Windows Analysis Report
lQV0SgKoqe.exe

Overview

General Information

Sample name: lQV0SgKoqe.exe
renamed because original name is a hash value
Original sample name: 918504ede26bb9a3aa315319da4d3549d64531afba593bfad71a653292899fec.exe
Analysis ID: 1428494
MD5: 76ffbb43f6ac003cacf391b95d462362
SHA1: 03c94534ae4471187d9ab10ad0802deb51103de1
SHA256: 918504ede26bb9a3aa315319da4d3549d64531afba593bfad71a653292899fec
Infos:

Detection

Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Contains functionality to hide the console window
Deletes shadow drive data (may be related to ransomware)
Found Tor onion address
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Overwrites Mozilla Firefox settings
Tries to harvest and steal browser information (history, passwords, etc)
AV process strings found (often used to terminate AV products)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
IP address seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious desktop.ini Action
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: lQV0SgKoqe.exe ReversingLabs: Detection: 80%
Source: lQV0SgKoqe.exe Virustotal: Detection: 77% Perma Link
Machine Learning detection for sample
Source: lQV0SgKoqe.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00111A40 CryptBinaryToStringA,CryptBinaryToStringA, 0_2_00111A40
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00112B90 CryptCreateHash,CryptHashData,CryptDestroyHash,CryptDeriveKey,CryptDestroyHash,CryptDestroyHash, 0_2_00112B90
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00111520 CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptReleaseContext,CryptSetKeyParam,CryptDestroyKey,CryptReleaseContext,CryptGetKeyParam,CryptDestroyKey,CryptReleaseContext,CryptSetKeyParam,CryptDestroyKey,CryptReleaseContext, 0_2_00111520
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00111D80 CreateFileA,_strcat,GetFileSize,ReadFile,FindCloseChangeNotification,DeleteFileA,CryptReleaseContext,CreateFileA,WriteFile,FindCloseChangeNotification, 0_2_00111D80
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_001116A0 CryptEncrypt,CryptDestroyKey,CryptDestroyKey,_memcpy_s,CryptEncrypt,CryptDestroyKey,CryptDestroyKey, 0_2_001116A0
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00111820 CryptDestroyKey,CryptDestroyKey,_memcpy_s,CryptDecrypt,CryptDestroyKey, 0_2_00111820
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00111950 CryptDestroyKey,CryptReleaseContext, 0_2_00111950
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00111990 CryptBinaryToStringW,CryptBinaryToStringW, 0_2_00111990
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00111AF0 CryptStringToBinaryW,CryptStringToBinaryW, 0_2_00111AF0
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00111BB0 CryptStringToBinaryA,CryptStringToBinaryA, 0_2_00111BB0
Uses 32bit PE files
Source: lQV0SgKoqe.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: lQV0SgKoqe.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00111F70 FindFirstFileA,GetFullPathNameA,SetCurrentDirectoryA,SetCurrentDirectoryA,GetFullPathNameA,FindNextFileA,GetLastError,FindClose, 0_2_00111F70
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Adobe\Acrobat\DC\Collab Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Adobe\Acrobat\ Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Adobe\ Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Adobe\Acrobat\DC Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Adobe\Acrobat Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Adobe\Acrobat\DC\ Jump to behavior

Networking
barindex
Found Tor onion address
Source: lQV0SgKoqe.exe, 00000000.00000002.1845298885.0000000003E30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: <h1><a style = "color:#ffffff;" href = "http://aa2stvtvgxo6mv5y.onion.to/ransomed.php">Help | Aiuto | Au secours | Ayuda | Hilfe</a></h1>
Source: lQV0SgKoqe.exe, 00000000.00000002.1845298885.0000000003E30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: <h2>A : The only method accepted is <strong style = "color:#ff6000">Bitcoin</strong> follow this <a style = "color:#ff6000" href = "http://aa2stvtvgxo6mv5y.onion.to/payments.php?id=%s">link</a> to start pay.</h2>
Source: lQV0SgKoqe.exe, 00000000.00000002.1843663234.000000000012C000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: <h1><a style = "color:#ffffff;" href = "http://aa2stvtvgxo6mv5y.onion.to/ransomed.php">Help | Aiuto | Au secours | Ayuda | Hilfe</a></h1>
Source: lQV0SgKoqe.exe, 00000000.00000002.1843663234.000000000012C000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: <h2>A : The only method accepted is <strong style = "color:#ff6000">Bitcoin</strong> follow this <a style = "color:#ff6000" href = "http://aa2stvtvgxo6mv5y.onion.to/payments.php?id=%s">link</a> to start pay.</h2>
Source: lQV0SgKoqe.exe, 00000000.00000000.1635861529.000000000012C000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: <h1><a style = "color:#ffffff;" href = "http://aa2stvtvgxo6mv5y.onion.to/ransomed.php">Help | Aiuto | Au secours | Ayuda | Hilfe</a></h1>
Source: lQV0SgKoqe.exe, 00000000.00000000.1635861529.000000000012C000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: <h2>A : The only method accepted is <strong style = "color:#ff6000">Bitcoin</strong> follow this <a style = "color:#ff6000" href = "http://aa2stvtvgxo6mv5y.onion.to/payments.php?id=%s">link</a> to start pay.</h2>
