	Get hash	malicious	FormBook	Browse	104.21.45.138
	F723838674.vbs	Get hash	malicious	Remcos	Browse	104.21.84.67
	order & specification.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	CTM REQUEST BIRTHSHIP.doc	Get hash	malicious	AgentTesla	Browse	172.67.175.222
	SHIPPING DOCUMENTS_PDF..vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	DHL Receipt_pdf.vbs	Get hash	malicious	AgentTesla	Browse	104.21.84.67
	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.21.74.5
	Remittance slip.vbs	Get hash	malicious	Unknown	Browse	104.21.84.67
	https://msteams.link/WK80	Get hash	malicious	Phisher	Browse	104.21.80.104
NAMECHEAP-NETUS	Remittance slip.vbs	Get hash	malicious	Unknown	Browse	185.61.152.60
	hesaphareketi_1.SCR.exe	Get hash	malicious	AgentTesla	Browse	198.54.114.199
	Payment Advice for Invoice 2024 0904.vbs	Get hash	malicious	FormBook	Browse	185.61.152.60
	https://assets-usa.mkt.dynamics.com/d7d7d53b-67f7-ee11-9046-6045bda8c213/digitalassets/standaloneforms/a8a5d076-d2fc-ee11-a1fe-6045bda76c78	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	162.0.232.241
	PO JSC_109117.exe	Get hash	malicious	AgentTesla	Browse	198.54.120.175
	TNT Invoicing_pdf.vbs	Get hash	malicious	FormBook	Browse	185.61.152.60
	Arrival Notice.vbs	Get hash	malicious	FormBook, GuLoader	Browse	162.255.119.150
	RFQ.exe	Get hash	malicious	FormBook	Browse	37.61.232.138
	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse	198.54.122.135
	Ordin de plat#U0103.exe	Get hash	malicious	FormBook	Browse	198.54.120.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Request for Proposal Quote_2414976#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	104.26.12.205
	Signed Proforma Invoice 3645479_pdf.vbs	Get hash	malicious	FormBook	Browse	104.26.12.205
	F723838674.vbs	Get hash	malicious	Remcos	Browse	104.26.12.205
	order & specification.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	SHIPPING DOCUMENTS_PDF..vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	DHL Receipt_pdf.vbs	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Remittance slip.vbs	Get hash	malicious	Unknown	Browse	104.26.12.205
	Cheater Pro 1.6.0.msi	Get hash	malicious	Unknown	Browse	104.26.12.205
	pQTmpNQX2u.exe	Get hash	malicious	DCRat	Browse	104.26.12.205
	Payment Advice.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	hesaphareketi_1.SCR.exe	Get hash	malicious	AgentTesla	Browse
	remasdasd.exe	Get hash	malicious	XWorm	Browse
	9safSk1jJz.exe	Get hash	malicious	RedLine	Browse
	OZQB66iRBr.exe	Get hash	malicious	RisePro Stealer	Browse
	BXQ4Nv60Rl.exe	Get hash	malicious	RisePro Stealer	Browse
	nq5gQXmhPL.exe	Get hash	malicious	RisePro Stealer	Browse
	B266519287329.IMG	Get hash	malicious	XWorm	Browse
	https://castorndpollux.com/R9283762154.zip	Get hash	malicious	XWorm	Browse
	03.04.24 0000123.vbs	Get hash	malicious	AgentTesla, XWorm	Browse
	R9283762154.wsf	Get hash	malicious	XWorm	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073548394613905
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvru:KooCEYhgYEL0In
MD5:	3AD28A0EAE7DD28F148AA72F46E5F741
SHA1:	9227AA3055FFA62851E522F1BE01C7F5771E87BB
SHA-256:	CB74CF91662AFCB55BF2E02389935D6476A42E542FE85C15BCEADD53706B4D64
SHA-512:	7EC1C387F4E6334A18ACC1D17AA24200D1C7FFBB32224F56B509174A4DC36AE2E98E896CCB7039157D4F83E063B60022793A4F77386735644148692CCD3B04C5
Malicious:	false
Reputation:	low
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x10f7c474, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42217836837332384
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	3EE4CCE166590DCF628721DB37BC0D76
SHA1:	C48E9736D9A58BFCF6CDA8FEB5E69BB7264C0523
SHA-256:	6EBF0F61A763AAA37144AAE89B43003485D317726F492C006CF37C3C92D4FA53
SHA-512:	751B44A86A007B5DC20B78CFABEAE71BCC63BD401973C2B46F0FE68938139A6F740E954CAD75A46B97CE75A066FDD5C5E5786D3398ABCFC47D962CB36C114A9A
Malicious:	false
Reputation:	low
Preview:	...t... .......A.......X\...;...{......................0.!..........{A.,....\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{................................... .;,....\|u....................H,....\|W..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.077526978254612
Encrypted:	false
SSDEEP:	3:KlyYe+mhFlvjn13a/Zt7BlYllcVO/lnlZMxZNQl:+yzBx53qZt7TIOewk
MD5:	A83D03687D54A1A8A77BD6D64A5A30D5
SHA1:	129919BB4BE63A4B916E26212CEF752DD6B9031C
SHA-256:	A0B8AB23971FAFCA3BB0C818E1F89446347FE1313D8A528C9F9B7DD8B83CA686
SHA-512:	F3BB247D50D0A0B9134C9F6AFEA063142E0EBF53D33791C408C3F3AABDEA3A92DBE62709869D81C3660BB02345ABF0138B079498E978680DDA642EB1D1C756B4
Malicious:	false
Reputation:	low
Preview:	.BjJ.....................................;...{..,....\|W......{A..............{A......{A..........{A]...................H,....\|W.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cbsBVT.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hesaphareketi-01.pdf.SCR.exe.log

Download File

Process:	C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulPki/llllZ:NllUcylll
MD5:	D8D47FD6FA3E199E4AFF68B91F1D04A8
SHA1:	788625E414B030E5174C5BE7262A4C93502C2C21
SHA-256:	2D9AF9AB25D04D1CF9B25DB196A988CD6E4124C1B8E185B96F2AB9554F4A6738
SHA-512:	5BFD83D07DC3CB53563F215BE1D4D7206340A4C0AB06988697637C402793146D13CDDE0E27DC8301E4506553D957876AC9D7A7BF3C7431BBDD5F019C17AB0A58
Malicious:	false
Preview:	@...e.................................^..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjzmj1vw.pxj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gvhm5xf5.uqc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_py0uxfau.tk4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xlcbossz.gmt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	65440
Entropy (8bit):	6.049806962480652
Encrypted:	false
SSDEEP:	768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5:	0D5DF43AF2916F47D00C1573797C1A13
SHA1:	230AB5559E806574D26B4C20847C368ED55483B0
SHA-256:	C066AEE7AA3AA83F763EBC5541DAA266ED6C648FBFFCDE0D836A13B221BB2ADC
SHA-512:	F96CF9E1890746B12DAF839A6D0F16F062B72C1B8A40439F96583F242980F10F867720232A6FA0F7D4D7AC0A7A6143981A5A130D6417EA98B181447134C7CFE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: hesaphareketi_1.SCR.exe, Detection: malicious, Browse Filename: remasdasd.exe, Detection: malicious, Browse Filename: 9safSk1jJz.exe, Detection: malicious, Browse Filename: OZQB66iRBr.exe, Detection: malicious, Browse Filename: BXQ4Nv60Rl.exe, Detection: malicious, Browse Filename: nq5gQXmhPL.exe, Detection: malicious, Browse Filename: B266519287329.IMG, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: 03.04.24 0000123.vbs, Detection: malicious, Browse Filename: R9283762154.wsf, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0.............^.... ........@.. ....................... .......F....`.....................................O.......8................A........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P.....0.."........(......-.r...p.rI..p(....s....z....0..........(....~P.....o........(....n(.....(..........%...(....~(.....(..........%...%...(.....(.....(..........%...%...%...(....V.(......}Q.....}R.....{Q.....{R......0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	4.286073681226177
Encrypted:	false
SSDEEP:	24:z3d3+DO/0XZd3Wo3opQ5ZKBQFYVgt7ovrNOYlK:zNODBXZxo4ABV+SrUYE
MD5:	402278578416001C915480C7040F2964
SHA1:	B4833865ECE3609EC213509D4AB7D7A195C00753
SHA-256:	86E0747C9B54AA9AACB788589E70E19279DF13F1393795E689342AF3302912E1
SHA-512:	473600FBC051B22E9E7A6FBE1694ED736CF90DE5A8DF92AF1FA9A85DDD97379CFF0E8A5DF89937AE083BEBEFC81C407A907D0FB5ED9019BEDF6FB4703838321B
Malicious:	false
Preview:	Microsoft .NET Framework Assembly Registration Utility version 4.8.4084.0..for Microsoft .NET Framework version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....Syntax: RegAsm AssemblyName [Options]..Options:.. /unregister Unregister types.. /tlb[:FileName] Export the assembly to the specified type library.. and register it.. /regfile[:FileName] Generate a reg file with the specified name.. instead of registering the types. This option.. cannot be used with the /u or /tlb options.. /codebase Set the code base in the registry.. /registered Only refer to already registered type libraries.. /asmpath:Directory Look for assembly references here.. /nologo Prevents RegAsm from displaying logo.. /silent Silent mode. Prevents displaying of success messages.. /verbose Displays extra information..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.956150936982764
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	hesaphareketi-01.pdf.SCR.exe
File size:	351'744 bytes
MD5:	d4e8894fb5ed5f45972882fbc6ef04dc
SHA1:	f5ac926e2501659cd3933afb72e1172b1147f95d
SHA256:	4888ef9f557bfc04c0c7da3ff2dc1fc34767273d90053aa1e04c3892300afe12
SHA512:	bd9b3644bfe90a3c435fcbf8895163963b4302dbe64db5652c5978cb6cfcf19b6f84249909c597e00425c375456bcda0eb1aad31b2825c6d60d1bc0983f3d389
SSDEEP:	6144:MvkECw92bslgwmEuLCP50vDht1LIUcz7zyr+RCniN/F59ZrE:MvKC2bwmEbIht15c/qip
TLSH:	4B74E1A9C2D66BB9DD864AF4ED52107D01FD0803668F6F9D4A4D2C362C6E20D3B42B5F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i.................0..T...........s... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x45732e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF7E2BC69 [Sat Oct 15 15:02:01 2101 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x572d8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x58000	0x596	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x55334	0x55400	f5c6744f5793b0149df0f455b3a4af3c	False	0.9146925403225806	data	7.96694997733209	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x58000	0x596	0x600	3d90fd21b72ae9f5b6386b91e1399e8d	False	0.4140625	data	4.028643800397872	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5a000	0xc	0x200	3a8afa8452cf5d7f547fef5fc058d9ed	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x580a0	0x30c	data			0.4269230769230769
RT_MANIFEST	0x583ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 21:16:46.099497080 CEST	49732	443	192.168.2.4	104.26.12.205
Apr 18, 2024 21:16:46.099529982 CEST	443	49732	104.26.12.205	192.168.2.4
Apr 18, 2024 21:16:46.099590063 CEST	49732	443	192.168.2.4	104.26.12.205
Apr 18, 2024 21:16:46.110135078 CEST	49732	443	192.168.2.4	104.26.12.205
Apr 18, 2024 21:16:46.110147953 CEST	443	49732	104.26.12.205	192.168.2.4
Apr 18, 2024 21:16:46.332119942 CEST	443	49732	104.26.12.205	192.168.2.4
Apr 18, 2024 21:16:46.332226038 CEST	49732	443	192.168.2.4	104.26.12.205
Apr 18, 2024 21:16:46.336447954 CEST	49732	443	192.168.2.4	104.26.12.205
Apr 18, 2024 21:16:46.336456060 CEST	443	49732	104.26.12.205	192.168.2.4
Apr 18, 2024 21:16:46.336767912 CEST	443	49732	104.26.12.205	192.168.2.4
Apr 18, 2024 21:16:46.387701035 CEST	49732	443	192.168.2.4	104.26.12.205
Apr 18, 2024 21:16:46.392978907 CEST	49732	443	192.168.2.4	104.26.12.205
Apr 18, 2024 21:16:46.436120987 CEST	443	49732	104.26.12.205	192.168.2.4
Apr 18, 2024 21:16:46.638405085 CEST	443	49732	104.26.12.205	192.168.2.4
Apr 18, 2024 21:16:46.638467073 CEST	443	49732	104.26.12.205	192.168.2.4
Apr 18, 2024 21:16:46.638560057 CEST	49732	443	192.168.2.4	104.26.12.205
Apr 18, 2024 21:16:46.648564100 CEST	49732	443	192.168.2.4	104.26.12.205
Apr 18, 2024 21:16:52.198290110 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:52.354726076 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:52.354945898 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:53.268362999 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:53.268574953 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:53.427421093 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:53.427661896 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:53.583811998 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:53.584336042 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:53.751782894 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:53.751847982 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:53.751887083 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:53.751945019 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:53.751974106 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:53.752006054 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:53.753866911 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:53.794034958 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:53.997364044 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:54.159778118 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:54.163717031 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:54.318609953 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:54.343871117 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:54.515575886 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:54.515944004 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:54.715617895 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:54.716882944 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:54.717271090 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:54.872251034 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:54.872308969 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:54.872661114 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:55.068231106 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:55.094459057 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:55.094724894 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:55.248646021 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:55.248718023 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:55.249408007 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:55.249470949 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:55.249494076 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:55.249511003 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:16:55.403639078 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:55.403657913 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:55.403669119 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:55.403769016 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:55.440169096 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:16:55.481528044 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:18:32.044507980 CEST	49736	587	192.168.2.4	198.54.114.199
Apr 18, 2024 21:18:32.201553106 CEST	587	49736	198.54.114.199	192.168.2.4
Apr 18, 2024 21:18:32.202090025 CEST	49736	587	192.168.2.4	198.54.114.199