Source: lQV0SgKoqe.exe String found in binary or memory: <h1><a style = "color:#ffffff;" href = "http://aa2stvtvgxo6mv5y.onion.to/ransomed.php">Help | Aiuto | Au secours | Ayuda | Hilfe</a></h1>
Source: lQV0SgKoqe.exe String found in binary or memory: <h2>A : The only method accepted is <strong style = "color:#ff6000">Bitcoin</strong> follow this <a style = "color:#ff6000" href = "http://aa2stvtvgxo6mv5y.onion.to/payments.php?id=%s">link</a> to start pay.</h2>
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.117.118.44 34.117.118.44
May check the online IP address of the machine
Source: unknown DNS query: name: www.myexternalip.com
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /raw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: AdobeAcrobat Update/21.0Host: www.myexternalip.com
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: www.myexternalip.com
Source: lQV0SgKoqe.exe String found in binary or memory: http://aa2stvtvgxo6mv5y.onion.to/payments.php?id=%s
Source: lQV0SgKoqe.exe String found in binary or memory: http://aa2stvtvgxo6mv5y.onion.to/ransomed.php
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.00000000034C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.00000000034C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.00000000034C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.00000000034C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.00000000034C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.00000000034C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.00000000034C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: lQV0SgKoqe.exe String found in binary or memory: http://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Source: lQV0SgKoqe.exe String found in binary or memory: http://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.00000000034C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.00000000034C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.4.dr String found in binary or memory: http://upx.sf.net
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.amazon.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.google.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.live.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.nytimes.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.reddit.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.twitter.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.wikipedia.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.youtube.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.00000000034C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.00000000034C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://MD8.mozilla.org/1/m
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.c
Source: lQV0SgKoqe.exe String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://allegro.pl/
Source: lQV0SgKoqe.exe, 00000000.00000002.1845298885.0000000003C30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: lQV0SgKoqe.exe, 00000000.00000002.1845298885.0000000003C30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp, lQV0SgKoqe.exe, 00000000.00000002.1846141652.0000000004035000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: lQV0SgKoqe.exe, 00000000.00000002.1845298885.0000000003C30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: lQV0SgKoqe.exe, 00000000.00000002.1845298885.0000000003C30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: lQV0SgKoqe.exe, 00000000.00000002.1845298885.0000000003C30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.000000000348A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: lQV0SgKoqe.exe, 00000000.00000002.1845007098.000000000374B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mo
Source: lQV0SgKoqe.exe, 00000000.00000002.1846774982.000000000481C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: lQV0SgKoqe.exe, 00000000.00000002.1846774982.000000000481C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.ca/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1845298885.0000000003C30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp, lQV0SgKoqe.exe, 00000000.00000002.1846141652.0000000004035000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.de/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.fr/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bbc.co.uk/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ctrip.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.co.uk/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.de/
Source: lQV0SgKoqe.exe, 00000000.00000002.1845298885.0000000003C30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/
Source: lQV0SgKoqe.exe, 00000000.00000002.1844561467.0000000003520000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=&
Source: lQV0SgKoqe.exe, 00000000.00000002.1844561467.0000000003520000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=&metrics#search.engine.default.verified
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ifeng.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: lQV0SgKoqe.exe, 00000000.00000002.1845007098.000000000374B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846774982.000000000481C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: lQV0SgKoqe.exe, 00000000.00000002.1845007098.000000000374B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846774982.000000000481C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: lQV0SgKoqe.exe, 00000000.00000002.1845298885.0000000003CDA000.00000004.00000020.00020000.00000000.sdmp, lQV0SgKoqe.exe, 00000000.00000002.1844561467.0000000003551000.00000004.00000020.00020000.00000000.sdmp, lQV0SgKoqe.exe, 00000000.00000002.1845007098.000000000374B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846774982.000000000481C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: lQV0SgKoqe.exe, 00000000.00000002.1846774982.000000000481C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: lQV0SgKoqe.exe, 00000000.00000002.1846774982.000000000481C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.wykop.pl/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: lQV0SgKoqe.exe, 00000000.00000002.1846141652.000000000403B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/

Spam, unwanted Advertisements and Ransom Demands
barindex
Deletes shadow drive data (may be related to ransomware)
Source: lQV0SgKoqe.exe Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet
Source: lQV0SgKoqe.exe, 00000000.00000002.1845298885.0000000003E30000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet
Source: lQV0SgKoqe.exe, 00000000.00000002.1845298885.0000000003E30000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: AabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZUSERNAMEC:\Users\vssadmin.exe Delete Shadows /All /Quiet.AlcatrazConsoleWindowClassWindows_XPWindows_XPWindows_XP_SP1Windows_XP_SP1Windows_XP_SP2Windows_XP_SP2Windows_XP_SP3Windows_XP_SP3Windows_VistaWindows_VistaWindows_Vista_SP1Windows_Vista_SP1Windows_Vista_SP2Windows_Vista_SP2Windows_7Windows_7Windows_7_SP1Windows_7_SP1Windows_8Windows_8Windows_8.1Windows_8.1Windows_10Windows_10Windows_ServerWindows_ServerWindows_ClientWindows_ClientUSERNAME/index.php?ip=%s&id=%s&botid=%s&username=%s&key=%s%s&os=%s&count=%dAdobe Updater/33.4onion.toGETHost:aa2stvtvgxo6mv5y.onion.toOKAdobeAcrobat Update/21.0www.myexternalip.com/rawGETUser-Agent:Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\*...AppData\Desktop\ransomed.html<html lang="en">
Source: lQV0SgKoqe.exe, 00000000.00000002.1843663234.000000000012C000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet
Source: lQV0SgKoqe.exe, 00000000.00000002.1843663234.000000000012C000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZUSERNAMEC:\Users\vssadmin.exe Delete Shadows /All /Quiet.AlcatrazConsoleWindowClassWindows_XPWindows_XPWindows_XP_SP1Windows_XP_SP1Windows_XP_SP2Windows_XP_SP2Windows_XP_SP3Windows_XP_SP3Windows_VistaWindows_VistaWindows_Vista_SP1Windows_Vista_SP1Windows_Vista_SP2Windows_Vista_SP2Windows_7Windows_7Windows_7_SP1Windows_7_SP1Windows_8Windows_8Windows_8.1Windows_8.1Windows_10Windows_10Windows_ServerWindows_ServerWindows_ClientWindows_ClientUSERNAME/index.php?ip=%s&id=%s&botid=%s&username=%s&key=%s%s&os=%s&count=%dAdobe Updater/33.4onion.toGETHost:aa2stvtvgxo6mv5y.onion.toOKAdobeAcrobat Update/21.0www.myexternalip.com/rawGETUser-Agent:Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\*...AppData\Desktop\ransomed.html<html lang="en">
Source: lQV0SgKoqe.exe, 00000000.00000000.1635861529.000000000012C000.00000008.00000001.01000000.00000003.sdmp Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet
Source: lQV0SgKoqe.exe, 00000000.00000000.1635861529.000000000012C000.00000008.00000001.01000000.00000003.sdmp Binary or memory string: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZUSERNAMEC:\Users\vssadmin.exe Delete Shadows /All /Quiet.AlcatrazConsoleWindowClassWindows_XPWindows_XPWindows_XP_SP1Windows_XP_SP1Windows_XP_SP2Windows_XP_SP2Windows_XP_SP3Windows_XP_SP3Windows_VistaWindows_VistaWindows_Vista_SP1Windows_Vista_SP1Windows_Vista_SP2Windows_Vista_SP2Windows_7Windows_7Windows_7_SP1Windows_7_SP1Windows_8Windows_8Windows_8.1Windows_8.1Windows_10Windows_10Windows_ServerWindows_ServerWindows_ClientWindows_ClientUSERNAME/index.php?ip=%s&id=%s&botid=%s&username=%s&key=%s%s&os=%s&count=%dAdobe Updater/33.4onion.toGETHost:aa2stvtvgxo6mv5y.onion.toOKAdobeAcrobat Update/21.0www.myexternalip.com/rawGETUser-Agent:Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\*...AppData\Desktop\ransomed.html<html lang="en">
Source: lQV0SgKoqe.exe Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet
Source: lQV0SgKoqe.exe Binary or memory string: AabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZUSERNAMEC:\Users\vssadmin.exe Delete Shadows /All /Quiet.AlcatrazConsoleWindowClassWindows_XPWindows_XPWindows_XP_SP1Windows_XP_SP1Windows_XP_SP2Windows_XP_SP2Windows_XP_SP3Windows_XP_SP3Windows_VistaWindows_VistaWindows_Vista_SP1Windows_Vista_SP1Windows_Vista_SP2Windows_Vista_SP2Windows_7Windows_7Windows_7_SP1Windows_7_SP1Windows_8Windows_8Windows_8.1Windows_8.1Windows_10Windows_10Windows_ServerWindows_ServerWindows_ClientWindows_ClientUSERNAME/index.php?ip=%s&id=%s&botid=%s&username=%s&key=%s%s&os=%s&count=%dAdobe Updater/33.4onion.toGETHost:aa2stvtvgxo6mv5y.onion.toOKAdobeAcrobat Update/21.0www.myexternalip.com/rawGETUser-Agent:Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\*...AppData\Desktop\ransomed.html<html lang="en">
Modifies existing user documents (likely ransomware behavior)