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 21:16:45.979609013 CEST	63450	53	192.168.2.4	1.1.1.1
Apr 18, 2024 21:16:46.084294081 CEST	53	63450	1.1.1.1	192.168.2.4
Apr 18, 2024 21:16:52.051304102 CEST	53946	53	192.168.2.4	1.1.1.1
Apr 18, 2024 21:16:52.197240114 CEST	53	53946	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 21:16:45.979609013 CEST	192.168.2.4	1.1.1.1	0x3585	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 18, 2024 21:16:52.051304102 CEST	192.168.2.4	1.1.1.1	0xc979	Standard query (0)	business29.web-hosting.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 21:16:46.084294081 CEST	1.1.1.1	192.168.2.4	0x3585	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 18, 2024 21:16:46.084294081 CEST	1.1.1.1	192.168.2.4	0x3585	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 18, 2024 21:16:46.084294081 CEST	1.1.1.1	192.168.2.4	0x3585	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 18, 2024 21:16:52.197240114 CEST	1.1.1.1	192.168.2.4	0xc979	No error (0)	business29.web-hosting.com	198.54.114.199	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	104.26.12.205	443	416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 19:16:46 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-18 19:16:46 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 19:16:46 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8766fdbeb9797bdc-ATL
2024-04-18 19:16:46 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 18, 2024 21:16:53.268362999 CEST	587	49736	198.54.114.199	192.168.2.4	220-business29.web-hosting.com ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 15:16:53 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 21:16:53.268574953 CEST	49736	587	192.168.2.4	198.54.114.199	EHLO 216041
Apr 18, 2024 21:16:53.427421093 CEST	587	49736	198.54.114.199	192.168.2.4	250-business29.web-hosting.com Hello 216041 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 18, 2024 21:16:53.427661896 CEST	49736	587	192.168.2.4	198.54.114.199	STARTTLS
Apr 18, 2024 21:16:53.583811998 CEST	587	49736	198.54.114.199	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	21:16:42
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe"
Imagebase:	0x3a0000
File size:	351'744 bytes
MD5 hash:	D4E8894FB5ED5F45972882FBC6EF04DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1800686343.0000000003739000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:16:42
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi-01.pdf.SCR.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tt.exe'
Imagebase:	0xb90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:16:42
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:16:44
Start date:	18/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xc90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3042736012.0000000002EA4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3042736012.0000000002E9C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3042736012.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3042736012.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3040210068.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3040210068.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	21:16:44
Start date:	18/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:16:59
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Imagebase:	0x250000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:16:59
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:17:08
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Imagebase:	0x770000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:17:08
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	3

Executed Functions

Function 04B7C7B0 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 04B7C83E
GetCurrentThread.KERNEL32 ref: 04B7C87B
GetCurrentProcess.KERNEL32 ref: 04B7C8B8
GetCurrentThreadId.KERNEL32 ref: 04B7C911

Memory Dump Source

Source File: 00000000.00000002.1801392310.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_hesaphareketi-01.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: db801d2674f94e9ccb07f587209a9de4572182f8da77a7dff8f5714f9e8c5296
Instruction ID: 64fb000b3b86667eb2120060f073c6867b5f3eac9d057db7c72cf9a718e931a6
Opcode Fuzzy Hash: db801d2674f94e9ccb07f587209a9de4572182f8da77a7dff8f5714f9e8c5296
Instruction Fuzzy Hash: 7B5147B09007498FEB14DFA9D548BAEBFF1EF48304F24C469D059A7260DB74A984CB66

Uniqueness

Uniqueness Score: -1.00%

Function 04B7C7C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 04B7C83E
GetCurrentThread.KERNEL32 ref: 04B7C87B
GetCurrentProcess.KERNEL32 ref: 04B7C8B8
GetCurrentThreadId.KERNEL32 ref: 04B7C911

Memory Dump Source

Source File: 00000000.00000002.1801392310.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_hesaphareketi-01.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 69a496839f031a390f63a2f1965df308d978714ac01a79f0336af3f0a9724eb3
Instruction ID: 287e99c6f1779adfd6ab8d5f5077b5c8b078eb805eb7d0c6d617a563b2ac2d5c
Opcode Fuzzy Hash: 69a496839f031a390f63a2f1965df308d978714ac01a79f0336af3f0a9724eb3
Instruction Fuzzy Hash: 575136B09007498FEB14DFA9D548BAEBFF1EB48304F20C469D459A7360DB74A984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 04B7CE09 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04B7CE97

Memory Dump Source

Source File: 00000000.00000002.1801392310.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_hesaphareketi-01.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 58b76a84d6c24eb47817f06a4e262cc7c4be87ae1583cf4da0eda32fa3107898
Instruction ID: de9a4b01e35fbcadd818bbb8327bce6718f6a5afef5a0ea8d3e274122a285c10
Opcode Fuzzy Hash: 58b76a84d6c24eb47817f06a4e262cc7c4be87ae1583cf4da0eda32fa3107898
Instruction Fuzzy Hash: 9E21E4B5D01209DFDB10CFAAD584ADEBFF5EB48320F14841AE958A7310D378A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04B7CE10 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04B7CE97

Memory Dump Source

Source File: 00000000.00000002.1801392310.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_hesaphareketi-01.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 566c56b20b81123287ea46f3264be5312987c22aed3a5e8d544796b63eb4e1ee
Instruction ID: a88b2afa2998233f580c6756afcfcd415e477025c0312d39ad77d7d980cd77ed
Opcode Fuzzy Hash: 566c56b20b81123287ea46f3264be5312987c22aed3a5e8d544796b63eb4e1ee
Instruction Fuzzy Hash: 2321E4B5900208DFDB10CF9AD984ADEBFF8EB48310F14841AE958A3310C374A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04B798B0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04B7A7F9,00000800,00000000,00000000), ref: 04B7AA0A

Memory Dump Source

Source File: 00000000.00000002.1801392310.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_hesaphareketi-01.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2386b83446687f2612a61d9e99e07c879adc2f009b10cbfb8c10f2300bd5021b
Instruction ID: a5420f09ec3481f7a4b9510738a65bfc31db8dfb54fbefdb775963f86aabd383
Opcode Fuzzy Hash: 2386b83446687f2612a61d9e99e07c879adc2f009b10cbfb8c10f2300bd5021b
Instruction Fuzzy Hash: 601123B69003499FDB10CF9AC544AEEFBF4EB88310F10846AE469B7210C375A945CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 04B7A998 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04B7A7F9,00000800,00000000,00000000), ref: 04B7AA0A

Memory Dump Source

Source File: 00000000.00000002.1801392310.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_hesaphareketi-01.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c6f17950c4e0f9f958bd7336b9e19609f9144b97fe313c94791456dad6073d5f
Instruction ID: ceab3e97b8b7766ef8f014d07cfc00ef3741710ba458f5456421f4600aafaf51
Opcode Fuzzy Hash: c6f17950c4e0f9f958bd7336b9e19609f9144b97fe313c94791456dad6073d5f
Instruction Fuzzy Hash: 201134B6C00249CFDB10CF9AC544ADEFBF4EB88320F10842AD569A7310C379A546CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04B7A718 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04B7A77E

Memory Dump Source

Source File: 00000000.00000002.1801392310.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_hesaphareketi-01.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 37e11dc29aa757bd13b3f0b8a194b200997b93a0c259afbedd0acda9b35437ce
Instruction ID: 4e4454efdd1b7fcb4d7685dca5b472fe20ea4abf4bffdf4291afe74701aeb7a2
Opcode Fuzzy Hash: 37e11dc29aa757bd13b3f0b8a194b200997b93a0c259afbedd0acda9b35437ce
Instruction Fuzzy Hash: 5811EDB6C00749CFDB10CF9AC944ADEFBF5EB88324F10846AD869A7210C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00CCD4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799645625.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ccd000_hesaphareketi-01.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e2fc9772e184608755413d9104c1eac0a5b47d336ce90b941b6c47deccd3a83
Instruction ID: d9e9a6165e739aa9c84c8c3363167b6d467d6b48e01394192897a066475f956d
Opcode Fuzzy Hash: 8e2fc9772e184608755413d9104c1eac0a5b47d336ce90b941b6c47deccd3a83
Instruction Fuzzy Hash: D52100B2504200DFDB05DF18D9C0F27BFA5FB98328F20C17DE90A0A256C336D856CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CDD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799744619.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cdd000_hesaphareketi-01.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6f0b1bcb639b7ea1fcbfb2ce727fd4a56e7c9e8e40041563ecf96cc442aec6
Instruction ID: dc5d3d7eb4bdfe095ea69968de7f348a8c35f4b8a7c7a9e0347b44db407a4692
Opcode Fuzzy Hash: 0a6f0b1bcb639b7ea1fcbfb2ce727fd4a56e7c9e8e40041563ecf96cc442aec6
Instruction Fuzzy Hash: F921F571904200DFCB14DF14D9C4B26BBA5EBC4314F24C56EDA0A4B356C336E847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00CDD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799744619.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cdd000_hesaphareketi-01.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b481b1c51909a920a09171fd248cb20c23666d62370b3bfad304b904083934a2
Instruction ID: c018b52a969eedd300f93598135edf5d108f6b1b40a0faffbd3f05a24ae23048
Opcode Fuzzy Hash: b481b1c51909a920a09171fd248cb20c23666d62370b3bfad304b904083934a2
Instruction Fuzzy Hash: 55218E755093808FCB12CF24D994715BF71EB86314F28C5EBD9498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CCD49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799645625.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ccd000_hesaphareketi-01.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 1843935da3d9b841bb21d17f0fc43c237e85f4bf762d84f86d370fec5628692e
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 9511D3B6504240CFDB16CF14D5C4B16BF71FB94324F24C5ADD90A0B656C336D95ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04B7F5B8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1801392310.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_hesaphareketi-01.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98697228ee313a1635ca1ffc3e68d3084ff65483e62536a3e465cd20ff1665
Instruction ID: c466d6fa09aad30d8884eccfa28ab4c27f60b73bf3911962d947a8f9330cf4bd
Opcode Fuzzy Hash: fb98697228ee313a1635ca1ffc3e68d3084ff65483e62536a3e465cd20ff1665
Instruction Fuzzy Hash: 9612A7F0402745AAD330CF65E86C9893BB1FB45319F54428BD2661B2E1EBBC198ADF74