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File moved: C:\Users\user\Desktop\AIXACVYBSB\XZXHAVGRAG.pdf Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File deleted: C:\Users\user\Desktop\AIXACVYBSB\XZXHAVGRAG.pdf Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File moved: C:\Users\user\Desktop\ONBQCLYSPU.jpg Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File deleted: C:\Users\user\Desktop\ONBQCLYSPU.jpg Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File deleted: C:\Users\user\Desktop\ONBQCLYSPU.jpg Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_0011638A 0_2_0011638A
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_0011E580 0_2_0011E580
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00122F64 0_2_00122F64
One or more processes crash
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7492 -s 904
Uses 32bit PE files
Source: lQV0SgKoqe.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal76.rans.phis.spyw.evad.winEXE@4/1698@1/1
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\bc49718863ee53e026d805ec372039e9_9e146be9-c76a-4720-bcdb-53011b87bd06 Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7492
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03
Source: C:\Windows\System32\OpenWith.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7780:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\3a745af1-be60-4832-9d26-c4d9fddeee68 Jump to behavior
Source: lQV0SgKoqe.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File read: C:\Users\user\3D Objects\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: lQV0SgKoqe.exe ReversingLabs: Detection: 80%
Source: lQV0SgKoqe.exe Virustotal: Detection: 77%
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File read: C:\Users\user\Desktop\lQV0SgKoqe.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\lQV0SgKoqe.exe "C:\Users\user\Desktop\lQV0SgKoqe.exe"
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7492 -s 904
Source: unknown Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: twinui.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: actxprxy.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.ui.appdefaults.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.ui.immersive.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: duser.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: bcp47mrm.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: uianimation.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.ui.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: windowmanagementapi.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: inputhost.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: thumbcache.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: tiledatarepository.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: staterepository.core.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.staterepository.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: windows.staterepositorycore.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: mrmcorer.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: directmanipulation.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\3D Objects\desktop.ini Jump to behavior
Source: lQV0SgKoqe.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: lQV0SgKoqe.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00113BF6 push ecx; ret 0_2_00113C09
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_0011EF2D push dword ptr [esp+ecx-75h]; iretd 0_2_0011EF31
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Contains functionality to hide the console window
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_001129A0 AllocConsole,FindWindowA,ShowWindow, 0_2_001129A0
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe TID: 7548 Thread sleep time: -30000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00111F70 FindFirstFileA,GetFullPathNameA,SetCurrentDirectoryA,SetCurrentDirectoryA,GetFullPathNameA,FindNextFileA,GetLastError,FindClose, 0_2_00111F70
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Adobe\Acrobat\DC\Collab Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Adobe\Acrobat\ Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Adobe\ Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Adobe\Acrobat\DC Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Adobe\Acrobat Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Adobe\Acrobat\DC\ Jump to behavior
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: fImpt1RyTWTyxNNb+XkCOS8XsHZBEq9Ihy0TxeKLs8nydGf6XspEUym71hQ3DujcRJxRFT1rz0ie+z0jQQ5Cg+K9YUY/8MGQpxdsiEOkOugVEsENkSmHSDeSSEXkiwaZYt0pRjqBrkwFSVT8P8wol9v+BxlFxNwn0TNVmrBDU6RblCXRNTTI7+hNoC0Q6TFvrAG0s1d5gmuy6bNzBZ3biy0gnO7wYei3MgsGoMug14re3mdgNUH1hzXRbAUoV9FYspGNz4ymOt8YkrRGICqAmGE5l5BeuSBxqpZlU6KCc+0oEkC35DISPpINynMUIjQyYYvQi1J3cQYw1hEjDz5FtARqQuZWr5Wrs4u85NB1EHPJs2ZGjlbC8UmTbsnakqemUnvVfMODZBFrN4UMfT/mbKXBAj7A61HTJeeB7NU++fIFrzTJbHaaGONjUAqhKr84QEsW6Ivi7Es3phDosF4UCm6l2z1EIKiuPQY4kGUCS+fPcQjDzLzmFdGgpF6oVwsxgDEqMsG4zPgoj+MsQTQGNmNW6mrWgZ6aFZQkJErAEfSkN4f2LD0LxlFOVL4FzQs7M8sL0AleJV7u6xa4Y2hNmZfyAFxIq7tJCf0TwUO5ieAtbAmlzHiXMtX9n4rf/ujoQq7Pnn5M8VQmm5ILz1jP8SyNwQzrUW5FIOg8OrnV520on/6kwHWymIUg/8apQgJ5vdxIyFS11z+NgHKkeIq3z4jnZ3MgpwykImBoxE0sDac=bh
Source: Amcache.hve.4.dr Binary or memory string: VMware
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW8
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr Binary or memory string: VMware, Inc.
Source: lQV0SgKoqe.exe, 00000000.00000002.1849932155.000000000707E000.00000004.00000020.00020000.00000000.sdmp, MANIFEST-000001.Alcatraz.Alcatraz.Alcatraz.Alcatraz.0.dr Binary or memory string: WCx4Oic2PaZh/srrrCTAFuVgXhBNvRY2U7lXojnYqwLlfNd9JikK4lnKek4pnVm1PgdsUTmZ3rixrxWdy1ulUeyTYz2tesKYHNh3IohnVxSGhd0wJ8xuEQrjfBXDL2M9D5vqJaR3flG6sV+dx/M8lZ9oGg27kYuD7ZAN303Mcf8QnkBvTpzOl+8AEm65gkj0iQEmUGwI/dvDQyezbAc4yq5QEdtF7yuhlk2TxJWBkmJIzNQq+GUFzNXRH8g25vqNK98acK6iFmLlX1dnJd0eOLVv+V2sOEvK0iXR2HkPFC8=
Source: lQV0SgKoqe.exe, 00000000.00000003.1641398877.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW-
Source: Amcache.hve.4.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: lQV0SgKoqe.exe, 00000000.00000003.1641398877.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: previous.jsonlz4.0.dr Binary or memory string: 34d0VWRaMdq6jdmwrj3XX+IY3GdU+d4stQUL87IpMtt+yGamZAlU9pjogKpdW9KrfIOceYIK3Tw2pFijRQoMiNYTJuE7axEvhgAkJvE7tbW+vA42x9a5lR+3hZfnLfEuuwTsbrK9Htp8mbVYQ+u0mOHUQyDm/0CluSpfQrWjo7yjpbw4iIwAOhu2+O9RgALrTct8u4eLQXxqimPm7KhHm7Pp70buI9JrgMw6RPFOQOf40XXfdl3Nycbt/1EHaXz8R4crT5j+9girN00AhX8HdRbreqSr2EZTWpBsxjuCSAHfrMXEks34/Dqtp/Z54E9Qw23H8FNDDjsYbA6zh0nyszDE+7y+pz1FDrqWUiLyHEdcwb65k6xxMTFJ2szplF3rNMAWV20FcnTXUNzJKSj4Mhd6oQcW4vEzvB0UPIDLgbMoP9AezPuQD5ruV9IPTlHTesAWNWqMyDP3Ca4uaHwBIGl/m1g5A9QUIRdLxStFNhlcPixl9dJKpzlZfoat83HmqwCPgo5etXsWNAWrjw/2PiWqfG3GybaycJqd57Ht7UaMCrCbCOLhe+aBUiFFHSnr33jeLbXLmXDfGSRz+8O/QxUYbM73Qi9RgmNv790ez65BPs0R8BFLdHoNkU7hNQYkO7Padk+WCubPBs8vCDXLImzGUr2AD4kqvSO2WTPTPIIJl9h+Jf5RclpdbQXRVtj61TqvjPaevUCDkRgJkqqKj97hxCV2MBCjz0q5iEn2MKiPJHr2G2OP4fywF+ISwpf27LF0/sYPoKzA4wP/byp1qHE2gAQ4ggTu8r0EeDVqz170xLJs6bLqnM89Iw8CEvz9GV7D4JsvROWjqjOhhoo+D/Lk7sX2ay/TSDn/YUrdCLQFgcUWyBezwiwC/dKVe/xTmYfcJIYTntYdrUWlvwatT8PcsaavL8MDOdhT4AJWxWP32VDQ0xsXg8pUb57EKoIB8ouuN2nsB4wrgqyHHADrQCITANYaWFCp1gQ9FaDxXXSAPOt+cPP43NbO3qsrDuvJyouK1wVbu6VFqzU+/F2zM6JxPhFDgStRqRyLRvYIHsyUex/+3mPJ6VCCLHMSEFMTsyrp0inc9ojUWnKfDQ1bcqRrY3FzjBIkHhnpbVyZQrvL51KJ41ZykR4EMTndxlqxgY2J9q/VMcIOZfqiposaaV9MQ2Phzmb3WKNoYW9GSAs9CM7rk9+rD1IyXKyWchHBiu+LbSxG68cs7AIvYNLfkVcrZw8DNTTzgxmnYAjoYBuoH06x2b5B8GMU4nE+CWwQmi4b5JGLpedF28Y4GLnYhco7IlmDxAZmE8LlcquJnqUK6Q2BUiIpPGsiNLVemSWuSxRZrGtOt8el5lYgxleXpdhVcDTrmHqjf0ttfHhvKdqoVsTp/AMjCr41jgRndMiu+aZrkm80JXP603hxgaAcOu3hKXwd3b/wMBU/Texzdv3P9OsKlf53geJ4nt444wLPhLwPrE+bs+dR9W2d1+8FfeY66zXBuWtFLh2+PGHHenFCgLQxwN40eBhgT1GJH0ul2jw0yUWJt28VAmTQmtHczAf8O5s0fKTLNH9V3OIbKe5b+U/E24isJjYMtOOMN/KHhRcIDzDoy7I3XD7Rn55WH6P265+ne4gIJCkRnVa4lKo=
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.000000000114F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: HYGZTMOBZNLIUCJBYFLBDUAKJBLRARERXMVKEAPQMJITFUEJKUVKFODAYQEAUVRVETRCZBTSAGFPWQFMLYLDAPEFNOPKVOISCGDTAUAAJVWISHIOKHXZIYBAVXNJEWDMDYIRHTHOYDNKDCNAVKVIQRZFAPEGCJLIIYRWLYUWEAWTOKYUWAWKWQRVYDTWAZAQFPSVVBUIHWNKDDXYGEMXCNTRRPXCNAZAEHACUEYUTOUNVZMOTVTTNHNTPWIMLIWQVNEAFVTRIJPWLSEUJZKKCQJALAYIRJZXUZGZZKBAOWBWPVHJDHMMXLLYHYONGKEONUFGWAVITHRWBIZBUYQROUFLSFAMSCLPIAZKBRWXLSGSDLZUPATDCXMLGEYEIUVKOSEZUHTNGCEVISLMQJUFTADFAGWRNYOZYZSBKTBWZVBXHQHYZXQWNOTMNBSOJADGWKOBBLFJDSSNJOGFZEKHGNFSKVANLYRWPSIDYQXYLBWRDDHUWODUSEMMPQDTFTQFWVTJZJTTKBJYVWUQPFIEKHYKXRSWKOMYTFJHIHJTYVUZZQILLGLZDVONFFKATCXDYJDKCISFLSGKAGFZZGBSEKBOASZXHQUTFORYITFTDLPVQODSPUPMWBNLCIHODHFOHDHKLHCBSTZSKXTWDJKJIJHGWECZSCLEXVQFKTVHBNBFDIGBWCYIUFTYNXWINQROSYCHWXJCKPZYNZLVOOVLNCNYKQIGXRQCFJUHBKWMQUCASVTPDLYLDZRVIWXLMRUAQKCYBOEMFYUVWQKXHFUCRYJBPUBOAKKNPWARETAPJJXXUOZULUTXCQPITHNBBWWEVUTWUDRKHYDDUSHQBLIWFLPWKDUYIYTYIQKEJIOBLWDOVSETUWADBWGNDFUUJEJSRJWXWGHFPXTHUELZYPRJPNJUKSYQVDCDFZEEZLSYFNQOKCJRMASCJPYPWDPGJXUCDHEZMPLPVMCIBRIQFHGRLCNFONUMPWNQEUIWWQDYBHRVPAZEHOEYJYYTSUXKIGVO
Source: Amcache.hve.4.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: lQV0SgKoqe.exe, 00000000.00000002.1850568373.0000000007730000.00000004.00000020.00020000.00000000.sdmp, lQV0SgKoqe.exe, 00000000.00000002.1843859683.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, 4ca3cb58378aaa3f_0.Alcatraz.Alcatraz.Alcatraz.0.dr Binary or memory string: fImpt1RyTWTyxNNb+XkCOS8XsHZBEq9Ihy0TxeKLs8nydGf6XspEUym71hQ3DujcRJxRFT1rz0ie+z0jQQ5Cg+K9YUY/8MGQpxdsiEOkOugVEsENkSmHSDeSSEXkiwaZYt0pRjqBrkwFSVT8P8wol9v+BxlFxNwn0TNVmrBDU6RblCXRNTTI7+hNoC0Q6TFvrAG0s1d5gmuy6bNzBZ3biy0gnO7wYei3MgsGoMug14re3mdgNUH1hzXRbAUoV9FYspGNz4ymOt8YkrRGICqAmGE5l5BeuSBxqpZlU6KCc+0oEkC35DISPpINynMUIjQyYYvQi1J3cQYw1hEjDz5FtARqQuZWr5Wrs4u85NB1EHPJs2ZGjlbC8UmTbsnakqemUnvVfMODZBFrN4UMfT/mbKXBAj7A61HTJeeB7NU++fIFrzTJbHaaGONjUAqhKr84QEsW6Ivi7Es3phDosF4UCm6l2z1EIKiuPQY4kGUCS+fPcQjDzLzmFdGgpF6oVwsxgDEqMsG4zPgoj+MsQTQGNmNW6mrWgZ6aFZQkJErAEfSkN4f2LD0LxlFOVL4FzQs7M8sL0AleJV7u6xa4Y2hNmZfyAFxIq7tJCf0TwUO5ieAtbAmlzHiXMtX9n4rf/ujoQq7Pnn5M8VQmm5ILz1jP8SyNwQzrUW5FIOg8OrnV520on/6kwHWymIUg/8apQgJ5vdxIyFS11z+NgHKkeIq3z4jnZ3MgpwykImBoxE0sDac=
Source: Amcache.hve.4.dr Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr Binary or memory string: \driver\vmci,\driver\pci
Source: lQV0SgKoqe.exe, 00000000.00000002.1850568373.0000000007730000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: WCx4Oic2PaZh/srrrCTAFuVgXhBNvRY2U7lXojnYqwLlfNd9JikK4lnKek4pnVm1PgdsUTmZ3rixrxWdy1ulUeyTYz2tesKYHNh3IohnVxSGhd0wJ8xuEQrjfBXDL2M9D5vqJaR3flG6sV+dx/M8lZ9oGg27kYuD7ZAN303Mcf8QnkBvTpzOl+8AEm65gkj0iQEmUGwI/dvDQyezbAc4yq5QEdtF7yuhlk2TxJWBkmJIzNQq+GUFzNXRH8g25vqNK98acK6iFmLlX1dnJd0eOLVv+V2sOEvK0iXR2HkPFC8=J
Source: Amcache.hve.4.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr Binary or memory string: VMware VMCI Bus Device
Source: lQV0SgKoqe.exe, 00000000.00000002.1844314355.0000000003438000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: "VMware V[
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: lQV0SgKoqe.exe, 00000000.00000002.1843859683.0000000001130000.00000004.00000020.00020000.00000000.sdmp, CameraRoll.library-ms.0.dr Binary or memory string: FegQ8Cvs1+sGRToGcJhg8/8L5y9GiqiW9D7pOLTG1YjFq+AhXEBplGjlylNMy2haHd1x6ajqzfZnJ8a3jrXk9Sxv/OKZxzBsr5jPGFHijlzIqdJcEw2DROzjwJWhXBDFL1R8/Zxh00zrJfHTqYcWAdQ5OlvTxFE4DB9z3xSS0i0d6q1wk90ZB/v0pqm4fBZmqdLQro+vKp4DQ7TwEmc2tLLt2buARIsPPMlHa12zLh8dAV5XyKZJcmH+C+3gBAf2brSMyVIdjFHgpe91M24GdQRfJETHVyu8bv+pX89PfKYHBdYHoron8cLh0yygGdAK8UbAnWfINAVH976vba4fe3Gl/Z/hQXHFOGi3Ar2GeZ/KScfb/OET5cndG3Z51n3FJpVRQ2XiYDTcPNTYVvDgxpHzZ1G3XsIM1VltAaOShhdRif1madhrw30nJBPECmmNE8vbrcWvdd4M1TcthQtkjkaIag8Yu5LzaIaxXeToGvpWK3NfppPscFZ556AD8D+UxGNcYcYfQ0IiVxOjsX0+1HuJy12oHGfsePAlGlCokae1eExUQYJpykOZz7t8wL0D2NfU/HbEtwWGZYGJindMXH+5Z9W7zYaHnQweijjIYk5rHCVYHW7b1omwexctbCzUOcDnEcSpaLcuzOEchJqU+5xE+EncFNctqP0eQfbwSaQDToXmVivUMGnkM3n0WlPO+mEho7KbimiwqKh2J8NAjKDKoAcDeIEfBx6P1Nl+YlsBWvCigw97zdbgNKOJY9rOo33hms5p3N+4ZMBqqkYfCNhCGDuIcHLttoz/xJcuedVL0qsDzHI+3+V4EDiDyqHxav6aHDCe5PpjQ+kPV+nKJ3pm7KYcTjkHimXiFH9OOagPwS9JvIvmYSorNIPxxVsianZ+dc73WQikpYKiLApNVtLcHyAupv0PCC2BgtIOUBKEsCxvbRsqTLvRscLk8PmiZXG0KuJ++QV6d2GYY3ZmtbSLxo9cXW+7vVpVsXB6yitKscjR3Vk94S84d1goUjRHrRehhseii2QiFWSbuRZ0ET7aH2Og6N4G2prITxvHrLMWPUphYuR9xeNL54UkFPSfjyUnHLUnsfm8/qynhXUepmK6GEDvsybmrf153c1iRykNXUzu3ouiOwcpgeKxbGB68Fp5+mgShL77VUFPMhow5MHiQszEH6t+SLZ6Kpvv7vPj5ZKf0zxwtTv5/EM9/xwTZ6WtkYUMq3PFCKKV2lB4SnWpbEy8J/P5gAyt9kumSsP7bWx9it8Nm8JlY52pfEUjbgqgZiudIozwDGyrENaqaHGLp3pNoRyFyo/oXFNJkCAdzBbn7aJ7ou49rXBa4hvcYhSbLukyUfdfBIceOZNWvg==
Source: Amcache.hve.4.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00113991 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00113991
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00117720 mov eax, dword ptr fs:[00000030h] 0_2_00117720
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_0011CC7F GetProcessHeap, 0_2_0011CC7F
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00113991 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00113991
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_001131A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_001131A3
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00113AF0 SetUnhandledExceptionFilter, 0_2_00113AF0
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00114F17 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00114F17
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_00113C0B cpuid 0_2_00113C0B
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Code function: 0_2_0011387F GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_0011387F
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Overwrites Mozilla Firefox settings
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\data.safe.bin Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-update Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\events Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9b Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3f Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666f Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54e Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011f Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbc Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite.Alcatraz Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fd Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.Alcatraz Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.4.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857833.45e26519-596d-41a5-b290-e547b44111fd.