Uniqueness

Uniqueness Score: -1.00%

Function 04B7CD3C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1801392310.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_hesaphareketi-01.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 663518a131ebbeb4f59bd7db1f894f68846fbfd69a334099010ae1c74e855a26
Instruction ID: c1a10cef26d1571efa251ecb1adcfe31a012269ae840e0330002bfa46cd6f608
Opcode Fuzzy Hash: 663518a131ebbeb4f59bd7db1f894f68846fbfd69a334099010ae1c74e855a26
Instruction Fuzzy Hash: 62A16D32E002198FDF15DFA4C8445AEB7B2FF85304B1585EAE815AB265EB31F946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04B7F5A8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1801392310.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b70000_hesaphareketi-01.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7bfb87c9d4e084f9304e2492e8d92f09e95e3ab6d4e6b0e238bb5e5875989c6
Instruction ID: 7751a25bea9bdeca9fce57017d88dde20e817aabf8675531aaf49129ae787369
Opcode Fuzzy Hash: a7bfb87c9d4e084f9304e2492e8d92f09e95e3ab6d4e6b0e238bb5e5875989c6
Instruction Fuzzy Hash: 6BC12BB0402746ABD730CF25E8685897BB1FB85315F64438BD1626B2E0EBBC1886DF74

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 6692, Parent PID: 6592COMMON

Executed Functions

Function 07BB1C10 Relevance: 5.6, Strings: 4, Instructions: 584COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07BB20B0
4'^q, xrefs: 07BB1F4E
4'^q, xrefs: 07BB20BA
4'^q, xrefs: 07BB1F58

Memory Dump Source

Source File: 00000001.00000002.1816733331.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7bb0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: f17e35f91d7258823370b14feb4bd5cc146b30b6a2604c122d25ae920beb3b41
Instruction ID: adffc72a858a5fddbe8491b22fb9157b48a7678b746b2295e2cde1fa91d7bb6e
Opcode Fuzzy Hash: f17e35f91d7258823370b14feb4bd5cc146b30b6a2604c122d25ae920beb3b41
Instruction Fuzzy Hash: 941257F1B042098FE7258B6C98117FABBA2EFC6210F1484BAD905CF795DBB1C855C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 04C429F0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1808540910.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7a28c5a84ad69fb8e234e4e4e33b317e1c0f91ddc1b8722389192104d176b4
Instruction ID: 8404d69a94e7c241c9b04e385434fc0e28ec00715a64a64c94aa2a6bf8febf6f
Opcode Fuzzy Hash: cc7a28c5a84ad69fb8e234e4e4e33b317e1c0f91ddc1b8722389192104d176b4
Instruction Fuzzy Hash: 85918E74A002458FCB15CF59C5959AEFBB2FF88310B2485A9E815AB3A5C735FC91CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07BB1BF0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1816733331.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99ce4d5ac9575b54f22ddd242b6699a13727c2990f55c0ae1dd8132efb35deb
Instruction ID: 842a2c9ef3e76fac07de09068c95de65a9e35a6e4fc98577015346e12590f141
Opcode Fuzzy Hash: b99ce4d5ac9575b54f22ddd242b6699a13727c2990f55c0ae1dd8132efb35deb
Instruction Fuzzy Hash: EE41F3F1B0020E8FEB35CB6D8821AF97BA2EF86210F5480E9DD009F655CA71D855CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04C42B00 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1808540910.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4332bb2addc5a9b1a03a11863dde81d5fe31374f6d79a0dbd5ab4c549046d93
Instruction ID: 8616507333e9a40a2faa3f180bd54422ab3bd3ef8005ee101fad14b79cc101e8
Opcode Fuzzy Hash: e4332bb2addc5a9b1a03a11863dde81d5fe31374f6d79a0dbd5ab4c549046d93
Instruction Fuzzy Hash: 86416AB4A005058FCB05CF58C199AAEFBB2FF88314B118599E815AB364C736FD91CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04C44C18 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1808540910.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcad08149c8a454e2372049b484a61c1a9df41a0535d965ad90a029c7bfa427d
Instruction ID: 0be3a71f039fce5d8c05dab3398471e739fe3437854fb5e08636bee942805127
Opcode Fuzzy Hash: bcad08149c8a454e2372049b484a61c1a9df41a0535d965ad90a029c7bfa427d
Instruction Fuzzy Hash: 5A11DA78E002199FCB04CF98D5809AEBBF5FF89310B258599D809AB351C735FD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 033ED01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1808138873.00000000033ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 033ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ad3c225bb250a69feeb936055d61af0b5473bfc6e9f298a4bcd5b815cb7adf
Instruction ID: 8adf8ed0771d566e61d149fe78530950b989bd3212b3ba9d9cff0b6ca49bbffb
Opcode Fuzzy Hash: e2ad3c225bb250a69feeb936055d61af0b5473bfc6e9f298a4bcd5b815cb7adf
Instruction Fuzzy Hash: 4001F231409314AEE720CA29CDC4B67FF9CEF41325F0CC46AEC180A686C27D9C42C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 033ED006 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1808138873.00000000033ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 033ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df2ee2044a21b1f6a152719cd5e8db1a7d9a26876fb4a9cceedb76581aee6bc5
Instruction ID: 35810d25c72cac20580a992546129c0e2fe259b3d349f7a2022b1198f6bb9532
Opcode Fuzzy Hash: df2ee2044a21b1f6a152719cd5e8db1a7d9a26876fb4a9cceedb76581aee6bc5
Instruction Fuzzy Hash: 5C01407140E3C09ED7128B25CC94B52BFB4EF43225F1D84CBD8888F2A3C2699849C772

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07BB1270 Relevance: 9.2, Strings: 7, Instructions: 486COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BB12A8
4'^q, xrefs: 07BB14D7
tP^q, xrefs: 07BB12F9
tP^q, xrefs: 07BB12ED
4'^q, xrefs: 07BB14E1
$^q, xrefs: 07BB12B4
$^q, xrefs: 07BB1282

Memory Dump Source

Source File: 00000001.00000002.1816733331.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7bb0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-1608119003
Opcode ID: f12aa48b279b6fd46211aa7dfb1c4663e3c4ce4cbd19e589b9d00f2e37230c55
Instruction ID: 98f679b929758353bead2fc1fdff953735064fe90136f4c059f4353ed5c0def8
Opcode Fuzzy Hash: f12aa48b279b6fd46211aa7dfb1c4663e3c4ce4cbd19e589b9d00f2e37230c55
Instruction Fuzzy Hash: C2F126B2B0021D8FE7248B6D98216FABBE6EFC5210F1484BAD805CB755DA71C849CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07BB04E0 Relevance: 9.1, Strings: 7, Instructions: 322COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BB06E8
4'^q, xrefs: 07BB05E3
tP^q, xrefs: 07BB072D
$^q, xrefs: 07BB06C2
4'^q, xrefs: 07BB05EF
tP^q, xrefs: 07BB0739
$^q, xrefs: 07BB06F4

Memory Dump Source

Source File: 00000001.00000002.1816733331.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7bb0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-1608119003
Opcode ID: 39efcc03134b9fa82a199d14b47de8ebc48b2e61ce3a3d18f65b9367c82fd72b
Instruction ID: f76c6f40dcf3376509f46056e3b7250b387d028ac41c19abe75b437be9d09410
Opcode Fuzzy Hash: 39efcc03134b9fa82a199d14b47de8ebc48b2e61ce3a3d18f65b9367c82fd72b
Instruction Fuzzy Hash: 58A169F2B043168FE735AA2998506BBBBA5EFC5210F1484FBD805CB391DAB1C855CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 07BB3228 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BB3290
$^q, xrefs: 07BB3256
$^q, xrefs: 07BB323A
$^q, xrefs: 07BB3284

Memory Dump Source

Source File: 00000001.00000002.1816733331.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7bb0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: afbd968ff2b984cb94c2198946d9dc3adb758f0e704f3431870376bd65bd111f
Instruction ID: aa28559a0edbc3a2ba748b4b28962fabbc08d1e0b2c374830efe8883d49c0642
Opcode Fuzzy Hash: afbd968ff2b984cb94c2198946d9dc3adb758f0e704f3431870376bd65bd111f
Instruction Fuzzy Hash: F72105F170431A5BE778596A8801BB7A6D6DFC1710F24846AA905CB385DDB6C8498261

Uniqueness

Uniqueness Score: -1.00%

Function 07BB0308 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07BB0373
$^q, xrefs: 07BB0352
4'^q, xrefs: 07BB037F
$^q, xrefs: 07BB035E

Memory Dump Source

Source File: 00000001.00000002.1816733331.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7bb0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 096f2df7e7b4b2e97ce608d9afd894ee406f7c4d194626a66773309f24cc9dc2
Instruction ID: 5382027143b1f142f308919cd4d78cf44b69a47fecb5f1a72b8eeb6d253d97bd
Opcode Fuzzy Hash: 096f2df7e7b4b2e97ce608d9afd894ee406f7c4d194626a66773309f24cc9dc2
Instruction Fuzzy Hash: 8301D4A170E3C68FD32B622818245765FB25B87510B2A04DBC440CF39BCD558C0D8393

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 416, Parent PID: 6592COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	129
Total number of Limit Nodes:	9

Executed Functions

Function 06B27440 Relevance: 9.0, Strings: 6, Instructions: 1491COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B2886F
$^q, xrefs: 06B2883F
$^q, xrefs: 06B2884B
$^q, xrefs: 06B28816
$^q, xrefs: 06B28822
$^q, xrefs: 06B28863

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 59860f40f64d20a0925343356210d0df695233831677ed2315a80f0478f8a06a
Instruction ID: 8798eb1a2d79a66ef5d5029ef4108a95f5406b1ba5689c8e0bc362834ef24213
Opcode Fuzzy Hash: 59860f40f64d20a0925343356210d0df695233831677ed2315a80f0478f8a06a
Instruction Fuzzy Hash: 6CD25C70E102268FDB64DB68C584A9DB7F2FF89310F54D5A9D409AB365DB30ED86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B2CE58 Relevance: 3.0, Strings: 2, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B2D3C4
$^q, xrefs: 06B2D3D0

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 2bb6f8ef2a4c1b31a015a98c6ba0c83ada6c0861376159918149dc5b3c721c3a
Instruction ID: d33ac30721e7f5afe100b98dc0e80b8fdf594cc290b4585727c07891ed8d080e
Opcode Fuzzy Hash: 2bb6f8ef2a4c1b31a015a98c6ba0c83ada6c0861376159918149dc5b3c721c3a
Instruction Fuzzy Hash: A602BC70B002268FDB54EB64D99466EB7F2FF84304F1485A8D40ADB395DB35EC82CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06B2ADD0 Relevance: 2.9, Strings: 2, Instructions: 413
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ocq, xrefs: 06B2AEEB
XPcq, xrefs: 06B2B086

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: XPcq$\Ocq
API String ID: 0-2802517751
Opcode ID: 02c0bb1d7834cefef03625b4be780299ae1831ce657da72c6ba6369001a924cc
Instruction ID: 34f904ee087e3477fbdaccf5a168ce4604170acdb326d964c48df68e7003626b
Opcode Fuzzy Hash: 02c0bb1d7834cefef03625b4be780299ae1831ce657da72c6ba6369001a924cc
Instruction Fuzzy Hash: C2D11871B201258FDF54EB68D490AAEBBF2FF89714F2484AAE41ADB351CA31DC41C791

Uniqueness

Uniqueness Score: -1.00%

Function 06B219E8 Relevance: 2.9, Instructions: 2910COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cbfee6317fef33a75678338e2836faf309dced65ec35b69ddc9e0327ca37efd
Instruction ID: 9f9e7da625f8e8c476b89c5a5520f8561e93264280519444557ea03a35075c1d
Opcode Fuzzy Hash: 2cbfee6317fef33a75678338e2836faf309dced65ec35b69ddc9e0327ca37efd
Instruction Fuzzy Hash: FB630871D10B1A8ACB51EF68C880599F7B1FF99300F15D79AE45CB7221EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06B24D58 Relevance: 2.3, Instructions: 2300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629db0052d19e89babf26130c214137fff2897072b184b2fa67b9d589070c2a5
Instruction ID: 9951c1f864f992fa0f32977a5bd852ffb595d14268f6d125b892e4948d54fca5
Opcode Fuzzy Hash: 629db0052d19e89babf26130c214137fff2897072b184b2fa67b9d589070c2a5
Instruction Fuzzy Hash: DB331F71D1071A8ECB11EF68C8905ADF7B1FF99300F15D79AE458AB211EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06B04131 Relevance: 1.8, APIs: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3051819549.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391238cd80ff5538d23dd244ce32e1566ddc39d071a68ea08f47b279592dcde3
Instruction ID: e865613e72e9c282b0702a835f18d0a6aca1052279f849185dbf5620f59c6deb
Opcode Fuzzy Hash: 391238cd80ff5538d23dd244ce32e1566ddc39d071a68ea08f47b279592dcde3
Instruction Fuzzy Hash: EAD118B4A00209DFEB54DFA5C948BADBFF1FF48304F1581A4E615AB2A5DB70D985CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B21A99 Relevance: 1.3, Instructions: 1321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb12e69b2da76adbcfc6204a97bdc8d89fa80a63fd7d9d9888651d29c80637e6
Instruction ID: 66dcc8c8eb0b428baad74a275816168be480547ddda104527b71a984bfbdcf3b
Opcode Fuzzy Hash: cb12e69b2da76adbcfc6204a97bdc8d89fa80a63fd7d9d9888651d29c80637e6
Instruction Fuzzy Hash: E2E2D571D10B1A8ADB50EB68C8405A9F7B1FF99300F11D79AE45CB7221EB70AAD5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06B2B6C8 Relevance: .8, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26c0661b64283cdc28683f050252f95660c711a740b9178a338364015907922
Instruction ID: 012072dec7b47f795d35368300f34efc3ab65cfaeb266907c57bd7403567e130
Opcode Fuzzy Hash: d26c0661b64283cdc28683f050252f95660c711a740b9178a338364015907922
Instruction Fuzzy Hash: 4E629C74E002268FDB54DB68D584BADB7F2EF84318F1485A9D41AEB394DB35EC42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02D0AC48 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 02D0ADD7

Strings

Hbq, xrefs: 02D0AFF3
Hbq, xrefs: 02D0B038

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: ActiveWindow
String ID: Hbq$Hbq
API String ID: 2558294473-4258043069
Opcode ID: f08938be9e880f1c5c0add6d4ada4f61ba0695879e987992afdb663f5f72d9a6
Instruction ID: 69d8b4f1c3e05a85210cbd636593c6aa84fcd852aa1574f09e77c3a68fe7b969
Opcode Fuzzy Hash: f08938be9e880f1c5c0add6d4ada4f61ba0695879e987992afdb663f5f72d9a6
Instruction Fuzzy Hash: D0C19D30B103599BDB58AFB8C4557AE7BA6FF88300F148429E906AB390DF74DD82CB55

Uniqueness

Uniqueness Score: -1.00%

Function 06B2E228 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B2E2D3
$^q, xrefs: 06B2E2DF
$^q, xrefs: 06B2E298
$^q, xrefs: 06B2E2A4

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 53ec5a067cdaafb4c1cc547356f5c8d47b89d30d1fbb433462a2f1ee7026d461
Instruction ID: 34fe286dc0b503be114514ed7f24b109fa86947832fb40d00985b732fca374ec
Opcode Fuzzy Hash: 53ec5a067cdaafb4c1cc547356f5c8d47b89d30d1fbb433462a2f1ee7026d461
Instruction Fuzzy Hash: 84914F70F0022A9FDB54DB66D8907AEB3F6EB85204F1485A9D40DEB385EB31DC468B91

Uniqueness

Uniqueness Score: -1.00%

Function 06B29C50 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 06B29DA1
fcq, xrefs: 06B29C7B
\Ocq, xrefs: 06B29E2B

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: efdc868c51a4f6ff6545b5147de56ae8c20bac236e28d6155dbd28f4f17b7c5e
Instruction ID: a3f4a4de971f2d3eb2dbc7da2cadf44405fe8294a9a0622c5e96bb47bf16a8a2
Opcode Fuzzy Hash: efdc868c51a4f6ff6545b5147de56ae8c20bac236e28d6155dbd28f4f17b7c5e
Instruction Fuzzy Hash: E6619370E102199FEB54AFA9C8547AEBBF7FB88700F208529D10AEB394DB758C458B51

Uniqueness

Uniqueness Score: -1.00%

Function 06B29C40 Relevance: 2.6, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 06B29DA1
fcq, xrefs: 06B29C7B

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: 7e1857dcac1a2d6eeaae2fbe8fbe7fc92cdb2b1af38cc05e8c81c96d7e2bb356
Instruction ID: 94a82afc0915957a2fbc329e01cde52b59e59f72f539ee7f68dbf00dab7d4274
Opcode Fuzzy Hash: 7e1857dcac1a2d6eeaae2fbe8fbe7fc92cdb2b1af38cc05e8c81c96d7e2bb356
Instruction Fuzzy Hash: B5518470F102199FDB55AFA9C8547AEBBF7FF88700F208529D109AB394DB758C068B91

Uniqueness

Uniqueness Score: -1.00%

Function 02D0AC3C Relevance: 1.7, APIs: 1, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 02D0ADD7

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: ActiveWindow
String ID:
API String ID: 2558294473-0
Opcode ID: d9eae96843495eb07888a407ba503405bf517ef342bffd8006642ffbfb0a1784
Instruction ID: 15d926b32812185f8bee92162ee000f624614be1ec8b40877cbecbb2a7b2a456
Opcode Fuzzy Hash: d9eae96843495eb07888a407ba503405bf517ef342bffd8006642ffbfb0a1784
Instruction Fuzzy Hash: EA614870E1031A9BDB14DFA5D889BADBFB2FF88315F148429E915AB390EF349841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06B2A878 Relevance: 1.7, Strings: 1, Instructions: 423
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06B2A9F6

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 4becd9b898052fcbbfe3f506eea7a6faf45aa905a93a6c43bffccf59a86289fd
Instruction ID: f1cbd220104c87b18ce4b0f2ca4e7e9c1b1c93df3b46d10eb9aa6d6a294e6c4c
Opcode Fuzzy Hash: 4becd9b898052fcbbfe3f506eea7a6faf45aa905a93a6c43bffccf59a86289fd
Instruction Fuzzy Hash: F1E1D271E002268FDF64DBA4C4946AEF7F2FF88314F2085A9D859AB344DB319D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B01F10 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06B01FD1

Memory Dump Source

Source File: 00000003.00000002.3051819549.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b00000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 520433a895951a69eb4fc0f4d30c184187ffa17077a803324d8aff3114d61dc9
Instruction ID: 1ed79d49911c92b4081dd6202b5b2db039722d02fbd0c564698f0ec27c7570e4
Opcode Fuzzy Hash: 520433a895951a69eb4fc0f4d30c184187ffa17077a803324d8aff3114d61dc9
Instruction Fuzzy Hash: 0B4106B5900309CFDB54CF99C448AAABFF9FB88314F24C499E519AB361D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D0C1DB Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02D0C267

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b5481fc91669adfb7b81bcf2ad78195bac168d909cfa18f3d77a436bddd6b4d3
Instruction ID: f56f0e679b8cd9e8cca3e2132e6136a223aaf09be96eb4cc814af77f32640dcf
Opcode Fuzzy Hash: b5481fc91669adfb7b81bcf2ad78195bac168d909cfa18f3d77a436bddd6b4d3
Instruction Fuzzy Hash: E921E2B5900248AFDB10CFAAD984ADEBFF4EB48720F14841AE918A7350C374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02D0C1E0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02D0C267

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f5d4343aa353caaef94b743e951755c4ec0772e032c869cd6e6e73476a47248b
Instruction ID: 785853672fede32a0b8bb2f4c37c0d7f15f9c30759a657ea9c8e8ad528e21ae6
Opcode Fuzzy Hash: f5d4343aa353caaef94b743e951755c4ec0772e032c869cd6e6e73476a47248b
Instruction Fuzzy Hash: F121E2B59002489FDB10CFAAD984ADEBFF4EB48720F14841AE918A7350C374A954CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02D0D9BC Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E58,?,?,02D0DEA0,03E241C4,02E75058), ref: 02D0DF31

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 2682a8dc6c92a61092a75ff016af6ef645c7de51f659cf75b5673b57908daec9
Instruction ID: c44826fd1014acf892f8960edbc7605eb1bcfaf9e8d92853bb111ad4dfcc8362
Opcode Fuzzy Hash: 2682a8dc6c92a61092a75ff016af6ef645c7de51f659cf75b5673b57908daec9
Instruction Fuzzy Hash: 78214971D002498FDB10CF9AC884BEEFBF5EB88324F14842AE458A7390D774A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02D0DEB8 Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E58,?,?,02D0DEA0,03E241C4,02E75058), ref: 02D0DF31

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: a83897e549ca75bae10590573680268abe0852475e7a18e8c53cd6a252a0a7d5
Instruction ID: 08ff23a2e5fac1c8d1e294607f58487785460a7ed19420a472e4fa9f74c84bea
Opcode Fuzzy Hash: a83897e549ca75bae10590573680268abe0852475e7a18e8c53cd6a252a0a7d5
Instruction Fuzzy Hash: 47213B71D002498FDB14CF9AC844BEEFBF5EB88324F14842AE458A7390D774A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02D0E249 Relevance: 1.6, APIs: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?,?,?,?,?,?,?,02D0AE8D,?,?,?), ref: 02D0E2CD

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 627d29fc9c7391ba36d71637afbee5c26fabcae86b20b9f1923572da0beb6a7d
Instruction ID: 5fe4924b54662693199ae2b796d17a73ddd275c01353ef67433f1bdf6894328e
Opcode Fuzzy Hash: 627d29fc9c7391ba36d71637afbee5c26fabcae86b20b9f1923572da0beb6a7d
Instruction Fuzzy Hash: FB2104B69013499FDB10CF9AD884ADEFBF5FB48314F14892AE818A7310C375A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02D0A810 Relevance: 1.6, APIs: 1, Instructions: 60
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxW.USER32(?,00000000,00000000,?,?,?,?,?,?,?,02D0AE8D,?,?,?), ref: 02D0E2CD

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 8b309e229094ff802b4d04ef9c69360b8ab0fe564108d2e5216e3d736196d401
Instruction ID: cf2be6d59d522e61f0b01429e40c2ab3fa8ef56071169a38cdfa584c3634cc21
Opcode Fuzzy Hash: 8b309e229094ff802b4d04ef9c69360b8ab0fe564108d2e5216e3d736196d401
Instruction Fuzzy Hash: 6C2123B69003099FCB10CF9AD884BDEBBF4FB48314F10882EE818A7310C374A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02D0DB5C Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 02D0EA50

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d184d54a8b7f60a333b19ff3ae31ee4879f3b1be58863dc24a9a55c8c84d5485
Instruction ID: 7c31e73b753ce754c55022df68e0c4cddbd2a9811e16880555a84984a1923ed6
Opcode Fuzzy Hash: d184d54a8b7f60a333b19ff3ae31ee4879f3b1be58863dc24a9a55c8c84d5485
Instruction Fuzzy Hash: EB2147B2D046599BCB10CF9AD54479EFBF0FB48320F10852AE858A7350D334A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02D0E9D9 Relevance: 1.6, APIs: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 02D0EA50