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\events Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Crash Reports Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9b Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\277ffbb3-8e94-4f3f-acac-7a401d130160 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\z6bny8rn.default Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fd Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8e Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54e Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3f Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011f Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\installs.ini Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\data.safe.bin Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\7d12ac42-15c3-4db9-abfe-259bc8d249ac Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666f Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite.Alcatraz Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lock Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Crash Reports\events Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.Alcatraz Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-update Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbc Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Crash Reports\InstallTime20230927232528 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.81ddb4cc-1d49-45f2-961f-e24ea6db2be5.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Pending Pings Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9c Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528 Jump to behavior
Source: C:\Users\user\Desktop\lQV0SgKoqe.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1428494 Sample: lQV0SgKoqe.exe Startdate: 19/04/2024 Architecture: WINDOWS Score: 76 26 www.myexternalip.com 2->26 30 Multi AV Scanner detection for submitted file 2->30 32 Machine Learning detection for sample 2->32 34 Found Tor onion address 2->34 36 Deletes shadow drive data (may be related to ransomware) 2->36 7 lQV0SgKoqe.exe 861 2->7         started        12 OpenWith.exe 18 9 2->12         started        signatures3 process4 dnsIp5 28 www.myexternalip.com 34.117.118.44, 49730, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 7->28 18 C:\Users\user\Desktop\ONBQCLYSPU.jpg, Unknown 7->18 dropped 20 C:\Users\user\Desktop\...\XZXHAVGRAG.pdf, Unknown 7->20 dropped 22 C:\Users\user\AppData\...\profiles.ini, Unknown 7->22 dropped 24 66 other malicious files 7->24 dropped 38 Found Tor onion address 7->38 40 Deletes shadow drive data (may be related to ransomware) 7->40 42 Overwrites Mozilla Firefox settings 7->42 44 3 other signatures 7->44 14 WerFault.exe 21 16 7->14         started        16 conhost.exe 7->16         started        file6 signatures7 process8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.117.118.44
 www.myexternalip.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false

Contacted Domains

Name IP Active
www.myexternalip.com 34.117.118.44 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.myexternalip.com/raw false
    		high