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 3fdce3bae4c7e3712f5e48d4bd539c15ffb935087879faa4e75d35e7bc2acee2
Instruction ID: 4e75bda8bda89aadfcb99eb69618d3b6a41e66b26dc62f9b3861cd79da17af3b
Opcode Fuzzy Hash: 3fdce3bae4c7e3712f5e48d4bd539c15ffb935087879faa4e75d35e7bc2acee2
Instruction Fuzzy Hash: F62124B6D0061A9BCB10CF9AD5457EEFBB4BF48320F14852AD858B7350D338A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06B04DDA Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(00000006), ref: 06B04E3D

Memory Dump Source

Source File: 00000003.00000002.3051819549.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b00000_RegAsm.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 490602403fcf09fe4fc9e302c9a8e4f19db643d5dd0584c0a7550aa81872b0b8
Instruction ID: 0745f651a63e5aedf21b24de61bb68f9af843d4b970bcb26d2f5a1eb0f43995a
Opcode Fuzzy Hash: 490602403fcf09fe4fc9e302c9a8e4f19db643d5dd0584c0a7550aa81872b0b8
Instruction Fuzzy Hash: D211F2B5D00648CFCB24DF9AD844ACEFFF4EB48324F10845AE918A7210C378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02D0C0F0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 02D0CC5D

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 089dcc9409d8888522761e48bb6fe1e432fced371e160cd54d78b5f9b1f0169d
Instruction ID: 28ce5cea5073fa22f33dfefac0fe6444b3404910fba45398c5d466d1e3f1a5f5
Opcode Fuzzy Hash: 089dcc9409d8888522761e48bb6fe1e432fced371e160cd54d78b5f9b1f0169d
Instruction Fuzzy Hash: 1D1115B19007488FCB20DF9AD588BDEBBF4EB48324F24855AD558A7360C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02D0CC00 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 02D0CC5D

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: e5bf83785d3d38660800b98d52bfed37071223e381c0d18a30ddc530326346a2
Instruction ID: 2e3cab901dd7f0859a85621f71583a79edf9304261af647d54c91cc2334f8792
Opcode Fuzzy Hash: e5bf83785d3d38660800b98d52bfed37071223e381c0d18a30ddc530326346a2
Instruction Fuzzy Hash: 771115B19006488FCB20DF9AD589BCEFFF4EB48324F14855AD518A7360C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02D0C2A1 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02D0C267

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1cf0b195725705ef098ce3f994f3b5588dceb417756adc1b71de5a752d804a4d
Instruction ID: ed57ca469aad844187333c85e4b267639fdd46b57fffa801e4b40887f8279d0c
Opcode Fuzzy Hash: 1cf0b195725705ef098ce3f994f3b5588dceb417756adc1b71de5a752d804a4d
Instruction Fuzzy Hash: FB018C71910208DFDB10DFE9D884BEEBBF4EF49724F14820AE465A72A0C3359841CF61

Uniqueness

Uniqueness Score: -1.00%

Function 06B04DE0 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(00000006), ref: 06B04E3D

Memory Dump Source

Source File: 00000003.00000002.3051819549.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b00000_RegAsm.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: df92c7ec320c1d020f7bfc488250fe29891bda18aba5fe06aebc0b512a9ca0ea
Instruction ID: 70e9226040d2da05d29aa36375faebc90989244ae1b792c5b3817a9fd711ab2c
Opcode Fuzzy Hash: df92c7ec320c1d020f7bfc488250fe29891bda18aba5fe06aebc0b512a9ca0ea
Instruction Fuzzy Hash: 1611FEB1D00648CFCB10CF9AD848ACEFFF4EB48324F10846AD518A7210C378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02D0C2A3 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02D0C267

Memory Dump Source

Source File: 00000003.00000002.3042621439.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d00000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9aee96e839fcf5eb23efae1af003a5da6e08882e06711123a2d353053e3c2f39
Instruction ID: 940b21d226fd5ccd79a55e374f1e31da067a6004e3793912a37b6448b40d22e0
Opcode Fuzzy Hash: 9aee96e839fcf5eb23efae1af003a5da6e08882e06711123a2d353053e3c2f39
Instruction Fuzzy Hash: 2DF0EC325053808FD7219BB8D444389FFE0DF95318F28C45BD085C76A2C2395444CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06B272A5 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06B273F3

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 1b34ff01edd68f1004260fe5eb9ba6c257f1376060aae9866e5ad27b75d29b08
Instruction ID: 3364ae1ed4eb81627f1afe89e7370a5c8c143d3ec8b08d02779bbe8a79682b52
Opcode Fuzzy Hash: 1b34ff01edd68f1004260fe5eb9ba6c257f1376060aae9866e5ad27b75d29b08
Instruction Fuzzy Hash: FD312370B002128FCB69AB74C55466E7BE2FB89200F2445B9D80ADB385DF34CC47CB95

Uniqueness

Uniqueness Score: -1.00%

Function 06B272B8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06B273F3

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: b48b9943cb74f44a91df5b7cba3799d8d934d236e86f4f935fc7a632cd6c2931
Instruction ID: 82e059bdc1c684afae48903415f362bf3d862ebae8dde3b2b1978354a1e65cf0
Opcode Fuzzy Hash: b48b9943cb74f44a91df5b7cba3799d8d934d236e86f4f935fc7a632cd6c2931
Instruction Fuzzy Hash: 55310270B002168FDB69AB74C51466E7AE3FF89600F2085B9D80ADB384EF35DD46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 06B2D39F Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B2D3C4

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: bbc7ab17683c1a713311c3cd64a6033dca8645d81a3ce77b3657cb5b29bf9749
Instruction ID: 6e0c824de612e0532183e10a9dad8b4bdddbdc164340fc7d0b877f6ba783e3bb
Opcode Fuzzy Hash: bbc7ab17683c1a713311c3cd64a6033dca8645d81a3ce77b3657cb5b29bf9749
Instruction Fuzzy Hash: B9F0ECB5E0813ACFEFB48B01EA846AC77F1FF00310F1884A2D809A7188C330E942CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B21220 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00411fe3118d4b313c2d296e89e8b11c2f70e255ae06176de54d1a4213e2daf
Instruction ID: ecb660924b8a334580dd6323f535bd09ac7b6b7945f7b3f72576c36bb1676906
Opcode Fuzzy Hash: c00411fe3118d4b313c2d296e89e8b11c2f70e255ae06176de54d1a4213e2daf
Instruction Fuzzy Hash: E6F18274E002168FDB64DF68D9846AEBBF2EF89310F1485A5DA0AE7394DB31DC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06B2120C Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d1fde108a95e53a51d11efe406f62088610cfedc8e4bc20d1d86ba545d210d3
Instruction ID: 2dd608843fe5970ab448d0ef2d75588dd9b61bc63fd90799b6840c6ed6c35cd9
Opcode Fuzzy Hash: 4d1fde108a95e53a51d11efe406f62088610cfedc8e4bc20d1d86ba545d210d3
Instruction Fuzzy Hash: 1F917F74A001159FDB54EF68D584AADBBF2FF88314F1485A5EA0AE7364DB30DD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B2936B Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0a847492b0e5a05e0fcf249134ae9594487694c0b2220ced2cbd72d9fac837
Instruction ID: eb74aea2da4c7064977843fb018bef2c867bdf7f53c3113db3491e5bc0987565
Opcode Fuzzy Hash: 2b0a847492b0e5a05e0fcf249134ae9594487694c0b2220ced2cbd72d9fac837
Instruction Fuzzy Hash: 1C814B70F002168FDB55EBA9C59476EB7F6AF89300F108569D40EEB395EB30E8468B91

Uniqueness

Uniqueness Score: -1.00%

Function 06B2B2C8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c66d9dda15854a2baea0c77ff49e1528925d7187a5b0ba1101f2a5696d50ef4
Instruction ID: c240739bd2d92a7a93aff24e4517548d09b2382ff8e7f3442f5a06d797cac2f9
Opcode Fuzzy Hash: 6c66d9dda15854a2baea0c77ff49e1528925d7187a5b0ba1101f2a5696d50ef4
Instruction Fuzzy Hash: 9C61B2B1F001224FCB649A7EC89466FBAD7EFC4624B15447AD80EDB364DE65ED0287C2

Uniqueness

Uniqueness Score: -1.00%

Function 06B29337 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724520189ce20bc381748801fd63ce6996fb75deccd47193c6820bd19990dcfe
Instruction ID: fb1c55501c7a0e5371bcce3a2501c99fd8dc6480f6fdf677e65eb5cda7eeed13
Opcode Fuzzy Hash: 724520189ce20bc381748801fd63ce6996fb75deccd47193c6820bd19990dcfe
Instruction Fuzzy Hash: 9E815870B002168FDB55EBAAD49476EB7F2EF89304F108569D40EDB395EB34E8428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06B29390 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f5ccf74f7dcba6ea5b549882f2eadaeb35bb30eecf81255e9edb478f450d39
Instruction ID: 10475d690287aeec0bfa39767baf5068a6572ec2d8a5e6da6c72b93c6d1db956
Opcode Fuzzy Hash: 83f5ccf74f7dcba6ea5b549882f2eadaeb35bb30eecf81255e9edb478f450d39
Instruction Fuzzy Hash: 1D813A70F0021A8FDB55EBA9D59476EB7E6EF89304F108569D40EDB384EB34EC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06B296A4 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e51e1daa796e0843d0fb59d7c395f24828f76134c57a918149939ac1e69f7d
Instruction ID: 634ee0233a668f078b11d48b57c7e2b7887a8e091e89ac9d9b436124fae4a989
Opcode Fuzzy Hash: 55e51e1daa796e0843d0fb59d7c395f24828f76134c57a918149939ac1e69f7d
Instruction Fuzzy Hash: F0915E70E1021A8FDF60DF68C890B9DB7B2FF89310F208599D44DAB295DB70A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06B21748 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e540cf50c98b949be41d325c1d808e4a337fb25ee11b904b144e8f7e3c6177
Instruction ID: 0a29b438a302af6a79af67ca54b6351d26837405d53e36cfd7a317f2d209fc2e
Opcode Fuzzy Hash: a2e540cf50c98b949be41d325c1d808e4a337fb25ee11b904b144e8f7e3c6177
Instruction Fuzzy Hash: 44817E75A002058FDB54DF6DD984B9DBBF6FF88310F14C2A9EA08AB395DB709845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B296B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2686eb7eefbcaa07d379da04cd0b48a9f20611710e038cf0ae90b3cb760059
Instruction ID: 851c03c32572ce69ac8f13025b5f758e5fad40dfa077806f1ded72396b48acdb
Opcode Fuzzy Hash: cb2686eb7eefbcaa07d379da04cd0b48a9f20611710e038cf0ae90b3cb760059
Instruction Fuzzy Hash: F5914E70E1021A8BDF64DF68C880B9DB7B2FF89310F208595D44DAB255DB70A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06B2A710 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e707424b9278d30e7418c6d15d494d9e84c27ebec633e311f7f3e934fa6e30
Instruction ID: e27c5daf2921076fa4efffc6ab46dd4bc54e743f0dea6761296f438ba491dd7b
Opcode Fuzzy Hash: 50e707424b9278d30e7418c6d15d494d9e84c27ebec633e311f7f3e934fa6e30
Instruction Fuzzy Hash: 1751B0B4E102568FDF718B68C4C077EBBF2EB45310F2098A6D06ECB2A6C634E841CB55

Uniqueness

Uniqueness Score: -1.00%

Function 06B2A508 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f1cca82fb6fc55207d6a3b568a06474488734e85cf91056eb0d5cf7757d16f
Instruction ID: 137bee535ac7b1119a87dab159ee3ad00fba69dc6d72215081fb76ef8546085d
Opcode Fuzzy Hash: f4f1cca82fb6fc55207d6a3b568a06474488734e85cf91056eb0d5cf7757d16f
Instruction Fuzzy Hash: 35411DB1E0061A8FDF60CEA9D8C0AAFF7F6FB84310F10496AD25AD7654D330E9458B91

Uniqueness

Uniqueness Score: -1.00%

Function 06B28B80 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110fbb4fe4a041c4334deba6bccf45fcc95e44663117196cdf9e0f9142f189b0
Instruction ID: e9e9d409a47ebff0480b906ea2e60d72ac0cd434146b63c9213d8bcdc5e80a5c
Opcode Fuzzy Hash: 110fbb4fe4a041c4334deba6bccf45fcc95e44663117196cdf9e0f9142f189b0
Instruction Fuzzy Hash: C941CEB5E002269FDB50DFA9E880BEEBBF0EB48310F148169E949E7250D735D845CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06B27168 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220959e05e118d55ecb54b1aa2da95f588089d15c031a83da7715dbcb1721bc2
Instruction ID: 530d045f59d39cd9fa0dbad9b9804745cdc4295b0f19929b7675fae96bf83bc6
Opcode Fuzzy Hash: 220959e05e118d55ecb54b1aa2da95f588089d15c031a83da7715dbcb1721bc2
Instruction Fuzzy Hash: CA318374E102169FCB55DFA9D85469EB7F2FF89300F148569E80AE7350DB31AD42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06B28ED8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f662a60d1b14b9268e5a619ce533367e69127aa7a7ddd707304dc7be437f95
Instruction ID: f7cd6519b29613e6c0489754fb0b477ab5663cd822f1db839aaf42c2be97a4c2
Opcode Fuzzy Hash: 22f662a60d1b14b9268e5a619ce533367e69127aa7a7ddd707304dc7be437f95
Instruction Fuzzy Hash: 1C2123317041614FCB65E73CE05472EBBD7DF84320F2484AAE009CB3A2DE2ADC0683A1

Uniqueness

Uniqueness Score: -1.00%

Function 06B27178 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 896ed9388860658e807ea5c4a91797c1304eecff904e44f7308870eee4b6f343
Instruction ID: 6591bcc3163353ded7ab5ada2013916eb5bebca4fb5ed4b34d234c0c91fcff83
Opcode Fuzzy Hash: 896ed9388860658e807ea5c4a91797c1304eecff904e44f7308870eee4b6f343
Instruction Fuzzy Hash: 3F316370E1022A9BCB59DFA9D49469EB7F2FF89300F148569E80AE7350DB71ED42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06B210F8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d00956945bd6f126a12ecbc03db3306fffaaa438d6eb88406cc03acab929550
Instruction ID: d2bc3d4c2846e3710c8eb5f76ff7ac54ff1b3d310b8d42864ab8df226bda7c99
Opcode Fuzzy Hash: 8d00956945bd6f126a12ecbc03db3306fffaaa438d6eb88406cc03acab929550
Instruction Fuzzy Hash: C131B170E1022A9FDF49DFA8C88079EF7B2FF49304F148655E909AB244DB709886CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B28B90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b09104eb33329ee1fecf1fad8c17cab77575ce601794b688bc568985b42a2c1
Instruction ID: 8f6aaf12f62c4ce2974ff5e73d100162b50c3f72e1dfd8b6a21a977e83e08038
Opcode Fuzzy Hash: 5b09104eb33329ee1fecf1fad8c17cab77575ce601794b688bc568985b42a2c1
Instruction Fuzzy Hash: DA219AB5E002269FDB40DFA9D980BAEBBF1EB48610F108169E909E7354E730D8418B95

Uniqueness

Uniqueness Score: -1.00%

Function 06B21108 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeefe9d2a1ea767f8be6641a3bd7f32b492a34defa48fac1124c9cd8042f3476
Instruction ID: 06043a029fbccc10c396256fdea0d2578fc6cf639ebd3b8464a3b194838e4dca
Opcode Fuzzy Hash: eeefe9d2a1ea767f8be6641a3bd7f32b492a34defa48fac1124c9cd8042f3476
Instruction Fuzzy Hash: 85218570E1022A9BDB55DFA9C84069EF7B2FF95304F14C659E909AB340DB709D86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B20FF8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 433296b46c42249dd5c98f1748aebe2f20ff9e6fa3c28c620561073bbfda2153
Instruction ID: 7b914f07d900123d361d189ba33ef06160fe0b8398532b3797bc5cb5ff3dc525
Opcode Fuzzy Hash: 433296b46c42249dd5c98f1748aebe2f20ff9e6fa3c28c620561073bbfda2153
Instruction Fuzzy Hash: CF21C170E002569BDB49CFA8C8506DEB7F2FF89310F14865AE919FB390DB719846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0119D118 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3040796996.000000000119D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0119D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_119d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7f7796d28286efcb1afd37e9b85802858ccbb116ded8a74c690feab973f984
Instruction ID: d9d293cfbd17f899deed481a8cf85214519a299b12b6ffe8c336112334eb64ab
Opcode Fuzzy Hash: cd7f7796d28286efcb1afd37e9b85802858ccbb116ded8a74c690feab973f984
Instruction Fuzzy Hash: 4C2104B2604240DFDF09DF58EAC4B26BBA5FB84314F24C57DE8094B256C37AD446CA62

Uniqueness

Uniqueness Score: -1.00%

Function 06B2BDE0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac94ddf2ca957617fffc2b33ccd15e700714fe14dde04768420af85e93c5a96
Instruction ID: db070b2d7581693030e492570c8643f16471ed224e64cc072ff63bfe8573fdbe
Opcode Fuzzy Hash: 6ac94ddf2ca957617fffc2b33ccd15e700714fe14dde04768420af85e93c5a96
Instruction Fuzzy Hash: 47210470B200259FDF94EB69E85069EBBF7EB88214F1489A5D509DB384DB31DC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B21008 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47b037bd361f3283875b798342341280ecc896969c9d6dc9c4a81cae2de1ff1
Instruction ID: 8fcb3d442470f6c6f6b632564e841f6282f7b52f28503549cd50b2182933ce33
Opcode Fuzzy Hash: b47b037bd361f3283875b798342341280ecc896969c9d6dc9c4a81cae2de1ff1
Instruction Fuzzy Hash: 3A21D370E002569BCB45CFA8C45059EF7F2FF88300F10861AE909FB340DB709846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B2BDF0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809dd21e1b402d041e8fe2201f252e5db7340b1cdff318b85e458c71f4430049
Instruction ID: c430917c5dce0bdd6e934db66336bd23d56fe19094a1451b25634faeb73693d8
Opcode Fuzzy Hash: 809dd21e1b402d041e8fe2201f252e5db7340b1cdff318b85e458c71f4430049
Instruction Fuzzy Hash: 9A21C070B1012A9BDF94EB69E85069EB7F7EB84214F1489A9D509E7344DB31DC42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06B28958 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb7722969880fabe76e7107bc9e6dc976ccf329d369dcf6d93f4295e5fa7c65
Instruction ID: 2e29aa3a17a40926ba04f91e51ca9214cf47e090186eaef40a8c01ad0c986996
Opcode Fuzzy Hash: edb7722969880fabe76e7107bc9e6dc976ccf329d369dcf6d93f4295e5fa7c65
Instruction Fuzzy Hash: 9421F0B2D01259AFCB00DF9AD884ADEFFB4FB48324F10856AE518B7201C3746554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06B28CA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aea5e27fff6d9107bacf9ed19562702e586f54c70c342ceeb0955649bf8d5ff
Instruction ID: 6430df3ab725bdc760b31c7908b5582cdc7831cb32568945d966a7aff75713e0
Opcode Fuzzy Hash: 3aea5e27fff6d9107bacf9ed19562702e586f54c70c342ceeb0955649bf8d5ff
Instruction Fuzzy Hash: 73116D76F101299FDB549A78D814AAFB3EAEBC9650F00457AD40EE7344EF24DC0A8BD1

Uniqueness

Uniqueness Score: -1.00%

Function 06B2FDD8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d821f475e075f928a8624ecd880c15cad8ccb29c7409f8758ab3fc855da1d65
Instruction ID: ea90ea55cacd27f40bd3cbab136e86074aa19e8f4c7f9b67ed0be5a641f7003d
Opcode Fuzzy Hash: 1d821f475e075f928a8624ecd880c15cad8ccb29c7409f8758ab3fc855da1d65
Instruction Fuzzy Hash: A5019BB07A83638AFBA636B6159437639EDDB44298F0404B9D94FC7293EA59CC00C661

Uniqueness

Uniqueness Score: -1.00%

Function 0119D113 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3040796996.000000000119D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0119D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_119d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de7163a1e12a4c5df783ee0f29f24f6994aba7d146e6d7d26c00eb2d5c80d5
Instruction ID: 6aef368fdbf9007b8db53ceaec2071ff8cd28aad0887e8cb88b835613853a6e4
Opcode Fuzzy Hash: 17de7163a1e12a4c5df783ee0f29f24f6994aba7d146e6d7d26c00eb2d5c80d5
Instruction Fuzzy Hash: C51190B6504280DFDF06CF58D9C4B15BF61FB84314F24C6AAD8494B656C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 06B28140 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f68c597ba4cfb64cd84f11c527121610327534a47fb350799b76f3254dee6d
Instruction ID: 35f3005d953fda81f75d385ff2fdc003ba4380db6d6e121d3dcd0ae23d33c308
Opcode Fuzzy Hash: 01f68c597ba4cfb64cd84f11c527121610327534a47fb350799b76f3254dee6d
Instruction Fuzzy Hash: E6016171E002399EDBA8DBB9CC405DEF7F6EF89310F1085A9D41AE7244DA319A85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B28960 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300415bcdb75cc386a6ed0e69ca06020e4130a381e7749d9967a941b3cefab11
Instruction ID: ce37bcc845011518cf36f3572911745551b00f7d499b4e4d31d788d78e48ad6a
Opcode Fuzzy Hash: 300415bcdb75cc386a6ed0e69ca06020e4130a381e7749d9967a941b3cefab11
Instruction Fuzzy Hash: F611CEB1D01259ABCB00DF9AD884ADEFFB4FB48324F10852AE918A7200C374A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06B28EE8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c4c011b6481252508e6ccf595c1de04ea92f676b7d32617954fa7b16bc1594
Instruction ID: 650492c0ddcc935747d01d87f8eb5fd7a61c6110f552e5b222e13eebab88d037
Opcode Fuzzy Hash: e0c4c011b6481252508e6ccf595c1de04ea92f676b7d32617954fa7b16bc1594
Instruction Fuzzy Hash: F0018B71B101250FDBA4A66E940072BE3DBDBC9A20F14983AE40EC7344DA65DC024385

Uniqueness

Uniqueness Score: -1.00%

Function 06B2F3E0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 631328038297bd8093998af5b32a91c203133b026f01c35c91590f177a66d6e3
Instruction ID: 7a9fa773f0725913d1b4a8e5a54ca406de260df93de61f1921d19a94bce2aec2
Opcode Fuzzy Hash: 631328038297bd8093998af5b32a91c203133b026f01c35c91590f177a66d6e3
Instruction Fuzzy Hash: 4201F730B441654FDB65EB7CE850B3B7BEAEB4A614F108468E11EC7355DA11DC02C795

Uniqueness

Uniqueness Score: -1.00%

Function 06B28C90 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c5122c5c16aab7af690746c00a56f1ec97ff11285a4ce8923ada53d42a81dc
Instruction ID: efa919534db8d386a97a411ee4f5bfa10b6fcfc33869521063fc60351c136a08
Opcode Fuzzy Hash: 31c5122c5c16aab7af690746c00a56f1ec97ff11285a4ce8923ada53d42a81dc
Instruction Fuzzy Hash: E2018F76F100255FEB549AB8DC107EF73AAABC8610F00417AD50EE7244EF2498064B92

Uniqueness

Uniqueness Score: -1.00%

Function 06B2F3F0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e872f0685e601045cffde165eed8bddbc6ecc066a3d4885708ab41895241778
Instruction ID: e45f0a64d19b0ed0af6ca3e0a72c62c16f5aaff5d2e0e97100c71b96df6451d1
Opcode Fuzzy Hash: 5e872f0685e601045cffde165eed8bddbc6ecc066a3d4885708ab41895241778
Instruction Fuzzy Hash: 2201A470F401264FDBA4EA7DE950B3B73EAEB89714F108578E51EC7354EA21EC428785

Uniqueness

Uniqueness Score: -1.00%

Function 06B2B548 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2363aa985f4e95c4d0e36d91139f61594fb93fd7f453aa04a1c64870a7923426
Instruction ID: aa1176dd1e168371ef647c6b43a8b827cdd48b3113ba42ca389886d21a7989c1
Opcode Fuzzy Hash: 2363aa985f4e95c4d0e36d91139f61594fb93fd7f453aa04a1c64870a7923426
Instruction Fuzzy Hash: 2CE022B0E0801A9BDF50CEB8E96439A3BEADB41308F3049E5D01CCB251E636CA118340

Uniqueness

Uniqueness Score: -1.00%

Function 06B2B558 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01286a41a581f462f2cd16cd00c9152f092291e3d396a91bfb7fb991edc7bf5d
Instruction ID: 4fcf6d7e0ef8c29a8a01b2c0828a647ec094cd47e95e15ab708a359e9b977cb5
Opcode Fuzzy Hash: 01286a41a581f462f2cd16cd00c9152f092291e3d396a91bfb7fb991edc7bf5d
Instruction Fuzzy Hash: 8CE0C2F0F1011EABDF50DAB4C95575B73ECD701308F2089E5D50CCB240E676CA019780

Uniqueness

Uniqueness Score: -1.00%

Function 06B2FDA1 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0ad6b2d677ea7607adc91f48c6f8b26c061f296f37e05e8afc3d7e2bbc7ded
Instruction ID: 5256dfe4850c716cab47ada5489e78af688c5bc8e80b12d16b2a22abe44f60f3
Opcode Fuzzy Hash: dd0ad6b2d677ea7607adc91f48c6f8b26c061f296f37e05e8afc3d7e2bbc7ded
Instruction Fuzzy Hash: 23C0125000E2605FE7022B204D00ADA3B259F512C0B4A01C2A5409A063C2188A59ABB2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06B2C778 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B2C8C2
$^q, xrefs: 06B2C89D
$^q, xrefs: 06B2C8CE
$^q, xrefs: 06B2CD03
$^q, xrefs: 06B2CCED
$^q, xrefs: 06B2CC5A
$^q, xrefs: 06B2CC4E
$^q, xrefs: 06B2CCF9
$^q, xrefs: 06B2CD0F
$^q, xrefs: 06B2C891

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: e67ca6df1ede5f23a1751bdf828db83c66cfa2c9be99e7aa138e9f6c58e2a2c7
Instruction ID: 23272cb335ecc79bb92df343297c59722530f7d048ed43bbd4c0bb0471e6c45b
Opcode Fuzzy Hash: e67ca6df1ede5f23a1751bdf828db83c66cfa2c9be99e7aa138e9f6c58e2a2c7
Instruction Fuzzy Hash: CE122E70E4022A8FDBA4DF65C85469DBBF2FF89704F2085A9D409AB365DB309D85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06B2FA18 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B2FB75
$^q, xrefs: 06B2FBCA
$^q, xrefs: 06B2FB1A
$^q, xrefs: 06B2FB0E
$^q, xrefs: 06B2FB94
$^q, xrefs: 06B2FBD6
$^q, xrefs: 06B2FBA0
$^q, xrefs: 06B2FB69

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: fedc6956ae19fd737055dc1bd4c2775b5467c629e84764febcc593a4df037704
Instruction ID: 5681f0be3d3f06a8eeea0476ecc98909cf11130fa4cf7d3296baac9971a88c0c
Opcode Fuzzy Hash: fedc6956ae19fd737055dc1bd4c2775b5467c629e84764febcc593a4df037704
Instruction Fuzzy Hash: 3D91AE70E8021ADFEB68DB65D598BBEB7FAEF44300F108569D4099B3A4CB349C45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B2C178 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B2C4B4
$^q, xrefs: 06B2C4C0
$^q, xrefs: 06B2C614
$^q, xrefs: 06B2C68C
.5vq, xrefs: 06B2C1D3
$^q, xrefs: 06B2C680
$^q, xrefs: 06B2C45A

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 5ee57559a3392b8cd906c5fbeedf1eba8b62c94872e3375e03d1da76cc86f3c2
Instruction ID: 1a03dc62863f26ebf51563e302a082c4fbe8224ce974ca5232e96f6239a47da6
Opcode Fuzzy Hash: 5ee57559a3392b8cd906c5fbeedf1eba8b62c94872e3375e03d1da76cc86f3c2
Instruction Fuzzy Hash: 9BF13C70A00219CFDB99EB65C594B6EBBB2FF84300F108569D41A9B3A9DB31DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B2D4B0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B2D70A
$^q, xrefs: 06B2D77B
$^q, xrefs: 06B2D716
$^q, xrefs: 06B2D76F

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: bf98f317b16c8a6db5483f0c86c1ac7276dae5d1dd8650f543f907bbb4c5eb58
Instruction ID: fc509faa75b9e89a871865daae58542fc9d19ec624521b66956c61c2db0267b2
Opcode Fuzzy Hash: bf98f317b16c8a6db5483f0c86c1ac7276dae5d1dd8650f543f907bbb4c5eb58
Instruction Fuzzy Hash: B8B16B70E002198FDB58EF69D5847AEB7F2EF88304F249969D0099B395DB34DC86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B2D8C8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B2D953
LR^q, xrefs: 06B2D9BB
$^q, xrefs: 06B2D947
LR^q, xrefs: 06B2DA0A

Memory Dump Source

Source File: 00000003.00000002.3051879278.0000000006B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b20000_RegAsm.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: f75cb4364ec0a5a63d2c8fbe752ee2020c925f8840621cf5f0dbc98a88544541
Instruction ID: f78ab57cfd6c602d1b41653424d46044524a2a7874a1aab7c91f1a6dd92989c1
Opcode Fuzzy Hash: f75cb4364ec0a5a63d2c8fbe752ee2020c925f8840621cf5f0dbc98a88544541
Instruction Fuzzy Hash: A251D570F002269FDB58EF39D854A6A77E6FF85700F1486A8E5099B3A6DB30EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cbsBVT.exePID: 1068, Parent PID: 2580COMMON

Executed Functions

Function 02460E30 Relevance: 6.7, Strings: 5, Instructions: 440COMMON

Download Yara Rule

Strings

D@x, xrefs: 02461141
<Qx, xrefs: 02461039
D@x, xrefs: 024611CB
D@x, xrefs: 024610FC
D@x, xrefs: 02461186

Memory Dump Source

Source File: 00000008.00000002.1948748510.0000000002460000.00000040.00000800.00020000.00000000.sdmp, Offset: 02460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2460000_cbsBVT.jbxd

Similarity

API ID:
String ID: <Qx$D@x$D@x$D@x$D@x
API String ID: 0-2174297539
Opcode ID: c3436d99f62021db991746c96c1aebf382d80664f469d4d14d182ba0355fd524
Instruction ID: 7fe300d174e57095987a5701dfe0ae7c0257f1728c738c35c29431ecdd371676
Opcode Fuzzy Hash: c3436d99f62021db991746c96c1aebf382d80664f469d4d14d182ba0355fd524
Instruction Fuzzy Hash: 6F029030A006159FCB15DF68C888AAEBBF6FF84344B24C569D40E9B355DB75EC42CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02461498 Relevance: 2.6, Strings: 2, Instructions: 54COMMON

Download Yara Rule

Strings

D@x, xrefs: 024614C5
D@x, xrefs: 024614D7

Memory Dump Source

Source File: 00000008.00000002.1948748510.0000000002460000.00000040.00000800.00020000.00000000.sdmp, Offset: 02460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2460000_cbsBVT.jbxd

Similarity

API ID:
String ID: D@x$D@x
API String ID: 0-498500616
Opcode ID: e3754bf166b71890747d70b68c77e3f123bb0cd588c9ccdc64aec9962e8ca1a1
Instruction ID: a4e16dab2fcd599b67a22db69db2a4f1d6cea8ad527af57fa730fceca224916d
Opcode Fuzzy Hash: e3754bf166b71890747d70b68c77e3f123bb0cd588c9ccdc64aec9962e8ca1a1
Instruction Fuzzy Hash: D501C431F401049FC705ABB9D8197AE7FAAEF45644F1080AAD20D9B390CE38ED01CB96

Uniqueness

Uniqueness Score: -1.00%

Function 024608B0 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

tP^q, xrefs: 0246095E

Memory Dump Source

Source File: 00000008.00000002.1948748510.0000000002460000.00000040.00000800.00020000.00000000.sdmp, Offset: 02460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2460000_cbsBVT.jbxd

Similarity

API ID:
String ID: tP^q
API String ID: 0-2862610199
Opcode ID: c13cd706e28112ea1a3cd6506c97796792e79aa7a0c6c20624adfd782ff90ae7
Instruction ID: 47ffcff5cd0ed54d3f251cdebcd73b557f202b6a4c60db851841b80ca6bcdb83
Opcode Fuzzy Hash: c13cd706e28112ea1a3cd6506c97796792e79aa7a0c6c20624adfd782ff90ae7
Instruction Fuzzy Hash: AA210C713405018FCB59EB38D45892D7BE2AF8AA1931604E9E50ACF372DF35DC46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02461539 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

8bq, xrefs: 02461555

Memory Dump Source

Source File: 00000008.00000002.1948748510.0000000002460000.00000040.00000800.00020000.00000000.sdmp, Offset: 02460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2460000_cbsBVT.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: 57fe4a3729d204d577e8e0fdf4d2fa9c7b987b5da857b3bf41fe8329ef0d3a97
Instruction ID: d9a51a1a7a526a982db94a93525195bdb3bc054ed215fc1413c3a239443ff800
Opcode Fuzzy Hash: 57fe4a3729d204d577e8e0fdf4d2fa9c7b987b5da857b3bf41fe8329ef0d3a97
Instruction Fuzzy Hash: D1F0A3711407102BC301B654E42477E7A8B5B85355F008436D10E87358DF289A0247D3

Uniqueness

Uniqueness Score: -1.00%

Function 024609B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1948748510.0000000002460000.00000040.00000800.00020000.00000000.sdmp, Offset: 02460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2460000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bbd5aa9dc6aabb76e98a084f92dcc4fa7369187c089996d9cda5b7d73a8d0b5
Instruction ID: 0d88698857c7539ac2b891eba28ca923353af9c61edd0e1d71b6b6f4171fe9b2
Opcode Fuzzy Hash: 7bbd5aa9dc6aabb76e98a084f92dcc4fa7369187c089996d9cda5b7d73a8d0b5
Instruction Fuzzy Hash: 9AC15E34200305CFE709DF24D498B267BE6FF48304F649869E8168B369DB75EC86CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02461348 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1948748510.0000000002460000.00000040.00000800.00020000.00000000.sdmp, Offset: 02460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2460000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f9fa87203dffdb228c2291b6bf2aaf1a77485af36a7ef5bacaefbd543f8561
Instruction ID: fbd5b47f782c6bfc6569d2600f4465f2e44e1c866e874b036bc8764510e3ea89
Opcode Fuzzy Hash: f3f9fa87203dffdb228c2291b6bf2aaf1a77485af36a7ef5bacaefbd543f8561
Instruction Fuzzy Hash: 1E01FE76B006109FDB259B25EC5CD2F3B95FB89A607154556E80FCB318CB71DC41C792

Uniqueness

Uniqueness Score: -1.00%

Function 02461421 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1948748510.0000000002460000.00000040.00000800.00020000.00000000.sdmp, Offset: 02460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2460000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0d4d6d39a7c55e6f56f989992ead25e9639c830ff745afc406f7d1cae0580d
Instruction ID: 7861d525c6e6e473ad8c7bc276dbac2443cbdc55939f4f75d5e2adf8e7ac5165
Opcode Fuzzy Hash: 8e0d4d6d39a7c55e6f56f989992ead25e9639c830ff745afc406f7d1cae0580d
Instruction Fuzzy Hash: ADF05272B053282FC7081B3A5C54AAB3BAEEFC6224310487AE00DD7351ED388C0387E6

Uniqueness

Uniqueness Score: -1.00%

Function 02460857 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1948748510.0000000002460000.00000040.00000800.00020000.00000000.sdmp, Offset: 02460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2460000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b81b4d92d5f4599710a9062edafd031ee07e0cac43f0c686482ca69ec4800e2
Instruction ID: 8d29ed764b67e9282c50b8b271d8efd944c4d77b4e9e67b474200ad1157fe4a5
Opcode Fuzzy Hash: 6b81b4d92d5f4599710a9062edafd031ee07e0cac43f0c686482ca69ec4800e2
Instruction Fuzzy Hash: F4F09272B48389AFC705DFBA98486DA7FFDFE46126B15C0EBE008D3212E6749901C755

Uniqueness

Uniqueness Score: -1.00%

Function 02460868 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1948748510.0000000002460000.00000040.00000800.00020000.00000000.sdmp, Offset: 02460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2460000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e040ea89a792b8ff44d291b522d50d252d166ddb64a7b775686b0ec5212f4f6
Instruction ID: c71ae7d757774f23b3be66b7e67c88c01b43e7a687520c2ee4b23b1fc45f1bce
Opcode Fuzzy Hash: 7e040ea89a792b8ff44d291b522d50d252d166ddb64a7b775686b0ec5212f4f6
Instruction Fuzzy Hash: 7BE0ED76A4421AAF8B04EFA9A8485DA7BE9FA48162B20806AE009D2210EAB555418794

Uniqueness

Uniqueness Score: -1.00%

Function 024613E0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1948748510.0000000002460000.00000040.00000800.00020000.00000000.sdmp, Offset: 02460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2460000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8e106a501ed7008b6376fa5fb1b63ee4397100a70db5b3a1f568f7c7cd48a1
Instruction ID: a45d7ce4bffe1ce24c18c1f80bd0b621b4eeb0e8c2d0140072b202e9314636d0
Opcode Fuzzy Hash: 5a8e106a501ed7008b6376fa5fb1b63ee4397100a70db5b3a1f568f7c7cd48a1
Instruction Fuzzy Hash: 0DE0C2346887C44FD7069F24E92CB253FE5EB05215B5850D5E04D8B36BCA686C41C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 02461489 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1948748510.0000000002460000.00000040.00000800.00020000.00000000.sdmp, Offset: 02460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2460000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e462de596e4f860d4967f0b3fe4466890a5db5b8729ff0587feafe42ce85cb4e
Instruction ID: 20191e1d35e9f5d8a9dfede41554497e2a20d8a2bd36142bc38441353d9df189
Opcode Fuzzy Hash: e462de596e4f860d4967f0b3fe4466890a5db5b8729ff0587feafe42ce85cb4e
Instruction Fuzzy Hash: 23D0A772E8CA546BCB0196B16C0D39D3F649B03150B0440BBD44CC7291E60C991483D3

Uniqueness

Uniqueness Score: -1.00%

Function 02461590 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1948748510.0000000002460000.00000040.00000800.00020000.00000000.sdmp, Offset: 02460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2460000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78f1af199a4cdde3b8bd14f188ef4ae7d5bb9d81265f31cd15e592594c31ab5
Instruction ID: 4406ad009b8cd6cd7de8df7945a1b23ccf1b2724fac88b1bb17537b26ab11db5
Opcode Fuzzy Hash: c78f1af199a4cdde3b8bd14f188ef4ae7d5bb9d81265f31cd15e592594c31ab5
Instruction Fuzzy Hash: 8CD012A194D3C20DE71347314808324BF511F0210CF6814CBC19D4B3B3E3680884C76B

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cbsBVT.exePID: 6760, Parent PID: 2580COMMON

Executed Functions

Function 028E08B0 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

tP^q, xrefs: 028E095E

Memory Dump Source

Source File: 0000000A.00000002.2028707872.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_28e0000_cbsBVT.jbxd

Similarity

API ID:
String ID: tP^q
API String ID: 0-2862610199
Opcode ID: 4826ce2d445ff3576d9f32e1b239790539d1f510cdeef0f62989dbdaf0f67dec
Instruction ID: 6f291da9087284574fde664248573389776ea8d7b11270e356309c30f20aadee
Opcode Fuzzy Hash: 4826ce2d445ff3576d9f32e1b239790539d1f510cdeef0f62989dbdaf0f67dec
Instruction Fuzzy Hash: 862118753405118FCB49EF38D5A8A2D77E2AF89A1932504A8E40ACF371DF35DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 028E1539 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

8bq, xrefs: 028E1555

Memory Dump Source

Source File: 0000000A.00000002.2028707872.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_28e0000_cbsBVT.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: 8ac730c0b21a21f45587b09cdeb06cca2852dc354c2f1ac1c57f9d9c154d7ae7
Instruction ID: 37294419c2cda682754426176bca2f4a757ecda1de054534bb7ebbaf64b4ba72
Opcode Fuzzy Hash: 8ac730c0b21a21f45587b09cdeb06cca2852dc354c2f1ac1c57f9d9c154d7ae7
Instruction Fuzzy Hash: 2EF020BA9007104FC312A6A0E0506AF77E2BB99348B05012AD48ECB294EE2589424F81

Uniqueness

Uniqueness Score: -1.00%

Function 028E0E30 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2028707872.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_28e0000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4c708c3308d74a55aa1ad74de8686fc5da87b450cb6ed1ee09dbdd2621017a
Instruction ID: 5c1681d7caed3f5ad15e87b57cd446bbf1c788f4ed6f8ef9693c8766d3bf0e1c
Opcode Fuzzy Hash: 3e4c708c3308d74a55aa1ad74de8686fc5da87b450cb6ed1ee09dbdd2621017a
Instruction Fuzzy Hash: 85029E74A002159FCB14DF68C984AAEBBF2FF85304B148A68D44ADF395DB35EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 028E09B0 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2028707872.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_28e0000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c6ebeb64f9ddd232352818ea6df22bde7392f18a0b03e3907f93d101f78c63
Instruction ID: 6e81c82c0914f1cc08118284fd011d14ed0cdc3f5db24fa97581043293f5878d
Opcode Fuzzy Hash: a4c6ebeb64f9ddd232352818ea6df22bde7392f18a0b03e3907f93d101f78c63
Instruction Fuzzy Hash: 61C16F3C200305CFDB15DF24D544A6A7BA2FB89308F548868E84ADF758DBB6ED85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 028E1498 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2028707872.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_28e0000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d15d371b70d0c280231e72f0d89a403a410b38373d6293c8a616cc8cc5fd69
Instruction ID: c90231febee6aac85b39657cb5596a2303c9a1f4a0f88b7c4ac08b053eebdbc8
Opcode Fuzzy Hash: 18d15d371b70d0c280231e72f0d89a403a410b38373d6293c8a616cc8cc5fd69
Instruction Fuzzy Hash: 1F01F571F001149FCB54ABB8D8156AE7FB6EF85340F1080AAE509DB380DE399D01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 028E1421 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2028707872.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_28e0000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b3d7a3e548f3a97c8bfddbd275aa2111710faaff9ed0192868b279f0a947e4
Instruction ID: af4f4d9786663c4c36de8ac54b190bf4400ece352e3383eb0df70f2904dbdca2
Opcode Fuzzy Hash: 01b3d7a3e548f3a97c8bfddbd275aa2111710faaff9ed0192868b279f0a947e4
Instruction Fuzzy Hash: 96F0BEB2B003244FD70856789C946AB3BAAEBC5220705087EE009D7350ED798C4283A4

Uniqueness

Uniqueness Score: -1.00%

Function 028E0868 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2028707872.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_28e0000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf52cbe72a74324597bdfc7cb914ff3126f64b5a7cd91e2f1fa8df9837b23a6
Instruction ID: fc4d71cca20777b550aed503362965fd2110e59c86819eb716e9857bd1ce4cda
Opcode Fuzzy Hash: dbf52cbe72a74324597bdfc7cb914ff3126f64b5a7cd91e2f1fa8df9837b23a6
Instruction Fuzzy Hash: D1E06D37A08219AF8B14EFE9A8485DB7BEDEA48222B008466E00DD2204FAB654809790

Uniqueness

Uniqueness Score: -1.00%

Function 028E0857 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2028707872.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_28e0000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d65fbb0412b55e4d151a643ae4b5821b79148c970ce5e838ffb8a4a66f977b
Instruction ID: 9dce83c725d87a478b10651778892ce0df30628bd1cdff83b791d89661ef0cdb
Opcode Fuzzy Hash: 52d65fbb0412b55e4d151a643ae4b5821b79148c970ce5e838ffb8a4a66f977b
Instruction Fuzzy Hash: F4E09236A182189FCB04DFF59C487DBBFE9DF45215B0484AAE00DE3200E67195419711

Uniqueness

Uniqueness Score: -1.00%

Function 028E1489 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2028707872.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_28e0000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5557588ca4a6885b4db3eb8aaea5ad5d074c20ede43667f7de12fa3c167ef8dd
Instruction ID: 146d086b858c83f3cdec239e5a2733c014c1dcae6e5b63e8e6be19ec98c727de
Opcode Fuzzy Hash: 5557588ca4a6885b4db3eb8aaea5ad5d074c20ede43667f7de12fa3c167ef8dd
Instruction Fuzzy Hash: E0D0A772A047148BCB1056E5AC091CE3F74DF022A4B0640AAD488C7181E7689D1487D6

Uniqueness

Uniqueness Score: -1.00%

Function 028E13E0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2028707872.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_28e0000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae832ca47f2279eb4d9e190ee4a02c0bc28a3e2c7baa240bceb6f04d265e025
Instruction ID: 0e5e7e0a485aa698e49c57ceafd394600ad476bd25f592613606b5488e406ed2
Opcode Fuzzy Hash: fae832ca47f2279eb4d9e190ee4a02c0bc28a3e2c7baa240bceb6f04d265e025
Instruction Fuzzy Hash: CCE0C23C2083808FC7059F20EB2865A3FB2AF06209B0504D9E0C98FA6ACA789880CF05

Uniqueness

Uniqueness Score: -1.00%

Function 028E1590 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2028707872.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_28e0000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c968fbdf0b63ed184fac6215ecd8d691b80108219037ea1b9a825754c15b39d
Instruction ID: 8932749ccb6c620e8b02ecdcf21c779fb674dce5499a3c4f28a52d1ceeb7db22
Opcode Fuzzy Hash: 6c968fbdf0b63ed184fac6215ecd8d691b80108219037ea1b9a825754c15b39d
Instruction Fuzzy Hash: 66B09277054B421BE36219508DAB3873654A760208BDD0468448682297F1CA948141CB

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hesaphareketi-01.pdf.SCR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cbsBVT.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hesaphareketi-01.pdf.SCR.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjzmj1vw.pxj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gvhm5xf5.uqc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_py0uxfau.tk4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xlcbossz.gmt.ps1

C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Windows Analysis Report
hesaphareketi-01.pdf.SCR.exe

Function 04B7C7B0 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Function 04B7C7C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 04B7CE09 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 04B7CE10 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 04B798B0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 04B7A998 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre